There are three technologies being sold under the name AI watermarking, and they fail at different points in your publishing pipeline. Conflating them is why the enterprise conversation goes sideways.
- Provenance metadata. A signed cryptographic manifest attached to a file header, such as C2PA or Content Credentials. It answers where a file came from and whether it was altered. It dies at the first format conversion. A screenshot, a print-to-PDF, a paste into Word, or a social media platform’s upload compression strips it entirely.
- Statistical text watermarks. The model biases token sampling at generation time toward a hidden list of favored words. It answers whether a specific model produced the text. It requires the vendor’s detector and often a cryptographic key. It degrades under paraphrase, translation, summarization, or round-tripping through a second model.
- AI-content detectors. These are not watermarks. They infer machine generation from perplexity, burstiness, and stylistic tells. They are the least reliable of the three, and the only one that causes immediate reputational damage.
A vendor demo of metadata gets treated as coverage for a detector. The physics of the three technologies do not overlap.
The Real Threat Model
The pitch for watermarking usually centers on intellectual property protection or preventing employee plagiarism. The actual risk is asymmetric and external. A third party—a journalist, a customer, a litigant—runs an open-source detector against your public sustainability report, annual filing, or press release.
A utility publishes its sustainability report in March. In June, a trade-press data journalist runs it through a free detector and gets a 94% AI score. Two paragraphs were drafted by an LLM and heavily edited by a human. The rest were written entirely by humans. The detector cannot tell the difference. The correction runs three weeks later, below the fold. The original headline is what ranks in search engines.
Detection is an accusation, not a proof. The accusation is the damage. You cannot disprove a probabilistic score in a news cycle. The first person to run a detector against your annual report will not be you.
The Source Code Delusion
Legal and compliance teams often want generated code watermarked to prove provenance and avoid copyright infringement. This ignores the physics of software development.
Code is immediately subjected to linters, formatters, and compilers. A token-probability watermark applied to a five-line sorting function will not survive being integrated into an existing codebase, formatted to company standards, and refactored during peer review. You cannot watermark a boolean, and code formatters do not care about your token distribution.
For source code, watermarking is the wrong control. The actual risks are training-data provenance and indemnity. Those are contract questions. Rely on commit trails, code review, security scanning, and vendor contracts.
Chain of Custody, Not AI Governance
Watermarking is a chain-of-custody control. Your organization already manages chain of custody for legal holds, financial records, and safety documentation. Most enterprises file AI watermarking under the AI platform team, which is the wrong drawer.
When a regulator sends a letter asking whether AI was used in a set of filings and what controls existed, the team that owns the AI platform has usually never spoken to the team that owns records retention. If opposing counsel argues your AI-assisted internal documents are unreliable during discovery, and you have no logs, no keys, and no drafts, you have a narrative you cannot refute.
Provenance is a records retention problem. You already solved it for other documents. You just didn’t invite the AI team.
Sorting Your Content
Classify content by blast radius and transformation path, not by which tool produced it. For each content class, evaluate the cost of a false accusation, the cost of an undetected true finding, and whether the mark survives the publishing workflow.
- Internal drafts and knowledge bases: Low stakes. Ignore watermarking. Log usage if your retention policy covers it.
- Source code: Watermarking is the wrong tool. Use commit trails, peer review, and contractual indemnity.
- Public marketing and thought leadership: Medium stakes, high accusation risk. Pre-score your public corpus with common detectors so you know what they will say before a third party runs them.
- Investor, ESG, and regulatory filings: High stakes. Use provenance metadata where it survives the workflow, but rely primarily on prompt retention, draft retention, and approval records. Assume the disclosure question is coming.
- Customer deliverables and RFP responses: Contractual risk. Read the AI disclosure clause before signing. Retain review records.
- Training data and licensed corpora: A membership inference and licensing problem, not a watermarking problem.
What changes the answer is your sector, your jurisdiction, the contract terms you have already signed, and whether the content carries a legal signature. Financial services, healthcare, and defense have specific regulator transparency obligations that override general enterprise policies.
Procurement and Vendor Demos
When a vendor pitches enterprise-grade watermarking, they are often trying to satisfy a procurement security questionnaire. Test the control against your actual workflow before you sign the master service agreement.
Ask the vendor to run their detector after the text is pasted into Word, saved as a PDF, and re-exported. Ask them who holds the detection key and what happens to it if the vendor is acquired or sunsets the model. Ask them to paraphrase the text through a second model and run the detector again. Most demos end early when you ask these questions.
If your threat model is adversarial—plagiarism, sanctions evasion, procurement fraud—the watermark does not survive a two-step paraphrase through a consumer-grade model. Paraphrase is the universal watermark remover. Price your controls against the threat you actually have, not the one the vendor is selling.
Do not deploy internal AI detectors to screen employee output. The false-positive rate on non-native English writers and technical documentation is unmeasured. You will just build a bias machine with discovery exposure. A human writes a sensitive draft, an editor runs it through an enterprise LLM to smooth the tone, and the tool silently embeds a statistical watermark. You just laundered human authorship into a machine-generated liability.
Watermarking answers “did a machine make this.” Your filings, contracts, and regulators ask “who is accountable for this.” Keep the original file, the prompt logs, and the review record. Neither can be reconstructed from a detector score.