AI watermarking and your deliverables

What changed, and who can see it

The situation, rather than the technology, is what matters first: text produced with frontier AI is becoming machine-detectable, and the parties positioned to run that check are the ones a consultant or regulated expert answers to, sponsors, agencies, HTA reviewers, and clients enforcing their own contracts. Anthropic announced in August 2026 that Claude models launched in the EU on or after 2 August 2026 mark their text output at launch, 2 August being the date the EU AI Act's transparency duty applies, not a date Anthropic chose. Anthropic has said it is working to add marking to older covered models. Google has used SynthID on Gemini text since May 2024. Other providers are implementing their own schemes on their own timelines.

Two qualifications matter, and both cut less comfortably than they first appear. (1) Detection is not open to the public, but it is not absent either. Anthropic has a detection API in private preview, available to regulators, law enforcement, media, fact-checkers, researchers and civil-society bodies. That is a narrower group than "anyone", and a much more uncomfortable one: it is broadly the set of parties who would have reason to ask. (2) Coverage is widening, not frozen: models launched in the EU on or after 2 August 2026 mark at launch, and Anthropic has said it is working to extend marking to older covered models. What is genuinely unaffected is text that was already generated before marking existed, the exemption attaches to output already produced, not to a model that stays permanently unmarked. Exposure begins now and grows from here.

It means work augmented with AI will now carry a mark showing that AI was involved. It does not show how much, or how. A consultant or regulated expert who used AI to tighten prose under close human review and one who outsourced an entire deliverable can produce the same signal. The watermark does not distinguish them. A record does.

What actually gets marked, and how

Text and files are two different mechanisms with different properties, and conflating them leads to bad decisions.

Because the text signal is carried in word choice, it survives copy-paste into another document and can persist through some editing. Provider-by-provider coverage is uneven and still moving, so the practical assumption is that any frontier-model text may be marked, or soon will be.

What reformatting does not do

You cannot strip a text watermark by cleaning up the file. Retyping the document, find-and-replace, normalising Unicode, converting between formats, pasting through a plain-text editor: none of it touches a signal carried in which words were chosen. There are no invisible characters to remove because none were inserted.

Paraphrasing is a different matter, and it is worth being straight about it. The published robustness work finds that meaning-preserving rewriting: paraphrase, back-translation, heavy copy-paste editing, does measurably degrade detection of statistical text watermarks. That is what a commercial "humanizer" attempts, and the honest position is that it can work in the narrow technical sense. The case against it does not rest on the technique failing. It rests on the three things that remain true whether or not it succeeds: it breaches the provider's terms, you cannot verify the result, and deliberate removal is evidence of intent to conceal in front of a regulator, an HTA agency or a client.

Can it be removed, legally?

As of August 2026, no general US or Canadian statute makes removing an AI watermark an offence on its own. Here is what it actually means, and what it actually breaks:

• It breaches the provider's terms of use. The practical consequences are throttling, suspension or termination of access.
• California's AI Transparency Act builds revocation into the supply chain, for images, video and audio. A covered provider that learns a licensee has stripped or disabled a latent disclosure must revoke that licensee's access within 96 hours (Bus. & Prof. Code § 22757.3(c)(2), operative 2 August 2026). Read the scope before relying on it: the Act's disclosure duties cover “image, video, or audio content” and do not extend to text. It does not govern the text marks this page is about. It is worth knowing because it shows legislatures building enforcement into the vendor relationship rather than the regulator's, not because it binds a written deliverable today.
• In the EU, Article 50 places the marking duty on providers. The emerging reading is that deployers must not suppress or defeat provider-embedded disclosures. Where a deployer carries its own disclosure duty, removal works directly against it.
• Deliberate removal is evidence of intent to conceal. This is the decisive point for regulated work. It converts a compliance question into a bad-faith question, in front of a regulator, an HTA agency, a government body, or a client that simply wants transparency, and bad faith is a far worse position to argue from than an unauthorized-tool finding.

Article 50 of the EU AI Act, which requires providers to ensure generative output is marked in a machine-readable format and detectable as artificially generated, applies from 2 August 2026. That regulation is the driver behind the whole rollout, and it is moving in one direction.

A watermark is not the problem

The instinct is to treat detectability as a threat. It is only a threat to work that cannot be explained. Hiding it, or doing it secretly, is not the answer, but transparency is.

Start from what the field already accepts. AI-assisted and AI-augmented documents are legitimate. Guidance in HEOR assumes AI use and asks for human oversight, transparency about AI involvement, and traceability that survives scrutiny, but none ask to avoid it. ISPOR named AI the top HEOR trend for 2026–2027, and an ISPOR Working Group has published a taxonomy of generative AI applications across the HEOR workflow (Fleurence et al., Value in Health 2025;28(11):1601–1610). The same working group's report on health technology assessment is explicit that these models are to augment human work, not replace it: foundation models, it says, should augment “human activities for which humans remain fully accountable” (Fleurence et al., Value in Health 2025;28(2):175–183). It also calls for reporting guidance and checklists covering validation, reproducibility and bias. Nobody in that conversation is arguing that using AI is the violation, the argument is about the conditions, and every one of them is a condition about the record.

What creates exposure is something else: unauthorized disclosure of confidential values, secrets and unpublished data, and the absence of any record of what was done. Those are two separable problems, and they have separate solutions. Cloaking addresses the first, the confidential value is replaced on your own computer, so the model never receives it. The audit trail, such as the Untraceable Protocol, addresses the second. Solve both and a mark on the deliverable is not a finding. It is corroboration: evidence consistent with a workflow you can already document.

Why an AI humanizer has no place in regulated work

A whole category of tools now offers to rewrite model output so it "reads as human" and clears AI detectors. For a consultant or regulated expert, adopting one is a bad trade on every axis that matters.

• It does not do what it claims on text. The provider watermark is statistical, carried in word choice. A tool that paraphrases is, at best, guessing at which words carried the signal, and you have no way to verify the result, because the detection tooling is not public yet.
• It breaches the provider's terms of use. The same exposure as stripping a mark directly: throttling, suspension or termination of access.
• It runs against the direction California has already set. A covered provider that learns a licensee has disabled a latent disclosure must revoke that licensee's access within 96 hours, a duty that currently reaches image, video and audio rather than text (Bus. & Prof. Code § 22757.3, operative 2 August 2026). Using a humanizer on text is not caught by that provision today; it is simply the same conduct the statute was written to stop.
• It works against the EU Article 50 direction of travel. The emerging reading is that deployers must not suppress or defeat provider-embedded disclosures. Where you carry your own disclosure duty, a humanizer defeats it.
• It is the intent problem in its clearest form. Stripping a mark can at least be argued as a formatting accident. Buying a tool whose stated purpose is to evade AI detection cannot. In front of a regulator, an HTA agency, a government body or a client that simply wants transparency, that purchase is the finding.
• It degrades the deliverable. Paraphrasing for evasion optimises for reading as human, not for being correct. In regulated writing, where a number or a qualifier carries the meaning, that is the last thing you want a machine doing unsupervised.

The tell is that a humanizer solves a problem you should not have. If the AI use was authorized, scoped and free of confidential values, there is nothing to evade. If it was not, the humanizer does not fix that, it just removes your ability to explain it.

Our position, plainly. Untraceable does not hide, disguise, strip or degrade watermarks, and we would decline to build that. We treat them as one more element of provenance. The reason is straightforward: a company whose product is auditability cannot also sell concealment, and any vendor offering both is telling you what it actually values.

Why the audit trail turns this to your advantage

Set the two situations side by side. A sponsor detects a mark in a delivered dossier and asks about it.

The shareable audit is safe to give to a sponsor or an agency, while the complete version, the one including real values, is regenerated client-side and never leaves your own tenant. You are not choosing between transparency and confidentiality; the record is built so that you get both.

There is a forward-looking argument too, and it does not need hype to land. Marking is rolling out unevenly and the regulation behind it is still moving. A firm that has been logging provenance all along is ready for a disclosure requirement whenever one arrives. A firm that has not will be reconstructing history under time pressure, which is the worst moment to discover what was never written down. The Untraceable Protocol is the specification for that record, published openly so any tool or team can conform to it.

What to do now

• Assume anything you produce with frontier AI from here is markable. Plan for visibility rather than against it, the planning-against options do not work and carry their own cost.
• Read what your MSAs actually restrict. Most restrict disclosure of confidential information rather than AI use as such. That distinction determines what you genuinely need to fix, and it is often narrower than people assume. Does using AI break your NDA?
• Do not adopt tools that promise undetectable output. They do not work on text watermarks, and adopting one creates the intent problem described above.
• Keep confidential values out of the model. This is the disclosure question, and it is entirely independent of detectability, worth solving on its own terms. De-identification is not confidentiality
• Keep a contemporaneous record of every AI submission. Reconstructed after the fact, it is worth much less, if anything, and will involve speculating and extrapolating the truth. AI for HEOR: what you can and can't put in a prompt
• If you sponsor consulting work, say what you will permit. Silence produces shadow use, and shadow use produces exactly the exposure the silence was meant to avoid.

The record is the whole answer here. If you want to see what it looks like, the Untraceable Protocol sets out what it must contain, the security architecture covers how the confidential values stay out of it, and a demo runs it on your own workflow.