How AI watermarking works in 2026: SynthID, C2PA, and the 2 December deadline

Two different technologies, one regulatory clock. A plain-English guide to the watermark hidden inside the content, the credential signed onto the file, and the EU rule that is about to make both matter.

For a couple of years, "can you tell if AI made this?" was a research question. In 2026 it became a compliance one. The EU AI Act now requires providers of generative systems to mark their synthetic output so a machine can detect it as AI-generated¹ — and a specific deadline, 2 December 2026, is bearing down on the systems that were already on the market when the rule took effect.³ Two very different technologies carry most of that weight: Google DeepMind's SynthID, a watermark woven into the content itself, and C2PA Content Credentials, a signed receipt attached to the file. They solve different halves of the same problem, and the regulation, sensibly, asks for both.

01Watermark vs. provenance: two different jobs

The confusion worth clearing up first is that "watermark" and "Content Credentials" are not two brands of the same thing. They work in opposite places.

A watermark changes the content itself — the pixels of an image, the word choices in a sentence — in a way a person cannot perceive but a detector can recover. Because the mark lives inside the content, it rides along through the transformations that normally destroy a label: a screenshot, a re-encode, an upload that strips metadata. SynthID is the best-known example.⁴

Provenance metadata does the reverse. Instead of touching the content, it attaches a cryptographically signed record beside it — who or what made the file, when, with which tool, and what was edited since. That is what C2PA's Content Credentials standard produces.⁷ The record is far richer than a watermark's one-bit "AI or not," but it is also fragile: strip the metadata and the claim is simply gone, even though the file looks identical.

02SynthID in 2026: the mark inside the content

Google DeepMind introduced SynthID in 2023 for images, then extended the same idea across modalities: audio, video, and — the hard case — text.⁴ In every case the watermark is embedded during generation, not stamped on afterward. For an image, that means folding an imperceptible, structured signal across the whole frame, so cropping or compression still leaves enough of it to detect. For text, it means subtly biasing which of several plausible next words the model picks, so the signal is carried by the words themselves rather than by anything added to them. (We walk through the token-level mechanism — tournament sampling, and how Claude built its own text watermark on the openly published SynthID-Text method — in a companion deep dive.⁶)

Two things changed the picture in 2026. The first is scale: Google reports it has watermarked more than 180 billion images and videos with SynthID since 2023, plus hundreds of thousands of hours of audio, and says it now fields on the order of a million verification requests a day across its products.⁴ The second is access. For most of its life, the SynthID detector was a closed tool for a handful of journalists and researchers. Google said in October 2026 that it had opened its SynthID Detector verification portal to the public, globally and in English, at synthid.com, where you can upload a file and get a "watermarked / not watermarked / uncertain" style verdict.⁵

The catch sits in that word uncertain, and in one structural limit. SynthID can only find a SynthID watermark. If an image or paragraph was produced by a model that does not embed it — a different vendor, an open-weights model run locally, a camera photographing a real scene — there is nothing to detect, and the portal correctly returns nothing. A negative result is not evidence of human authorship; it only means this particular mark was not present. Google itself positions SynthID as one signal among several, explicitly alongside C2PA, not as a universal "AI or not" oracle.⁴

03C2PA Content Credentials: the receipt on the file

C2PA — the Coalition for Content Provenance and Authenticity — is the standards body behind Content Credentials, the "nutrition label" you may have seen as a small cr icon on an image.⁷ A credential is a tamper-evident manifest, cryptographically signed, that travels with the asset and records its origin and edit history. Crucially, it is not limited to AI: a camera can sign a photo at the moment of capture to assert that it is a real, unedited exposure, and an editor can append a signed note each time the file is changed. For provenance, that is a much stronger claim than any watermark can make.

Adoption has moved from slideware to shipping. The coalition's members span Adobe, Microsoft, Google, OpenAI, Amazon and Meta, alongside the major camera makers;⁸ OpenAI attaches Content Credentials to the images its tools generate,¹⁰ Adobe builds them into Photoshop, Lightroom and Firefly, and camera makers including Sony, Canon, Nikon, Leica and Fujifilm have shipped or demonstrated in-camera signing. To turn "supports C2PA" into something verifiable, C2PA runs a formal Conformance Program; its own deployment guidance reports that, as of May 2026, 54 products from 31 companies had passed conformance, with well over a hundred more in the queue.⁹ Real, but still early — and, on the hardware side, uneven, with dedicated-camera conformance lagging the software tools.

04The two December 2nds, untangled

Here is where even careful coverage gets the dates wrong, because there are two different "2 December" deadlines in the EU AI Act and they belong to different obligations.

The relevant one for watermarking is Article 50, the transparency chapter. Its obligations apply from 2 August 2026, and they were not postponed by the amendment package widely called the Digital Omnibus.¹³ Article 50(2) is the specific duty that providers of generative AI mark their output in a machine-readable format detectable as artificially generated. For systems placed on the market after 2 August 2026, that applies immediately. For systems already on the market before that date, the Omnibus (Regulation (EU) 2026/1744) granted a short grace period to get the marking in place — ending 2 December 2026.³ That is the deadline in this article's title, and it is roughly six weeks away as this is written.

The other 2 December — 2 December 2027 — is unrelated to watermarking. That is the new date to which the Omnibus pushed the obligations for stand-alone high-risk systems in Annex III (biometrics, hiring, credit scoring, and the like); product-embedded high-risk systems moved further still, to 2 August 2028.³ So if you have seen "the EU AI Act watermarking deadline is December 2027," that conflates the two: the marking clock is 2026; the high-risk clock is 2027.

05Why the EU asks for both — and leaves the "how" open

The Act says output must be machine-readable and detectable; it does not mandate a specific technology. To fill that gap, the European Commission published, on 10 June 2026, a voluntary Code of Practice on Transparency of AI-generated Content, accompanied by guidelines on the scope of Article 50.² The Code is the clearest signal of what regulators consider adequate, and its answer is telling: the robust baseline it describes combines signed provenance metadata with a durable watermark, and it explicitly rejects the idea that any single technical solution could satisfy Article 50 in every case.²

That is the whole argument of this piece, written into policy. A watermark survives the screenshot that strips the credential; the credential carries the rich, verifiable history the one-bit watermark cannot. Layer them and each covers the other's failure mode. The approach is not flawless — researchers have shown that provenance and watermarking can even disagree about the same asset when they are generated or checked out of step, which is its own small headache — but a belt-and-suspenders label still beats either alone.

06Where OcxlyDev lands

Treat 2 December 2026 as a real date, not a theoretical one: if you ship a generative feature to EU users, the marking obligation is already live for anything new and closing fast for anything legacy. Practically, that means emitting SynthID-style watermarks (or an equivalent) and writing C2PA Content Credentials at generation time, then checking that your own delivery pipeline doesn't strip the credential on the way out — the most common own-goal we see.

And keep the claims honest, because the technology invites overconfidence in both directions. A valid Content Credential or a confident SynthID hit is strong evidence that something was machine-made; a missing mark proves almost nothing, since the easiest way to have no watermark is to use a tool that never wrote one. The useful mental model is provenance, not detection: these systems are good at labelling content that wants to be labelled, at scale and invisibly, which is genuinely valuable — and they are a speed bump, not a wall, for anyone determined to strip the label off. Build on the first fact; don't bet the farm on the second.