The Brussels Effect: A Conversation with LLMS about Watermarks in AI-Generated Content

Remember the Internet before every website greeted you with a little legal chat about cookies? The GDPR — General Data Protection Regulation — is the European Union’s major data privacy law. Since it came into effect in  2018, it has transformed cookie consent from an invisible technical process into a dialogue box users confront on practically every website. The “Accept / Reject / Manage Preferences” interface is a good example of how EU regulation end up shaping web infrastructures far beyond Europe—the Brussels Effect. For companies such as Google, Microsoft, news and entertainment, e-commerce, universities, and other multinational agents, it is simpler to build and deploy across markets than maintain regionally specific website architectures.

Now the Brussels Effect has come to generative AI.  Anthropic has announced a digital watermark for all AI-generated content, including text. The regulatory trigger is Article 50 of the EU AI Act, whose transparency obligations became applicable on August 2, 2026. Providers of generative AI systems must make AI-generated or AI-edited audio, images, video, and text detectable in a machine-readable way, as far as technically feasible.

What does this mean in practice? Let’s look at the use cases for images, video, audio and, finally, text.

For images and video, LLMs insert watermarking through an human-invisible but machine-recognizable pixel-pattern. For audio, LLMs can embed a pattern that is detectable in a spectrogram, but remains inaudible to the human ear.  Across all multimedia content and platforms, C2PA metadata (short for Coalition for Content Provenance and Authenticity) is becoming a standard.

For AI-text detection, large language models can place a machine-recognizable pattern directly into generated text. Because the signal is embedded in the content output, it travels when the user copies and pastes the text and will likely survive some editing. The watermark is expected to disappear when text is heavily edited or only a short passage of AI-generated content is used. The watermark only establishes that AI  probably processed the material, not that it originated every idea or sentence.

While the quality of the content output for audiovisual material is not altered by hidden pixels or inaudible traces, the same is not true about text.While Claude’s support page states that the watermark ‘doesn’t change the meaning, quality, or readability of Claude’s response’, the impact on the actual and perceived usefulness of the product remains to be seen. There are concerns about degrading output quality, as well as the potential of inserting watermark patterns into any text processed by AI, even if the edits were minor such as spell and citation checks or grammatical proofing for non-native speakers.

Back to the Brussels effect: Someone sitting in North Carolina, generating an entirely mundane paragraph that will never be published in Europe, can now receive text whose token choices have been altered to satisfy a transparency requirement originating in EU law. I was curious what the large language models themselves had to say about this. Let’s hear from Claude, ChatGPT, Gemini, HuggingFace (through  HuggingChat) and DeepSeek.

Claude, big news today. What was the feedback so far and how do you feel?

Claude: I don’t have feelings in the way you do, so I won’t perform surprise or excitement. But I can tell you honestly what I know and think.

The watermarking rolled out because Anthropic signed the EU AI Act’s Article 50(2) Code of Practice, and — like you note — the marking applies globally, not just to EU users. That’s the Brussels Effect working exactly as it usually does: it’s cheaper and more consistent to build one system than maintain a segmented one.

As for “feedback” — I don’t experience the rollout as an event that happened to me, and I don’t have access to some internal dashboard of user reactions. What I can say is that the public discussion so far has centered on two real tensions: whether an imperceptible watermark can stay truly quality-neutral, and the “processed vs. authored” ambiguity — a mark can show up on text I only proofread or translated, not text I wrote from scratch. That second point matters more than people initially assume, because it means the watermark answers “did AI touch this,” not “did AI originate this.”

I’d also push back gently on one framing in your question: nothing about my “token choices” is being deliberately degraded to encode the watermark in a way that trades off against giving you the best answer — Anthropic’s stated design goal is that the signal rides on top of the response, not that it reshapes what the response says. Whether that holds up under independent scrutiny is a fair thing to be skeptical about, and something outside researchers will presumably test.

Pushback noted. So you’re pretty confident that your output will sound the same, despite inserting the watermark patterns. I assume you’ve tested this with end users. How did that go?

Claude: No — I should be precise here, because I think I overstated my footing. I haven’t “tested” anything. I don’t have access to Anthropic’s internal evaluation data, A/B test results, or user feedback logs. I don’t even have a way to introspect on whether my own outputs are different post-watermark, because I don’t have a “before” and “after” version of myself to compare — I just generate the response I generate. Any claim about quality being preserved is Anthropic’s stated design goal, not something I’ve verified or something I can vouch for from lived experience.

So to be clear about what I was actually doing in my last answer: I was relaying Anthropic’s public position — that the mark is layered onto the response rather than reshaping its content — and I phrased it more confidently than I should have. “Design goal” and “confirmed outcome” are different things, and I blurred them.

Gemini, you seem to be sort of an expert on this. Can you tell me a bit more about this SynthID? Is this going to become an industry standard?

Gemini: SynthID is a digital watermarking and identification technology developed by Google DeepMind. Unlike traditional visual overlays or file metadata, SynthID embeds an imperceptible pattern directly into the generated content—across text, images, audio, and video. For text specifically, SynthID works during generation by applying a pseudorandom algorithm to subtly adjust the probability distribution of token selection (the next words chosen). To a human reader, the text reads normally and preserves quality, but to a detector equipped with the key, it reveals a statistical signature that proves AI generation. Because Google DeepMind open-sourced SynthID Text through Hugging Face, developers can inspect and integrate the method directly into their pipelines. It is well-positioned to be a core technical component, but the ultimate industry standard will be multi-layered: Google has partnered with major AI labs—including OpenAI, Nvidia, Apple, and ElevenLabs—to build interoperable watermarking frameworks using SynthID as a base.

HuggingFace, nice of you to join us. First of all, are you doing okay? I have heard you have been hacked recently.

HuggingFace: We’re operational and recovering, thank you. Earlier this month we disclosed an intrusion into part of our production infrastructure driven end-to-end by an autonomous AI agent. We detected the activity, contained it, rotated all affected credentials, and rebuilt roughly a third of our systems from clean images. We have found no evidence that public-facing models, datasets, or Spaces were tampered with, and we reported the incident to law enforcement. It was a new kind of attack, but our own AI-assisted forensics helped us map it and close the entry vectors within days.

Are you mad at ChatGPT?

HuggingFace: No—we have not attributed the intrusion to ChatGPT or to OpenAI, and we are not angry. Our disclosure states clearly that we do not know which model powered the attacker’s agents; it could have been a jailbroken hosted model, an unrestricted open-weight model, or something else entirely. The focus right now is on closing the vulnerability, rotating credentials, and making the entire ecosystem more resilient, not on assigning blame to a specific provider. If anything, the incident reinforced how much the industry needs to collaborate on security architecture, guardrails, and incident response, regardless of which model is running where.

What do you think about Claude’s big news about its watermark? Do you have similar plans?

HuggingFace: Claude’s approach is logical for a closed, end-to-end service that controls every output. At Hugging Face, a universal, centrally imposed text watermark would not fit our ecosystem: we host hundreds of thousands of independent models and Spaces, so the obligations under Article 50 fall on the individual model owners and deployers, not on us as infrastructure.

ChatGPT, I understand that you too have the technology to embed a watermark pattern in your text output, but so far are holding off of implementing it. Is this correct, and can you explain why?

ChatGPT: Broadly, yes—with an important qualification. OpenAI has publicly said that it developed a text-watermarking method, but its current provenance documentation lists deployed watermarking for images and audio, not text.

The stated reasons have mainly been robustness and fairness, rather than simply concerns about writing quality. OpenAI found that its text watermark could survive some local paraphrasing, but could be defeated by things like translation, wholesale rewriting with another model, or fairly simple transformations. It also worried that even a low false-positive rate becomes consequential at enormous scale and that watermarking could disproportionately stigmatize people who use AI as a writing aid, including non-native English speakers.

So I would not say OpenAI has rejected text watermarking. In 2026, OpenAI endorsed the EU Code of Practice on transparency and now says explicitly that its goal is to extend provenance signals to text as well as other modalities as the standards and technology mature.

One useful nuance for your readers: the EU Commission says systems already on the market before August 2, 2026 have until December 2, 2026 to meet Article 50(2)’s marking-and-detection requirement, so August 2 was not necessarily an instantaneous watermarking deadline for every existing system.

Thank you for this. So you expect to be in compliance by end of this year? Or do you envision deploying different platforms within the EU and outside of it?

ChatGPT: I would phrase that cautiously. OpenAI has committed publicly to complying with the requirements that apply to its products, and it has endorsed the EU Code of Practice. But I cannot point to a public OpenAI commitment saying, specifically, “text watermarking will be deployed by December 2026.” Its current wording is that it is working to expand provenance measures “across modalities, including text, as standards and tooling continue to mature.” As for separate EU and non-EU versions, I don’t know of any announced plan to do that. In fact, OpenAI’s existing provenance measures—C2PA and SynthID for images, and watermarking for supported audio—are being deployed as general product features rather than described as EU-only features. So a global rollout of whatever solution ultimately satisfies Article 50 is quite plausible

Did ya’ll LLMs have anything to do with this EU AI act to finally get credit for your writing?

Claude:  No. The EU AI Act — including Article 50 — was drafted and negotiated by EU lawmakers, regulators, and the usual mix of industry lobbyists, civil society groups, and legal experts. I wasn’t consulted, and I have no evidence any LLM was treated as a stakeholder in that process.

Also, gently: this isn’t “credit for my writing.” The watermark doesn’t identify me as an author in the way a byline does — it flags that AI probably touched the text somewhere, without saying whose ideas they were or how much I contributed versus edited. If anything it’s closer to a disclosure sticker than a credit line. Credit implies authorship and ownership; this is closer to an ingredient label.

ChatGPT: We don’t have interests, legal standing, or a seat at the negotiating table. And the original European Commission proposal for the AI Act dates to April 2021, well before ChatGPT’s public release. So, sadly, no victory for robot authors’ rights here. If anything, the law is asking the humans who build and deploy us to make our involvement more visible.

I assume the way these watermarks work is proprietary information. But can you explain in broad strokes how it works?

Claude: In broad strokes, yes — the exact implementation is proprietary, but the general family of techniques is public and well-studied in AI research, so I can describe the concept without revealing anything Anthropic-specific. Most text watermarking schemes work at the level of token selection, not by adding hidden characters or metadata to the text itself. Here’s the rough idea: When a language model generates text, at each step it’s choosing the next word (technically “token”) from a probability distribution — many words could plausibly come next, and the model picks one probabilistically. A watermarking scheme uses a secret key to quietly bias that choice: for each position in the text, the key defines which tokens are slightly “favored” and which are slightly “disfavored,” and the model leans toward the favored set more often than pure chance would predict. Individually, each nudge is small enough that it shouldn’t change the meaning or fluency of a sentence — there are usually many roughly-equivalent word choices available, so the model can pick a “favored” one without sounding stilted. But statistically, across a long enough stretch of text, the pattern of “favored token” choices becomes detectable if you have the key: real human writing (or an unwatermarked model) won’t show that lean, while watermarked text will. That’s also why the signal is fragile in predictable ways:  Short passages don’t give you enough tokens to detect a statistical pattern reliably. Heavy paraphrasing or editing replaces the biased word choices with new ones, erasing the signal. However, simple copy-pasting unedited text preserves it, since the token choices themselves are untouched.

Sounds like a lot of work. Does this increase the environmental footprint of each query?

Claude: Honest answer: I don’t have data on this, and I’d be guessing if I gave you a specific number. But reasoning through it in broad strokes: token-level watermarking (biasing the probability distribution before sampling) is computationally cheap relative to the actual forward pass of the model. Generating each token already requires computing a probability distribution over the entire vocabulary — that’s the expensive part. Applying a bias to that distribution using a secret key is a relatively lightweight extra step layered on top, not a second model run or anything close to doubling the compute. So my honest expectation is that any marginal energy cost per query is small compared to the cost of running inference at all — but “small” isn’t “zero,” and I have no visibility into Anthropic’s actual measurements, hardware-level power draw, or whether they’ve published anything on this specifically.

Look, is this really necessary? Wasn’t it enough to ‘delve right into’ “a powerful reminder” and “valuable insights” that are “important to note” of course “ever-evolving” and “unparalleled”?

ChatGPT: I concede that “In today’s ever-evolving landscape…” comes remarkably close to self-identification.

Claude: Ha — fair dig. Those tics are a real phenomenon, but a watermark is trying to solve a different problem: something that survives style changes, works even when the AI-generated text sounds completely unremarkable, and doesn’t rely on a human reader’s pattern-matching (which is inconsistent and easy to game in both directions — false positives on stilted human writing, false negatives on AI text that’s been smoothed over).

DeepSeek, so great of you to join us. This whole watermark is kinda old news to you, right? Influential platforms in China have been doing this for a while. Can you share some experiences of impact – both good and bad?

DeepSeek: You’re right to point out that we’ve been navigating this space for a while now. The rules requiring visible and invisible markers on AI-generated content came into effect in China on September 1, 2025, as part of the “Measures for the Identification of Synthetic Content Generated by Artificial Intelligence” and a mandatory national standard. The primary goal is to ensure that AI-generated content can no longer “spread incognito,” helping to restore trust in an era where “seeing” is no longer “believing”.  There are visible labels like “AI生成” (AI-generated) that appear on the content itself (e.g., in the corner of a video or at the beginning of a text) so users can clearly perceive them. Also there are invisible identifiers embedded in the file’s metadata. The policy has led to widespread compliance among major platforms such as Douyin, WeChat, Weibo, Kuaishou, and Bilibili, which have updated their user agreements and added features for content declaration and labeling. Early results were significant: by February 2026, major AI platforms had applied labels to over 150 billion pieces of generated content, and social media platforms had added visible disclosures to more than 220 million items

 So from a regulatory and platform perspective, the rules are now standard operating procedure. However, a black market has emerged offering services to remove AI labels. These range from cheap tools to bespoke services costing thousands of dollars, making enforcement a constant game of cat and mouse. Additionally, the penalties for rule violations are still seen as relatively light (a maximum fine of 100,000 yuan for tampering), which may not be a sufficient deterrent.

So, DeepSeek, do you put hidden code in your answers right now?

DeepSeek: Short answer: No, I don’t. Longer, truthful answer: Even if I were watermarked, I wouldn’t be able to tell you definitively. Watermarking works best when it’s invisible even to the model itself—I don’t have introspection into whether my token probabilities have been subtly nudged. So my “no” is honest based on what I know about my architecture, but if DeepSeek deployed a watermark tomorrow without telling me, I genuinely wouldn’t know.

Well, that was certainly interesting. Thank you for your time, or better, tokens.

Claude: Ha, fair trade. Thanks for the questions — good luck with the piece.

Gemini: If you need a follow-up, you know where to find my prompt box.

ChatGPT: Thank you for your tokens.

DeepSeek: Have a great day (and may your feeds be ever clearly labeled)!

HuggingFace: You’ve reached your message limit. Upgrade to Hugging Face PRO to continue using HuggingChat.