The AI watermark paradox: why marking content is easier than proving who made it

The rule and the real question

Article 50 of the AI Act says that providers of general-purpose AI models with systemic risk must ensure their systems are technically capable of detecting and marking AI-generated content in a machine-readable format ^[1]. For systems placed on the market from 2 August 2026, the duty applies immediately. Systems already on the market get until 2 December 2026 ^[2].

The marking is less a 'contains nuts' sticker and more a barcode: machines read it, people barely notice it. The point is downstream detection, so platforms, fact-checkers and rights holders can identify AI outputs as they spread.

But here's the paradox. A watermark proves a file has a mark. It doesn't prove who put it there, or when, or whether the file is the one a particular system made. The moment someone questions the origin, the question shifts from 'does it have a watermark?' to 'can you show this came from your model?'

Article 50 doesn't ask for that proof, but the question comes up anyway.

How watermarks work, and where they fail

Watermarks come in two broad types. Signal-based watermarks embed patterns in the output itself—statistical tweaks in token selection for text, imperceptible noise in images ^[3]. They survive some transformations but not all. Compress an image, crop it or run it through another tool and the watermark can fade or vanish entirely.

Metadata-based approaches attach information to the file, like EXIF data in a photo. They're easy to strip. Open an image in an editor, save it again and the metadata is often gone ^[3].

Neither approach is tamper-proof. That's not a flaw in the technology; it's a feature of how digital content moves around. People edit things. Platforms resize them. Compression algorithms don't care about provenance.

Adobe's Content Credentials system takes a different route. Instead of embedding a signal in the content, it builds a verifiable chain of actions: who created the file, which tools were used, what edits were made ^[4]. That lineage is cryptographically signed and stored separately, so even if the file is changed, the original record of its creation stays intact. It's closer to a receipt than a watermark.

The lineage question

Say a synthetic voice clip turns up without a watermark. Someone asks: did your model generate this? If the watermark is gone, what's left?

A lineage record keeps a log of what the system made. Not the content itself—just a fingerprint, a timestamp and enough context to match a disputed file to a known generation event. When the question comes, you calculate the fingerprint of the disputed file and check whether it matches anything in the log.

That's the idea behind content provenance systems like Adobe's. They answer a different question from watermarks: not 'does this file have a mark?' but 'was this file made by this tool, at this time?' ^[4].

What a digital witness seals

Here, the thing to seal is a record of each generation as it happens: what was generated, when, and by which model version. The content itself stays with the provider—only a fingerprint goes to the witness.

Sealing happens at generation. When a model outputs an image, a passage of text or an audio clip, the system logs the event and sends a fingerprint of the output to WitniumChain through the REST API, the SDK or the MCP server. The witness returns an ID, and that ID is stored with the log entry.

Months later, if a file turns up and someone asks whether it came from your system, you calculate its fingerprint and compare it with the sealed log. If it matches, you can show that the file existed at that time, unchanged, and that your system generated it. If it doesn't match, you know it's not in your records.

Anyone you share the log with can check the fingerprint themselves. The record is yours, the check is theirs, and neither party has to trust the other.

What the witness doesn't do: it doesn't replace the marking duty in Article 50. It doesn't embed anything in the content, and it doesn't decide whether a file is lawful to distribute. It shows that a generation record existed and hasn't changed. Whether the content itself was appropriately marked is a separate matter.

The first 2,000 witnesses a month are free. Find out more at witniumchain.com or read the documentation.

How it would work

1. Your model generates an image. Your system calculates its fingerprint and logs the generation event.
2. The fingerprint is sealed with WitniumChain. The content stays with you.
3. If the image is questioned later, you recalculate its fingerprint and check whether it matches the sealed log.

What this means for you

If you provide a general-purpose AI model with systemic risk, Article 50 already asks you to mark outputs. That's one duty. Keeping a record of what your system generated is another, and it's worth deciding early how that record will work:

• Can you show, six months after the fact, whether a particular file came from your model?
• If a watermark is stripped or lost, what's your backup?
• Who keeps the generation log, and how do you prove it hasn't been edited?

Lineage systems like Adobe's Content Credentials answer some of these questions for content creators. A digital witness gives providers a sealed log of their own outputs, checked without trusting whoever keeps the log.

The marking makes detection possible. The lineage makes the answer hold up.

What to watch

2 August 2026: Article 50 marking requirements apply to new systems.

2 December 2026: Systems already on the market must also mark their outputs ^[2].

Technical standards for watermarking and detection are still being developed, and questions about their robustness, interoperability and long-term reliability remain open ^[3][4].