Why the EU's plan to watermark AI text has a built-in escape hatch

The EU's new AI-text watermark rule took effect on 2 August. The deadline that actually binds vendors is 2 December: from that date, every AI model already deployed in the EU market must mark its text as machine-made, in a way third parties can later verify.

The rule sits inside the EU AI Act and covers images, audio, and video as well as text. For images and audio, the watermarking problem is comparatively tractable. Those media are dense, redundant, and can hide a signal in pixels or frequency bands that survive resizing, recompression, and re-recording. A photo carries roughly a million bits per pixel; an audio sample carries a continuous waveform. The watermark can be smeared across the redundancy and still come back intact. Text is the opposite. There are no pixels to hide a pattern in, only words, and a single sentence carries something on the order of a few hundred bits of meaning that the reader actually wants to see. The standard text-watermarking technique exploits that small budget by choosing between the model's top two candidate next-words in a way that encodes a detectable statistical fingerprint, without changing what the sentence means. Reading the pattern back requires a detector trained to recognize that bias.

Light editing, paraphrasing, translation, or a synonym swap erases the bias. So does running the output through any tool that nudges word choice, even one designed for an entirely different purpose, like a tone adjuster or a grammar fixer. James Padolsey, who runs the AI safety firm NOPE, has published a small web app called declaude that does exactly this: it lightly rewrites AI-generated prose so existing AI detectors, and, by his argument, vendor watermarks, stop firing. Padolsey frames the tool as documentation of a limitation the rule does not yet address, not as an exploit.

OpenAI already watermarks ChatGPT-generated images and audio and says it plans to add text watermarking in future. Anthropic has said future Claude models will watermark text. Both announcements are forward-looking. Neither vendor currently ships a text watermark that survives the kind of rewrite Padolsey's tool performs, and the AI Act gives vendors roughly four months to ship one that does.

The watermarking obligation binds the company that places a model on the EU market. Open-weight models, the kind anyone can download and run on their own hardware, are not controlled by a single vendor and are not in scope. A user who wants untraceable AI text can run Llama, Qwen, Mistral, or any of a growing list of open-weight models without the watermark ever existing. The provenance signal only attaches to the people who would have used a watermarked service anyway, which is roughly the population least likely to want to evade it.

Stronger statistical biases can survive light paraphrasing. Companion detectors can look for stylistic rather than lexical tells. Provenance metadata can travel in a separate channel, like a signed header or a content credential, rather than baked into the words. Each of these helps. None of them changes the underlying asymmetry. Text has orders of magnitude fewer bits per character than an image of the same sentence, and a watermark has to compete for those bits with whatever the user wants to say. The medium sets the ceiling.

The 2 December deadline will test how close the major labs can get to that ceiling in four months. If compliant text watermarks are in shipping products by then, the gap Padolsey demonstrated closes, at least until the next round of rewrite tools. If they are not, the rule remains in force, the label is technically present on every model the EU can reach, and the label is, in practice, optional for anyone who runs the text through a paraphrase pass first. The European AI Office, which will handle enforcement, has not yet said what a non-compliant text watermark looks like under the Act.