Since the beginning of August, the EU AI Act has asked for something reasonable. If a picture was made by AI, it should be detectable as such. Article 50 requires the mark to be machine-readable, and getting it wrong can cost you €15 million or 3% of worldwide annual turnover.
Fine. Except the mark comes off in seconds, and everybody involved knows it.
Each generation of watermarks gets broken
I’ll spare you the full history, but watermarking has been through three rounds. First came the visible stamp: a logo across the picture, which works and ruins the image at the same time. Then, in the 1990s, the mark moved into the pixels themselves, using the same frequency-domain maths that makes JPEG work. It became invisible and could survive cropping and compression. Now the mark goes in during generation itself. Google’s SynthID writes it with one neural network and reads it back with another.
Each round was harder to break than the one before, but each round got broken anyway.
Sora 2 is the clearest example. OpenAI launched it at the end of September last year with a visible watermark on every clip. Within a week, 404 Media had tested three removal websites, and all three worked in seconds, for free.
The invisible layer didn’t hold up much better. A university team built an attack called UnMarker that needs to know nothing about how a watermark was made. It beat systems including SynthID and Meta’s Stable Signature more than half the time. As one of the researchers put it: “Watermarking is being promoted as this perfect solution, but we’ve shown that this technology is breakable.”
Brussels isn’t naive about any of this. The Code of Practice on Transparency of AI-generated Content, signed by more than 190 organisations, tells providers to layer several techniques because any single one can be stripped. Twelve days after the law took effect, Google made the visible watermark on its own AI images optional while retaining its invisible markers. Even Google no longer treats the visible stamp as the main line of defence.
An AI label cannot tell you if the picture is right
For businesses using images, what does the mark actually establish? It may indicate that AI generated the picture but it cannot confirm that the product shown is accurate or that the image is clear of copyright problems. The model may have been trained on copyrighted works without their owners’ permission or reproduced protected material. A watermark provides no assurance that these rights have been respected.
There is a separate question about the business’s own rights in the image. In the US, purely AI-generated content does not qualify for copyright protection, although human creative contributions can. A business may therefore have limited grounds under copyright law to stop competitors copying its generated imagery. The rules differ between countries, but paying to generate an image does not automatically give you exclusive rights over it.
Take automotive retail. A dealer advertising a particular car needs imagery that matches its model, year, trim and equipment. The wheels and headlights may distinguish one version from another. A convincing image of a similar vehicle can still give someone the wrong impression of what they are buying.
An AI label does nothing to correct the wrong wheels. The dealer needs to check the image against the vehicle specification before publishing it. That responsibility remains even if the image carries a watermark that survives every attempt to remove it.
Removing the watermark can leave a trace
There is one piece of good news, and it’s a strange one. Current watermark-removal methods leave signatures of their own. You can compare it with removing a tattoo using a laser, which also leaves a trace. In tests published this year, detectors trained to recognise specific attacks caught at least 99% of the images those attacks produced. Out of 750 attempts, exactly one image emerged with the watermark removed and no detectable trace of tampering.
Proving where an image came from takes several layers
The lesson is that watermarking has value, but it cannot carry the entire burden of proving where an image came from.
A credible system needs several layers: machine-readable provenance, invisible marking, forensic detection and a clear record of how the image was created. Even then, these are signals rather than proof. A missing watermark does not make an image authentic, and a detected watermark does not tell you whether its contents are true.
Businesses should ask image suppliers how their content was created, what source material supports it and what usage rights come with it. Keep those answers alongside the files, including any restrictions and a record of later edits.
If a customer questions a product detail or a rights holder challenges an image’s use, someone needs to retrieve that evidence. A watermark may help establish part of the story. The business still needs records that explain why it considered the image accurate and suitable for publication.
