The EU's machine-readable watermarking requirement is set for December 2026. This isn't about content moderation or misinformation detection. It's about making AI assistance visible in every communication your organization produces, whether you're drafting performance reviews or client proposals.
Research shows that disclosing AI use can reduce trust compared to not disclosing. Your compliance strategy needs to account for that reality while meeting the regulatory mandate.
What This Checklist Covers
This checklist addresses the EU AI Act transparency requirements for AI-generated content watermarking. It applies to organizations deploying generative AI systems that produce text, regardless of where your headquarters is located. Google's SynthID and Anthropic's Claude watermarking implementations show this is already moving beyond EU borders.
Use this to verify your technical controls, governance processes, and stakeholder communication before the December 2026 deadline.
Prerequisites
Before starting this checklist, confirm:
- You've identified all generative AI systems producing text in your organization (internal tools, licensed platforms, custom models).
- You have legal sign-off that these systems fall under the EU AI Act's transparency requirements.
- Your IT team can access model configuration settings or API parameters for each system.
- You've designated an owner for watermarking compliance within your AI governance function.
Compliance Checklist
1. Inventory every text-generating AI system across your organization
Done when: You have a documented list of every platform, API, and tool that uses generative AI to produce written content, including employee-facing systems and customer-facing applications. Each entry includes the vendor name, deployment date, user population, and typical use cases.
Good looks like: Your inventory captures the scheduling assistant your HR team uses, the email drafting tool in your CRM, and the customer service chatbot, not just your flagship AI products.
2. Verify watermarking capability for each system
Done when: For every system in your inventory, you've confirmed whether it supports machine-readable watermarking and documented the technical specification (SynthID, proprietary method, or alternative approach). Systems lacking this capability are flagged for replacement or exemption review.
Good looks like: You've tested watermark detection on sample outputs from each system using the vendor's verification tool or your own detector.
3. Apply the 150-word exemption threshold correctly
Done when: You've classified each AI use case by typical output length and documented which fall below roughly 150 words. You have a clear policy for edge cases where output length varies.
Good looks like: Your two-line meeting reminders are documented as exempt, but your performance review drafts and client proposal templates are flagged for watermarking.
4. Distinguish assistive functions from substantial generation
Done when: You've reviewed grammar checkers, spell-checkers, and autocomplete tools against the EU Commission's Code of Practice definition of assistive functions that don't substantially change input. You've documented which tools qualify for exemption.
Good looks like: Your organization's style guide now specifies that Grammarly-style corrections don't trigger watermarking, but using AI to expand bullet points into paragraphs does.
5. Configure watermarking in production systems
Done when: For each non-exempt system, you've enabled watermarking in the production environment, not just development or test. You have confirmation from your vendor or internal team that the watermark persists through your content workflow (CMS, email system, document storage).
Good looks like: You've sent test emails through your actual email infrastructure and verified the watermark survives your email security gateway and formatting tools.
6. Document your watermarking approach for audit
Done when: You have written documentation explaining which systems use watermarking, which are exempt and why, and how you verify watermark integrity. This documentation references specific sections of the EU AI Act and the Code of Practice.
Good looks like: Your documentation includes screenshots of configuration settings, test results showing watermark detection, and a decision log for exemption classifications.
7. Train employees on watermarking implications
Done when: Staff who use AI writing tools understand that their outputs will be watermarked, what that means for recipients, and when voluntary disclosure is still appropriate. Your training addresses the trust implications research has identified.
Good looks like: Your training doesn't just say "AI content is now watermarked." It walks through scenarios where a manager might want to explain their AI use before sending a message, even though the watermark will reveal it anyway.
8. Update your AI use policy to address voluntary disclosure
Done when: Your organization's AI acceptable use policy now includes guidance on when and how employees should proactively disclose AI assistance, separate from the automatic watermark. The policy acknowledges that watermarks don't capture the extent or nature of AI involvement.
Good looks like: Your policy states: "When using AI to draft sensitive communications (performance feedback, condolence messages, personal recognition), explain your process to the recipient rather than relying solely on the watermark."
9. Establish a process for watermark integrity monitoring
Done when: You have a recurring process (monthly or quarterly) to sample AI-generated content from your systems and verify watermarks are present and detectable. You've assigned this responsibility to a specific role.
Good looks like: Your AI governance team pulls random samples from your customer service logs, HR communications, and marketing content, runs them through a watermark detector, and logs the results.
10. Plan for rewriting and paraphrasing scenarios
Done when: You've identified workflows where users might extensively rewrite AI-generated content (potentially overriding the watermark) and documented your organization's stance. You've decided whether to prohibit this, allow it with disclosure, or treat it as non-AI content.
Good looks like: Your policy explicitly addresses the case where someone generates a draft with AI, then rewrites 80% of it. You've clarified whether that still counts as AI-generated for compliance purposes.
Common Mistakes
Assuming watermarks are foolproof: Statistical word patterning can be overridden by paraphrasing. Don't treat watermarks as tamper-proof authentication.
Ignoring private or local model deployments: If your engineering team runs models locally or uses less mainstream systems, those outputs still need watermarking if they meet the EU definition of generative AI.
Conflating watermarking with disclosure: A watermark tells someone AI was involved. It doesn't tell them you used AI to fix typos versus write the entire message from scratch. Your communication practices need to fill that gap.
Overlooking the trust research: The finding that disclosing AI use reduces trust isn't a bug in the research. It's a signal that your implementation strategy needs to address relationship dynamics, not just technical compliance.
Treating December 2026 as the start date: Systems already on the market have until December 2026 to comply. New systems deployed after the EU AI Act's entry into force must include watermarking from day one.
Next Steps
After completing this checklist:
- Schedule a review meeting with your legal, IT, and communications teams to discuss gaps.
- If you have systems that can't support watermarking by December 2026, start vendor replacement discussions now.
- Draft your employee communication about watermarking before you enable it in production (don't surprise people).
- Consider piloting voluntary disclosure practices in low-stakes contexts (internal team communications) before rolling out organization-wide.
- Add watermarking verification to your AI system audit procedures.
The technical requirement is straightforward. The relational implications are not. Your checklist completion should address both.
