The State of AI Watermarking: Who Has It, Who Doesn’t, and What It Catches

As of 2026, only one major lab ships a text watermark at scale: Google, whose SynthID-Text marks Gemini output — OpenAI built one and shelved it, Anthropic has none, and open-weight models can’t enforce one at all. If you’ve been wondering which AI models have watermarking baked in, the honest answer is “far fewer than the headlines suggest,” and the gap between what regulators want and what the technology delivers is where all the interesting detail lives.

Key takeaways

• Text watermarking exists and works in a narrow lane: Google’s SynthID-Text is deployed on Gemini, published in *Nature*, and open-sourced.
• OpenAI has confirmed it built a text watermarking method for ChatGPT and chose not to release it, citing easy circumvention and fairness concerns.
• Open-weight models (Llama, Mistral, and the rest) effectively can’t be watermarked, because whoever runs the model controls the step where the mark would be added.
• New rules in the EU and China now require marking AI-generated content — but a legal mandate doesn’t make the marks durable.
• No school, employer, or third-party detector can check for these watermarks. What they use instead is probabilistic guessing.

What a text watermark is (and what it isn’t)

A text watermark isn’t a hidden character or an invisible logo. It’s a statistical bias in word choice. As the model writes, a secret key nudges it toward certain “green-listed” tokens, and a detector holding the same key can later count how strongly the text leans green. The foundational method came from Kirchenbauer and colleagues in 2023, and every production system since is a variation on that theme.

Three things follow from that design. The signal is spread across the whole passage, not stored in any one word. Checking for it requires the provider’s key, so only the company that made the mark can verify it. And because the mark lives in word choice, changing the words weakens it — we’ve written a full breakdown of whether watermarks survive paraphrasing and editing, and the short version is: not well.

Watermarking is also not the same thing as provenance metadata. Standards like C2PA attach signed “nutrition labels” to files rather than hiding signals in the content itself — a different bet with different failure modes, which we cover in our piece on content credentials for written text.

Which AI models have watermarking today

Here’s the map as it actually stands, lab by lab.

Google — yes, deployed. SynthID-Text is the one production-scale text watermark in the wild. DeepMind published the method in *Nature* in October 2024, reported testing it across millions of Gemini responses, and open-sourced an implementation so other developers could adopt it. Google also watermarks images (Imagen) and audio with SynthID variants. If you use Gemini, your output is likely marked — though only Google’s tooling can check for it.

OpenAI — built, then shelved. OpenAI has said publicly that it developed a text watermarking method it considered highly effective on unedited output. It has not shipped it. The company’s stated reasons: the mark is trivially weakened by paraphrasing or translation, and releasing it could disproportionately harm legitimate users — students writing in a second language, for instance — while barely slowing down anyone determined to cheat. ChatGPT output today carries no watermark.

Anthropic — nothing announced. Claude has no publicly disclosed text watermarking system as of this writing.

Meta and the open-weight world — structurally unable. This is the part most coverage misses. Watermarking happens at generation time, in the decoding step the provider controls. With open-weight models like Llama, anyone can download the weights and run their own decoding — meaning any watermark is optional, and an optional watermark is not a watermark. Meta has shipped watermarking research for images and audio, but open text models remain unmarked by design of the distribution model itself.

Why the pressure is rising anyway

If the technology is this leaky, why does everyone keep building it? Regulation, mostly.

The EU AI Act’s transparency rules require providers of generative systems to mark AI-generated content in a machine-readable way, with those obligations applying from August 2026. China moved earlier and harder: its labeling measures for AI-generated content took effect in September 2025, requiring both visible labels and embedded technical marks. Neither regime dictates a specific technology, and neither can make a statistical signal survive a paraphrase — but both make “we ship a watermark” a compliance requirement rather than a research demo.

The result is a strange equilibrium: labs are building marking systems to satisfy regulators, while being candid in their own papers that the marks are fragile.

What a watermark actually catches

Within its lane, watermarking genuinely works. The realistic catch list looks like this:

• Unedited, copy-pasted output from a cooperating model, checked by that provider’s detector. This is the core case, and detection confidence on long, untouched passages is high.
• Lightly edited output, sometimes. SynthID-Text was engineered to tolerate small edits, and a long document holds signal better than a short one.
• Bulk platform abuse. For a provider scanning its own traffic — spam farms, fake reviews, coordinated content — watermark checks are cheap and effective at scale.

What it misses

The blind spots are bigger than the coverage:

• Everything from non-watermarked models — which today means ChatGPT, Claude, and every open-weight model. That’s most AI text in existence.
• Paraphrased or translated output. The mark lives in token choice; rebuild the tokens and the mark fades. This is the attack every published scheme still loses to.
• Human writing, obviously — but note the inverse problem: a “no watermark” result is the default state of nearly all text on earth, so it proves nothing about authorship in either direction.
• Anything checked by a third party. Turnitin cannot see Google’s key. No watermark check is happening in your classroom or newsroom today.

That last point deserves a beat. The tools schools and employers actually run are probabilistic detectors — pattern-matchers with documented error rates, including a bias against non-native English writers that Stanford researchers measured back in 2023. Watermark verification and AI detection get blurred together constantly in coverage, and they shouldn’t be. One is cryptographic-ish certainty about a cooperating model’s output; the other is an educated guess. If you want to see what the guessing looks like from the inside, you can browse the rest of our writing on detection.

What this means for you

If you write with AI assistance, watermarking changes less than you’d think in 2026. Your Gemini drafts are marked, but only Google can check. Your ChatGPT drafts aren’t marked at all. What actually determines whether your writing gets flagged is the same thing it’s been for three years: how the text *reads* to a statistical classifier — its rhythm, predictability, and specificity.

That’s worth acting on directly. Run your draft through a detector before anyone else does, revise the parts that read as machine-flat, and make the writing genuinely yours. Our detector is free to try on your own text, and if you’re working at volume you can see what each plan handles.

Frequently asked questions

Which AI models have watermarking built in right now? For text, Google is the only major lab shipping one at scale: SynthID-Text runs on Gemini output and the underlying method was published in Nature and open-sourced. OpenAI built a text watermarking system but has held it back, Anthropic hasn’t announced one for Claude, and open-weight models like Llama can’t enforce one at all, because anyone running the model locally controls the decoding step where a watermark is applied.

Does ChatGPT watermark its text? No. OpenAI confirmed in 2024 that it built a text watermarking method it considered highly accurate on unedited output, but chose not to release it, citing how easily paraphrasing or translation defeats it and the risk of unfairly stigmatizing groups like non-native English speakers who use AI as a writing aid. ChatGPT text carries no hidden mark you or a teacher could check for.

Can a teacher or employer check text for an AI watermark? Generally no. Detecting a statistical watermark requires the provider’s detector and key — Google can check for SynthID, but Turnitin and GPTZero cannot. The AI detectors schools and employers actually use are probabilistic classifiers that guess from writing patterns, which is a completely different technology with a real error rate in both directions.

Do laws require AI companies to watermark text? Increasingly, yes — in some places. The EU AI Act’s transparency rules require providers to mark AI-generated content in a machine-readable way, with those obligations applying from August 2026, and China’s labeling measures for AI-generated content took effect in September 2025. The catch is that the rules require marking in general, not any specific unbreakable technology, and text remains the hardest medium to mark durably.

If watermarking spreads, will AI detectors become obsolete? Not soon. A watermark only proves something about text from a cooperating model, checked by the provider’s own tool, and it degrades under paraphrasing and translation. Everything else — human writing, open-model output, edited AI text — still lands in the gray zone where probabilistic detectors operate. The two approaches will likely coexist, each covering the other’s blind spots.

The bottom line

The state of AI watermarking in 2026 is one deployed system, one shelved system, and a regulatory wave demanding more of both. It’s real technology solving a narrower problem than the public conversation assumes: it can tag unedited output from a cooperating model, and that’s about it. For everyone else — writers, students, editors — the practical landscape is unchanged. What gets judged is how your text reads, not what invisible signal it carries.