Three months of EU AI labels: what watermarks and detectors actually prove

What's at stake

Article 50 of the EU AI Act has been in force since August 2, 2026. If you offer generative AI, its output has to be marked as artificially generated in a machine-readable way. Deepfakes and AI-written text on matters of public interest also need a visible label. Since then, Anthropic has been watermarking Claude's text, OpenAI announced "textGrain" for ChatGPT in the EU in October, Google marks content with SynthID, and Meta uses "Content Seal". On November 4, Pangram also unveiled two detectors for images and video.

Three months in, we wanted to know: what can a journalist, a teacher or a platform actually prove reliably today? To find out, we looked at four layers separately: text watermarks, image watermarks, C2PA metadata and after-the-fact detectors.

First, two corrections to common claims. One: the EU is no longer undecided. According to law firm Reed Smith, the Commission deemed the voluntary code of practice from June adequate on July 8, 2026, and the member states' AI Board followed on July 9. Signatories can rely on it. It's not a guaranteed safe harbor, though, since regulators can still investigate. Around 190 organizations had signed by the end of July. According to Faegre Drinker, fines can reach €15 million or 3 percent of global annual turnover. Systems already on the market before the deadline have until December 2, 2026. By February 2, 2027, signatories have to offer verification tools that work across providers. Two: whether the Claude watermark has been "bypassed" is a matter of nuance. More on that below.

Text watermarks: measurable, but only for insiders

Anthropic uses a variant of Google's SynthID Text. A secret key nudges the model toward certain candidates when it picks words. Anyone holding the key counts those hits and estimates statistically whether the text came from the model. There are no hidden characters involved.

How well this works in practice is almost impossible to verify from the outside. That's why researchers at Case Western Reserve University (Nemecek, Chaudhary, Ayday) tested the open-source SynthID Text implementation on two open models, Gemma-2-9B and Llama-3.1-8B, in their paper "Watermarks Without Verification". At a 1 percent false-positive rate, they detected only 39 percent of watermarked 200-token texts (a token is roughly a piece of a word). At 400 tokens, the rate rose to 56 to 59 percent. For code, detection was practically random. Text quality, on the other hand, barely suffered. The authors argue the real failure is the lack of verifiability, not the watermark itself.

OpenAI reports better numbers for textGrain, but they're its own measurements. According to OpenAI, at a 1 percent false-positive rate it catches about 80 percent of 200-token texts and 95 percent of 400-token texts. Swap 10 percent of the words for synonyms and detection falls from around 92 to 66 percent. At 25 percent swapped words, only 17 percent are still caught. You can't verify these figures, because OpenAI's detector is also only available to "approved researchers and expert organizations".

Against deliberate rewriting (paraphrasing), the methods barely hold up. A study by Tamim and Khan (arXiv, July 2026) tested three methods against the admissibility standards of US courts. After paraphrasing, SynthID Text lost the watermark in 98.3 percent of cases. At the same time, it flagged 5.4 percent of paraphrased human-written control texts as AI. The authors' verdict:

"These configurations, as tested, do not meet the evidentiary standards that courts require."

That leaves Guillaume Meyer's much-discussed remover tool, which now has more than 26,000 GitHub stars. What it promises is surprisingly modest. It verifiably strips invisible Unicode characters and file metadata. Against the actual text watermark, it has another model rewrite the text, and it calls that "best effort" itself. The README states that as long as providers don't publish public detectors and keys, "no tool can honestly guarantee" that the official check will fail. What is documented, however, is a gap Anthropic admits itself: according to its help page and The Decoder, the watermark doesn't reliably appear in Opus 4.6 and Sonnet 4.6 output when temperature, top_p or top_k differ from the defaults. These settings control how randomly the model picks its words.

One detail in the Commission's July 20 guidelines makes things harder for teachers. According to Faegre Drinker, AI translations count as standard editing there and don't need to be labeled. Claude still fully watermarks translations, though, because the model chooses every word itself. So if you only use it to translate, your text carries a mark the law doesn't even require.

Image watermarks: sturdier, but not unbreakable

Images leave more room to hide a signal invisibly in the pixels. Google DeepMind said in October 2025 that SynthID was embedded in more than 10 billion images and video frames. There are still attacks, with very different levels of evidence:

• UnMarker (IEEE Symposium on Security and Privacy 2025, so peer-reviewed, and not USENIX as often reported): According to IEEE Spectrum, it removed 57 to 100 percent of watermarks depending on the method. For SynthID, author Andre Kassis says it cut detection from 100 to about 21 percent. Google DeepMind disputed that success rate.
• reverse-SynthID (around 5,000 stars): Using frequency analysis, the developer found a fixed carrier pattern and reports a 91 percent weakening of the key signal components. For the latest version, he lists 20 images that supposedly fooled the Gemini detector, checked manually in the Gemini app. According to reports on reporting by The Verge, Google spokesperson Myriam Khan said it was false that the tool could systematically remove SynthID.
• Meta's Content Seal: According to a Reuters analysis from July, Meta's detector recognized all 40 original images. After cropping them to a third to half their size, it missed 55 percent, even though Meta promises the opposite on its website.

One counterpoint from this year: according to a preprint (arXiv 2605.09203), six tested removal tools, including UnMarker, leave traces of their own. Specially trained detectors found those traces in more than 98 percent of cases at a 1 percent false-positive rate. After heavy JPEG compression, though, the rate dropped significantly, to 74.5 percent for UnMarker.

C2PA: the signature that vanishes on upload

C2PA ("Content Credentials") isn't a watermark but a signed provenance record stored in the file, a bit like a sealed package insert. Anyone can read it for free, for example with Anthropic's "Claude Content Checker". The problem is that it rarely reaches the viewer. In a Washington Post test in October 2025, secondary reports say seven of eight platforms stripped the data, and only YouTube showed a hidden notice. According to several reports, Meta reads C2PA on upload to apply its "AI info" label, then serves the file without the credentials. WhatsApp discards the data when you send a photo normally. These platform details come mostly from vendor blogs and haven't been officially confirmed. Either way, a screenshot is enough to remove the record, and Meyer's tool strips C2PA at the push of a button.

After-the-fact detectors: fact-checking Pangram's 99.2 percent

Detectors like Pangram don't need a watermark. They look for traces left by the generation process. Here are the numbers behind Pangram Image 1.0:

DF26 is an independent dataset of 271 real and 2,420 fake talking-head videos. Humans spotted only 52.6 percent of the fakes. Pangram says its score is "29 points" better than the next-best detector. In the DF26 paper, the best score is 69.7 AUROC, a measure of how well a detector separates real from fake. But that score comes from nine academic detectors trained on older data (FaceForensics++). No commercial services were included. Our take: the comparison pits Pangram's accuracy figure against a different metric and says little about competitors like Hive or Reality Defender.

Run the numbers for a platform: a 0.27 percent false-positive rate means roughly every 370th real photo gets flagged. Across a million uploaded photos, that's around 2,700 false hits. Even Pangram struggled with this: according to Engadget, the company delayed its launch because the model mistook iPhone 18 Pro photos for AI. Smartphones already sharpen images with AI anyway. In a test shared by co-founder Max Spero, the browser extension rated two obvious AI images only as "uncertain". Five images a day are free; video requires a subscription.

NewsGuard showed in May how much detectors vary in real-world use, with 45 images related to the Iran war. Depending on the tool, the false-positive rate for real photos ranged from 0 percent (Hive, Sightengine) to 40 percent (ScamAI). Sightengine, in turn, missed two-thirds of the heavily manipulated images. For 35 of the 45 images, the tools contradicted each other at least once. Hive rated a real video of Netanyahu as AI with 96.9 percent confidence.

Who can prove what today?

The bottom line

Our take: labeling works where nobody is trying to deceive, for example when a platform labels honestly uploaded Gemini images. If someone sets out to deceive, text is easy to launder, while images take more effort. Teachers are in the trickiest spot: they don't get access to the text detectors. And a hit could just as well be a permitted translation or proofreading pass. Journalists can use image watermarks and C2PA, but should never read a negative result as proof of authenticity. For platforms, detectors are a filter, not a verdict.

The code's requirement that providers offer verification tools "in principle free of charge" is so far little more than a box ticked on paper. In practice, only selected organizations can check text, and there are no independent error rates for the systems in use. Whether Anthropic, OpenAI and Google deliver open, shared verification services by February 2027 is the real test of this regulation. Until there's an independent comparison, Pangram's new figures are vendor claims, nothing more.