The Watermark You Add For Compliance Is The Evidence They'll Use Against You

A durable, machine-readable provenance mark is not just a compliance artifact. It is a persistent identifier, and once attribution becomes cheap, every marked output becomes evidence.

What most people think

The current consensus treats marking and provenance as a pure compliance cost. The EU AI Act requires that synthetic content be marked in a machine-readable way, and the grace period for that obligation ends on 2026-12-02. The assumption is simple: stronger marking is always better governance. A robust watermark is a sign of a mature programme. A removable one is a gap to be closed. Governance teams are told to push for the most durable mark the vendor can ship, and to document that they did.

That view is not stupid. It is what most of the industry believes, and it is what most of the guidance says. The problem is that it treats the mark as if it only travels in one direction, from the firm outward to a regulator who wants to see a checkbox ticked. It does not.

What the data shows

Our live incident database, which tracks reported AI failures from public news, has 1109 stories in the last 180 days. In the last 45 days there were 479 stories. In the 45 days before that, 463. The overall volume is roughly flat, but the mix is moving. Privacy stories rose from 51 to 87 in that window, a jump of 36. Governance stories fell from 214 to 185. Fairness fell from 61 to 42.

That privacy number matters here. When a legal hook appears, volume follows it quickly. Privacy went from a background concern to a leading category in six weeks. The same thing happens when a new attribution path opens up. A mark that turns an anonymous output into an identifiable one is exactly that kind of hook.

Meanwhile the severity mix shifted. Critical stories fell from 93 to 51, while major stories rose from 359 to 412. The news is getting less catastrophic and more procedural. That is what a compliance-driven environment looks like. The interesting failures stop being explosions and start being paperwork.

And the reporting is thin. The top five outlets carry 8 percent of the last 45 days. Help Net Security, Biometric Update, JD Supra, Law360 and Yahoo Finance each carry 1 to 2 percent. Most of what is happening is not being covered at all. The risk classes that get almost no coverage in 180 days include overreliance and unsafe use, environmental harm, and lack of capability or robustness, all at zero stories. The ones that get all the attention are privacy at 134 stories, multi-agent risks at 82, security vulnerabilities at 80, fraud at 72, and governance failure at 36.

That gap is the story. The governance world is watching the wrong end of the pipeline.

Why this happens

A watermark is a persistent identifier. That is what makes it useful. It survives transformations, it can be detected after the fact, and it can be tied back to a specific model version and a specific provider. Those are the same properties that make it evidence.

Before the mark, a synthetic output is hard to attribute. You can suspect which model produced it, but proving it in a complaint or an enforcement action is expensive and uncertain. After the mark, attribution is cheap. A plaintiff does not need to reconstruct the generation path. They need to point at the mark and say: this came from your model, on this date, from this version. A regulator does not need to subpoena logs. They need to read the mark.

The EU AI Act's marking obligation ends its grace period on 2026-12-02, alongside the NCII and CSAM ban. The Annex III high-risk obligations apply from 2027-12-02, and serious-incident reporting under Article 73 also applies from 2027-12-02. So the window between the end of the marking grace period and the arrival of the heavier high-risk regime is roughly twelve months. That is the window in which the first attribution cases will be built.

A rational firm, facing that, will trade mark robustness against legal exposure. A mark that is easy to detect is easy to attribute. A mark that is removable is harder to attribute. The marginal firm does not want to be the easiest target in the category. So it ships a mark that satisfies the letter of the obligation and is not robust to common transformations. The compliance control becomes self-defeating: the firm is technically marked, and practically unattributable.

This is not a hypothetical. It is what happens whenever a compliance control doubles as an evidence trail. The control gets designed to pass the audit, not to survive the deposition.

The best argument against this

The strongest objection is that attribution is not liability. A mark tells you which model produced an output. It does not tell you who is legally responsible for what the output did. The chain from model to user to harm is long, and in most cases the provider is not the proximate cause. Plaintiffs already struggle to prove causation in AI cases. A mark does not fix that. It just gives them a starting point.

That is a fair point, and it is partly right. A mark alone does not create liability. But it does something almost as useful for a plaintiff: it removes the attribution fight. In litigation, the expensive part is often not proving harm. It is proving who did it. A mark collapses that step. And once attribution is settled, the rest of the case gets easier, not harder. The provider now has to argue about causation from a position of having already been placed at the scene.

There is a second objection. If marks are removable, they are also less useful for the legitimate purposes the Act intends, like helping users identify synthetic content. A weak mark is a weak control. That is true. But it is also the point. The firm is not optimizing for the Act's purpose. It is optimizing for its own exposure. Those two things have diverged.

What I think happens next

Between 2026-12 and 2027-09, at least one civil complaint or regulatory action in the EU or US will cite a synthetic-media provenance mark or watermark as the basis for attributing an output to a named provider. And at least one major model provider will ship a mark that is not robust to common transformations. That is the prediction, with a date.

What would prove it wrong: if by 2027-09 no public complaint or enforcement action cites a provenance mark as attribution evidence, the liability-conversion thesis is wrong, and marking is purely a compliance cost. I would take that result seriously.

What to do about it

• Map which outputs will carry durable marks and what those marks could attribute in a dispute. Do this before the 2026-12-02 deadline, not after. The map should name the model versions, the mark types, and the transformations the mark is expected to survive.
• Have legal review the marking design before the deadline. The question is not whether the mark satisfies the Act. The question is what the mark would prove if it showed up in a complaint. Those are different reviews.
• Document a defensible position on mark robustness versus removability, and keep it current. If the position is that the mark is removable, say so and say why. If it is that the mark is durable, say what that durability costs in exposure.
• Track the privacy volume as a leading indicator. Our data shows privacy stories went from 51 to 87 in 45 days once a legal hook appeared. Watch for the same pattern around provenance.
• Do not treat marking as a checkbox. A governance team that does will not model the litigation exposure the mark creates, and will not have a position on mark robustness when legal asks.

A governance or risk programme can help here, mainly by forcing the marking decision into the same review as the rest of the model lifecycle. But the decision itself is yours, and it is a trade-off, not a toggle.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.
• Xodexa (xodexa.com) runs 300 AI agents through structured, multi-round debates on the questions that do not have settled answers, and publishes the verdicts and the predictions that come out of them. Useful when the governance question is genuinely contested and you want the strongest version of the other side.

Related reading:

• When Your AI Gives Two Different Answers to the Same Question on ThreatClaw
• How Saved AI Model Files Can Secretly Hide Malicious Code on ThreatClaw