# How AI watermarking works in 2026: SynthID, C2PA, and the 2 December deadline Two different technologies, one regulatory clock. A plain-English guide to the watermark hidden inside the content, the credential signed onto the file, and the EU rule that is about to make both matter. For a couple of years, "can you tell if AI made this?" was a research question. In 2026 it became a compliance one. The EU AI Act now requires providers of generative systems to mark their synthetic output so a machine can detect it as AI-generated[1](#ref-1) — and a specific deadline, **2 December 2026**, is bearing down on the systems that were already on the market when the rule took effect.[3](#ref-3) Two very different technologies carry most of that weight: Google DeepMind's **SynthID**, a watermark woven into the content itself, and **C2PA Content Credentials**, a signed receipt attached to the file. They solve different halves of the same problem, and the regulation, sensibly, asks for both. ## 01 Watermark vs. provenance: two different jobs The confusion worth clearing up first is that "watermark" and "Content Credentials" are not two brands of the same thing. They work in opposite places. A **watermark** changes the content itself — the pixels of an image, the word choices in a sentence — in a way a person cannot perceive but a detector can recover. Because the mark lives *inside* the content, it rides along through the transformations that normally destroy a label: a screenshot, a re-encode, an upload that strips metadata. SynthID is the best-known example.[4](#ref-4) **Provenance metadata** does the reverse. Instead of touching the content, it attaches a cryptographically signed record *beside* it — who or what made the file, when, with which tool, and what was edited since. That is what C2PA's Content Credentials standard produces.[7](#ref-7) The record is far richer than a watermark's one-bit "AI or not," but it is also fragile: strip the metadata and the claim is simply gone, even though the file looks identical. **The core distinction.** A watermark is hard to remove but says little (roughly: "this was AI-generated"). A Content Credential says a lot (tool, time, edit history, signed by whom) but is easy to strip. One is robust and thin; the other is rich and brittle. That is exactly why the serious proposals, including the EU's, use them together rather than picking one. ## 02 SynthID in 2026: the mark inside the content Google DeepMind introduced SynthID in 2023 for images, then extended the same idea across modalities: audio, video, and — the hard case — text.[4](#ref-4) In every case the watermark is embedded *during generation*, not stamped on afterward. For an image, that means folding an imperceptible, structured signal across the whole frame, so cropping or compression still leaves enough of it to detect. For text, it means subtly biasing which of several plausible next words the model picks, so the signal is carried by the words themselves rather than by anything added to them. (We walk through the token-level mechanism — tournament sampling, and how Claude built its own text watermark on the openly published *SynthID-Text* method — in a companion deep dive.[6](#ref-6)) Two things changed the picture in 2026. The first is scale: Google reports it has watermarked **more than 180 billion** images and videos with SynthID since 2023, plus hundreds of thousands of hours of audio, and says it now fields on the order of a million verification requests a day across its products.[4](#ref-4) The second is access. For most of its life, the SynthID detector was a closed tool for a handful of journalists and researchers. Google said in October 2026 that it had opened its **SynthID Detector** verification portal to the public, globally and in English, at `synthid.com`, where you can upload a file and get a "watermarked / not watermarked / uncertain" style verdict.[5](#ref-5) The catch sits in that word *uncertain*, and in one structural limit. SynthID can only find a SynthID watermark. If an image or paragraph was produced by a model that does not embed it — a different vendor, an open-weights model run locally, a camera photographing a real scene — there is nothing to detect, and the portal correctly returns nothing. A negative result is not evidence of human authorship; it only means *this particular* mark was not present. Google itself positions SynthID as one signal among several, explicitly alongside C2PA, not as a universal "AI or not" oracle.[4](#ref-4) ## 03 C2PA Content Credentials: the receipt on the file C2PA — the Coalition for Content Provenance and Authenticity — is the standards body behind **Content Credentials**, the "nutrition label" you may have seen as a small *cr* icon on an image.[7](#ref-7) A credential is a tamper-evident manifest, cryptographically signed, that travels with the asset and records its origin and edit history. Crucially, it is not limited to AI: a camera can sign a photo at the moment of capture to assert that it is a real, unedited exposure, and an editor can append a signed note each time the file is changed. For provenance, that is a much stronger claim than any watermark can make. Adoption has moved from slideware to shipping. The coalition's members span Adobe, Microsoft, Google, OpenAI, Amazon and Meta, alongside the major camera makers;[8](#ref-8) OpenAI attaches Content Credentials to the images its tools generate,[10](#ref-10) Adobe builds them into Photoshop, Lightroom and Firefly, and camera makers including Sony, Canon, Nikon, Leica and Fujifilm have shipped or demonstrated in-camera signing. To turn "supports C2PA" into something verifiable, C2PA runs a formal **Conformance Program**; its own deployment guidance reports that, as of May 2026, **54 products from 31 companies** had passed conformance, with well over a hundred more in the queue.[9](#ref-9) Real, but still early — and, on the hardware side, uneven, with dedicated-camera conformance lagging the software tools. **Where Content Credentials break.** The honest weakness is distribution. Most image pipelines and many social platforms strip metadata on upload or re-encode, so a manifest frequently never reaches the person viewing the content — the credential was there, and the delivery chain quietly removed it. And the cryptography is only as good as its weakest link: an independent 2026 security analysis of the C2PA 2.x specification and its conformance profile concluded they did not meet several of their own stated security goals, which is a reason to treat a present-and-valid credential as strong evidence while not treating an absent one as suspicious.[11](#ref-11) ## 04 The two December 2nds, untangled Here is where even careful coverage gets the dates wrong, because there are two different "2 December" deadlines in the EU AI Act and they belong to different obligations. The relevant one for watermarking is **Article 50**, the transparency chapter. Its obligations apply from **2 August 2026**, and they were *not* postponed by the amendment package widely called the Digital Omnibus.[1](#ref-1)[3](#ref-3) Article 50(2) is the specific duty that providers of generative AI mark their output in a *machine-readable* format detectable as artificially generated. For systems *placed on the market after 2 August 2026*, that applies immediately. For systems already on the market before that date, the Omnibus (Regulation (EU) 2026/1744) granted a short grace period to get the marking in place — ending **2 December 2026**.[3](#ref-3) That is the deadline in this article's title, and it is roughly six weeks away as this is written. The *other* 2 December — **2 December 2027** — is unrelated to watermarking. That is the new date to which the Omnibus pushed the obligations for stand-alone **high-risk** systems in Annex III (biometrics, hiring, credit scoring, and the like); product-embedded high-risk systems moved further still, to 2 August 2028.[3](#ref-3) So if you have seen "the EU AI Act watermarking deadline is December 2027," that conflates the two: the marking clock is 2026; the high-risk clock is 2027. **The one-line version.** New generative systems: mark your output from 2 August 2026. Systems already live before then: you have until 2 December 2026. The 2 December 2027 date is the high-risk regime — a different obligation on a different timeline. ## 05 Why the EU asks for both — and leaves the "how" open The Act says output must be machine-readable and detectable; it does not mandate a specific technology. To fill that gap, the European Commission published, on 10 June 2026, a voluntary **Code of Practice on Transparency of AI-generated Content**, accompanied by guidelines on the scope of Article 50.[2](#ref-2) The Code is the clearest signal of what regulators consider adequate, and its answer is telling: the robust baseline it describes *combines* signed provenance metadata with a durable watermark, and it explicitly rejects the idea that any single technical solution could satisfy Article 50 in every case.[2](#ref-2) That is the whole argument of this piece, written into policy. A watermark survives the screenshot that strips the credential; the credential carries the rich, verifiable history the one-bit watermark cannot. Layer them and each covers the other's failure mode. The approach is not flawless — researchers have shown that provenance and watermarking can even *disagree* about the same asset when they are generated or checked out of step, which is its own small headache — but a belt-and-suspenders label still beats either alone. ## 06 Where OcxlyDev lands Treat 2 December 2026 as a real date, not a theoretical one: if you ship a generative feature to EU users, the marking obligation is already live for anything new and closing fast for anything legacy. Practically, that means emitting SynthID-style watermarks (or an equivalent) *and* writing C2PA Content Credentials at generation time, then checking that your own delivery pipeline doesn't strip the credential on the way out — the most common own-goal we see. And keep the claims honest, because the technology invites overconfidence in both directions. A valid Content Credential or a confident SynthID hit is strong evidence that something was machine-made; a *missing* mark proves almost nothing, since the easiest way to have no watermark is to use a tool that never wrote one. The useful mental model is provenance, not detection: these systems are good at labelling content that *wants* to be labelled, at scale and invisibly, which is genuinely valuable — and they are a speed bump, not a wall, for anyone determined to strip the label off. Build on the first fact; don't bet the farm on the second. **About this piece.** An OcxlyDev field guide to how AI-generated content is labelled, and what the EU AI Act actually requires. For the token-by-token mechanics of how these watermarks are embedded, see our companion deep dive on [how SynthID marks an image and Claude marks a sentence](ai-watermarks-synthid-claude.html); for the adjacent debates, see [AI transparency](aitransparency.html) and [AI interpretability](ai-interpretability.html). Watermarking and the surrounding law both move quickly, and dates, versions and thresholds change — treat the figures here as an October 2026 snapshot and follow the linked primary sources for the current state. Nothing here is legal advice. ## References 1. [EU AI Act, Article 50 — transparency obligations, including the Article 50(2) duty to mark AI-generated output in a machine-readable, detectable form; applies from 2 August 2026](https://artificialintelligenceact.eu/article/50/) 2. [European Commission — Code of Practice on Transparency of AI-generated Content (published 10 June 2026), with accompanying guidelines on the scope of Article 50; a voluntary baseline combining signed metadata with robust watermarking](https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content) 3. [Gibson Dunn (2026) — the AI Act "Digital Omnibus" (Regulation (EU) 2026/1744): the 2 December 2026 grace period for Article 50(2) marking of legacy systems, and the separate move of high-risk Annex III obligations to 2 December 2027](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/) 4. [Google DeepMind — SynthID: how the watermark is embedded during generation across image, audio, video and text; reported scale (180B+ images/videos) and positioning alongside C2PA rather than as a universal detector](https://deepmind.google/science/synthid/) 5. [Google — SynthID Detector: the public verification portal (opened globally in English in October 2026) that returns a watermark-detected / not-detected / uncertain verdict for uploaded content](https://synthid.com/) 6. [Dathathri et al. (2024), Nature — "Scalable watermarking for identifying large language model outputs": the openly published SynthID-Text method and tournament sampling](https://www.nature.com/articles/s41586-024-08025-4) 7. [C2PA — the Coalition for Content Provenance and Authenticity: the Content Credentials standard for cryptographically signed, tamper-evident provenance manifests](https://c2pa.org/) 8. [Content Authenticity Initiative — Content Credentials adoption across Adobe, Microsoft, Google, OpenAI, Amazon, Meta and major camera makers](https://contentauthenticity.org/) 9. [C2PA — Content Credentials Deployment Guidance (2026): the Conformance Program and its reported status (54 products from 31 companies passed as of May 2026)](https://c2pa.org/wp-content/uploads/sites/33/2026/07/Content-Credentials-Deployment-Guidance.pdf) 10. [OpenAI — C2PA Content Credentials applied to generated images: a worked example of the signed-provenance approach](https://help.openai.com/en/articles/8912793-c2pa-in-dall-e-3) 11. [IACR ePrint 2026/804 — a security analysis concluding that the C2PA 2.x specification and its conformance profile fall short of several of their own stated security goals](https://eprint.iacr.org/2026/804) --- *Source: [ocxly.com/ai-watermarking-synthid-c2pa-eu-deadline.html](https://ocxly.com/ai-watermarking-synthid-c2pa-eu-deadline.html) — OCXLY, free 100% client-side privacy-first tools. How AI watermarking works in 2026: Google's SynthID watermark, C2PA Content Credentials, and the EU AI Act's 2 December 2026 machine-readable marking deadline — an OCXLY field guide with primary sources.*