Text-marking obligations under the EU AI Act become enforceable this month for new systems, with systems already on the market given until December. The obligation asks vendors for machine-readable marking of AI-generated text. Sean Goedecke, a staff engineer at GitHub, published an argument in 2026 that the control being demanded cannot survive contact with the requirement that defines it.
His technical claim is narrow and checkable. The regulatory reading around it is not his field, and he says so: he rests the legal interpretation on Recital 133 and the Code of Practice rather than on the plain text of Article 50. Treat the legal boundary as contested. Treat the engineering boundary as settled.
The hiding budget is one token wide
A watermark has to live somewhere in the artifact. In an image, it lives in pixel values the eye does not resolve. In audio, in frequency bands the ear discards. Both media carry enormous redundancy, which is exactly the room a signal needs.
Text has almost none. At each generation step, the model selects one token from a vocabulary of roughly 100,000. That selection is the entire budget available to hide anything. Everything else in the output is a consequence of that choice and the choices before it.
The mechanism Goedecke describes for a SynthID-style scheme works inside that budget. Sum the token’s ID with the IDs of its previous three tokens, take the result mod 5, and you have a score. Out of the top five most likely next tokens, pick the one with the top score. Over thousands of tokens, the statistical skew becomes detectable. Over one paragraph, it does not.
The constraint that bounds every scheme of this shape is stated plainly in the piece: “you cannot make any change to a sentence that a human wouldn’t notice.” Any perturbation strong enough to survive editing is strong enough to degrade the writing. Any perturbation weak enough to preserve the writing dissolves under a rewrite, a translation round trip, or a second model asked to say the same thing in its own words.
Interoperability removes the only defense
Here the mandate turns on itself. The regulation asks for marking that is detectable in an interoperable way, so that a platform, a regulator, or a downstream buyer can verify provenance without a private arrangement with each model vendor. That is a reasonable governance ask. It is also the thing that kills the control.
A statistical watermark is a secret key applied to a public artifact. Its resistance to removal comes entirely from the attacker not knowing which tokens carry the signal. Publish the detector, or standardize the scheme across vendors so detection can be shared, and the removal recipe becomes public in the same motion. Whatever a detector can find, a stripper can undo.
Image watermarking tolerates this better because the pixel budget absorbs redundancy: you can spread a signal wide enough that removing it damages the image. Text offers no equivalent. The signal and the content occupy the same tokens.
The homoglyph family shows the same shape at a cruder level. Substituting a standard space (U+0020) with a three-per-em space (U+2004) or a CJK ideographic space (U+3000) plants an invisible marker in a way any reader would pass over. There is documented precedent for the technique in production: Claude Code used homoglyph steganography on the apostrophe in “Today’s date” to tag suspicious requests, an approach since walked back. Character substitution survives copy and paste. It does not survive a single pass through a normalizer, and normalization is a three-line function.
C2PA signs files, and agent output is not a file
The provenance work most enterprises are actually funding is C2PA: cryptographic manifests bound to media files, tracking capture, edits, and tool chain. It is real, it is shipping, and it does not reach the surface that matters most for agent operations.
Goedecke draws the boundary precisely: “C2PA is not a substitute for text watermarking… The output of chat tools (and most of the output of AI agents) is not containerized text, but plain old regular text, and so can’t be signed. What would it even look like to sign ChatGPT outputs? There’s no artifact to pass around.”
Sit with what that excludes. The pull request description an agent wrote. The Jira comment. The Slack message. The row inserted into a customer record. The summary pasted into a board deck. None of these is a file with a container to hold a manifest. All of them are places where the question “did a human write this, and did a human check it” carries real operational weight.
An enterprise can be fully C2PA-compliant on its marketing assets and have zero provenance coverage on the text its agents produce inside its own systems. That is the practical exposure, and it exists whether or not the EU obligation is ever enforced against anyone.
What actually carries provenance
If the artifact cannot carry the signal, the system around it has to. That shifts the control from cryptography to logging, and logging is a solved problem that most teams have simply not applied to agent output.
Provenance you can defend has three properties. It is recorded at generation time, by the system that generated the text, rather than inferred later from the text itself. It is bound to an identity, so the record names which agent, under which task, on whose authority. And it travels with the destination, not with the string: the commit, the ticket, the database row carries the reference.
We argued the recording side of this in the agent diary as an audit trail. The disclosure side is the same discipline that makes model cards work as a product surface rather than a PDF nobody opens. And when you buy an agent platform, this belongs in the same clause set as everything else in guardrails as a procurement variable: ask the vendor what record exists at the moment of generation, and where it is written.
A vendor who answers “we watermark the output” is describing a control that a paraphrase defeats. A vendor who answers “every generation writes a signed event to your log sink, with agent identity and task reference” is describing something an auditor can use.
Do this now
Take one system where agents write text into a place humans read as authoritative. A pull request body, a customer-facing reply, a field in a record. Then answer two questions with evidence rather than intent.
First: if someone asks in six months whether an agent wrote a specific piece of that text, what artifact answers? If the answer is “we would have to guess from the writing style,” you have no provenance on that surface, and no watermark scheme on the roadmap will give you one.
Second: does that answer survive a copy and paste? Move the text into another system and check whether the record follows. If provenance lives inside the characters, it is already gone.
Budget the compliance work for the EU obligation on the assumption that the marking requirement will be met formally and defeated trivially. Spend the real effort on generation-time records, because that is the layer that still works after the text has been edited, translated, and pasted somewhere nobody expected.
This analysis synthesizes Text AI watermarks will always be trivial to remove (Sean Goedecke, staff engineer at GitHub, 2026).
Victorino Group helps engineering organizations build generation-time provenance for agent output, so audit questions have answers that survive editing. Let’s talk.
All articles on The Thinking Wire are written with the assistance of Anthropic's Opus LLM. Each piece goes through multi-agent research to verify facts and surface contradictions, followed by human review and approval before publication. If you find any inaccurate information or wish to contact our editorial team, please reach out at editorial@victorinollc.com . About The Thinking Wire →
If this resonates, let's talk
We help companies implement AI without losing control.
Schedule a Conversation