There is a belief moving through Hong Kong offices right now that goes like this: AI writing can be caught by a checker, and the checker either says yes or no. Both halves of that belief are wrong, and the second half is the expensive one.
Since 2 August 2026, major AI providers have begun marking the text their models produce. The mark is real. What it can tell you is much narrower than most people assume.
What is AI text watermarking?
AI text watermarking is an invisible statistical pattern left inside text as a model writes it. A party holding the matching key can later estimate the likelihood that the model was involved. Nothing is added to the text, no characters are hidden inside it, and a reader cannot see it.
The word watermark is misleading, because a watermark on a banknote is visible when you hold it to the light. This one is not visible under any light. It lives in the choice of words themselves.
Anthropic published its explanation of the method on 14 August 2026, in a post titled How Claude's text watermark works. CNN ran a general-audience explainer on 20 August 2026, which is a fair signal that the term has left the technical press and is now arriving in client conversations.
How does a text watermark work?
A language model writes one word at a time. At each step it holds a short list of words that would all be acceptable, and it picks one using a random number.
Take the sentence "The weather today was cold and...". The next word will not be "sugary". It could reasonably be "overcast" or "grey", and the sentence means the same thing either way. That coin-flip happens hundreds of times in a long document.
Watermarking does not change which words are candidates. It changes where the randomness comes from. Instead of an arbitrary random number, the model uses a secret key plus the words just written to settle the coin flip. Afterwards, anyone with the key can measure whether the whole sequence looks like the choices that key would have produced.
An analogy that makes this concrete
Imagine a board game where each turn is decided by a dice roll. Now replace the dice with a printed book of the digits of pi, starting from a randomly chosen digit somewhere in the middle. To the players, nothing has changed. The moves are still unpredictable and the game plays the same way.
But if you kept a record of every move and you had the same book, you could work out afterwards that this particular game probably used the book rather than dice. That is exactly what a text watermark is: a game that used the book.
Three consequences follow directly, and they are the reason the technique was chosen:
--- No extra words are produced, so the output is not longer and not more expensive to generate.
--- The method carries no information about the user, the company, or the conversation. There is nothing in the mark to trace back to a person.
--- Quality is unaffected. The method comes from the SynthID-Text approach published by Google DeepMind in Nature in 2024, where a watermarked model was served to a share of live traffic and showed no statistically significant difference in user thumbs-up and thumbs-down ratings.
What can a watermark prove, and what can it not prove?
A watermark answers exactly one question: how likely is it that this specific model was involved in producing this text? It does not identify the writer, does not confirm that text is human-written, and cannot recognise a different company's model.
That single sentence is the whole article, so it is worth spelling out what it rules out.
It cannot tell you who wrote it. There is no user identity, no company, no account and no timestamp inside the mark. A positive result says a model touched the text. It says nothing about which employee, which laptop, or which client project.
It cannot separate "the AI wrote this" from "the AI heavily edited this". Both look the same to the detector.
It cannot clear anyone. A negative result is not evidence of human authorship. The text may have come from a different model, from an older model still inside its transition period, or from a passage too short to measure.
You cannot check it yourself today. Detection requires the provider's key. Anthropic has said a detection API is coming but that the details are still being worked out. Until such tools are public and independently testable, no ordinary business can run this check on a supplier's document.
Why are AI companies watermarking text now?
The trigger is regulation, not customer demand. Around 190 signatories signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026, and from 2 August 2026 providers serving the EU market are required to mark AI-generated content.
The detail that matters outside Europe is scope. Anthropic states that it is applying watermarking globally at launch, because there is no durable way to switch it on for European users only. Hong Kong has no equivalent marking law, and yet Hong Kong output is marked anyway.
This is the same pattern documented in the SynthID entry in this hub, which covers the image and video version of the same idea. Text is the harder case, because an image has millions of pixels to hide a signal in and a two-paragraph email has perhaps forty free word choices.
Where the mark fades or disappears
--- Short passages. Fewer word choices means less signal. Confidence rises with length.
--- Factual sentences. After "Isaac Newton's most famous work was called Principia..." the next word has one correct answer, so there is no free choice for the mark to occupy.
--- Proofreading. If you write the text and the model only fixes grammar, almost every word is yours and there may be nothing measurable left.
--- Code. Exact output cannot be varied, so code carries much less marking. Comments inside code can carry some.
--- A complete rewrite. Replacing every word removes the mark, at which point it is arguable whether the text is AI-generated at all.
--- Translation is the opposite case. A translation produced by a model is fully marked, because every word in the output was chosen by the model. For a bilingual Hong Kong business that publishes English and Chinese versions of the same page, the translated version is the more strongly marked of the two.
What does this mean for a Hong Kong business?
Nothing needs to be bought and nothing needs to be installed. What changes is that "did you use AI for this" becomes a question a client can now ask with a straight face, so a business needs an answer ready. Three situations show where it lands.
A marketing agency in Wan Chai delivering copy to a corporate client. Procurement asks whether AI was involved in the deliverable. The honest answer is usually "yes, for drafting, and a person edited and approved it". A watermark cannot produce that sentence for you, and it cannot contradict it either. What protects the relationship is a disclosure line agreed in the contract before the first invoice, not a hope that nothing shows up.
A 12-person engineering firm submitting a tender. Some tender packs now carry an AI-use declaration. Because marks are probabilistic and detection tools are not publicly available, the defensible position is a written record of your own process: which parts were drafted with assistance, who reviewed them, and what was checked. That record is under your control. A detector's verdict is not.
A trading company assessing a supplier's proposal. Somebody pastes it into a free online checker, gets a clean result, and concludes a human wrote it. This is the costliest inference in the whole subject, because a clean result is consistent with a different model, an older model, or simply a document short enough to be unmeasurable. Judge the proposal on whether the numbers, dates and delivery terms hold up. That test worked before watermarking existed and still works now.
One related point on files. When a model produces a supported file such as a .png, .jpg or .svg, some providers now attach a content credential in the file's metadata under the open C2PA standard, saying the file was made or processed with AI. That is a label attached to the file, not a mark woven into it. Nothing inside the file changes, and any C2PA-aware tool can read it.
Common misconceptions about AI text watermarks
"A watermark will show me who wrote it." It will not. The mark contains no identifying information about a user, an organisation, or a conversation, by design.
"No watermark means a human wrote it." False, and the most common error. Absence of a mark is not evidence of human authorship.
"Watermarking makes AI writing worse, slower or dearer." No extra tokens are produced, so there is no additional cost and no measured quality difference. A reader cannot distinguish marked from unmarked text.
"This is the same thing as an AI detector." It is not. Detection software such as Pangram does not hold any provider's key. It looks at stylistic tells instead, including the "this isn't X, it's Y" construction and an unusual fondness for the word "quietly". Watermark checking and style detection are different methods with different failure modes.
"A watermark changes who owns the text." It does not. The mark only helps test whether a model was involved. It says nothing about ownership or legal responsibility.
Frequently asked questions
Can I remove a watermark by editing the text?
Light editing probably will not remove it. A complete rewrite in which every word is replaced will, and at that point it is arguable whether the result should still be described as AI-generated.
Does watermarking apply to Chinese output?
The method works on word choice rather than on any one language, and providers describe it as applying to model output generally. Translation output is marked, because every word is chosen by the model.
Does Hong Kong law require AI content to be marked?
There is no general Hong Kong marking requirement of this kind. The driver is the EU AI Act, plus client contracts and platform rules, which are often stricter than any law. This is general information and not legal advice.
Should we tell clients when we use AI?
That is a commercial decision, not a technical one. The practical point is that the decision is better made once, in writing, than improvised the first time a client asks.
What about models released before August 2026?
The EU rules include a transition period for models launched before 2 August 2026, and providers have said marking for those older models is being rolled out over the following months. So an unmarked document today may simply have come from an older model.
The one thing worth deciding this week
Watermarking is not a threat to a Hong Kong business and it is not a tool a Hong Kong business can use yet. It is a change in the background conditions: from now on, a growing share of AI-written text carries a mark, and no useful conclusion can be drawn from the absence of one.
So the useful action is not technical. Write down, in one paragraph, how your company uses AI in work that goes to customers, and who checks it before it leaves the building. That paragraph answers the client question, satisfies most declarations, and costs an afternoon. A detector result would not have done any of those things.
This is the sort of unglamorous groundwork that makes the technology usable rather than nerve-racking. We understand AI. UD stands with you.
Reviewed by the UD AI team.
Work out where your business actually stands
Knowing what a watermark proves is one piece. Knowing which of your own workflows already depend on AI, and which of them nobody is checking, is the piece that changes decisions. UD has spent 28 years helping Hong Kong companies get this right, and we will walk you through it step by step, from a plain-language readiness check to a written process your staff can follow.
