Two things happened on August 2, 2026, and almost nobody who runs a small business noticed either one.
The European Union's AI Act transparency rules under Article 50 began to apply. On the same day, California's AI Transparency Act became operative, after AB 853 pushed the original January date back specifically to line up with Brussels. Two of the largest regulatory blocks on earth landed on the same requirement at the same time: generative AI output has to be markable and machine-detectable.
I have had four conversations in the last month with owners who heard a version of this and reacted the same way. Either "am I about to get fined" or "great, now I can finally prove which vendor is sending me AI garbage."
Both reactions are wrong. Here is the actual situation.
What the law does and does not put on you
California's rule applies to what it calls covered providers: companies that build a generative AI system with more than one million monthly users accessible in the state. That is OpenAI. That is Google. That is Adobe. Penalties run $5,000 per violation with each day counted separately, which is exactly the kind of number that makes a headline and has nothing to do with your business.
It is not you. If you run a 15-person shop in Vacaville and you use ChatGPT to draft proposals, this statute does not create an obligation for you. A later tranche of AB 853 obligations lands on large online platforms and hosting platforms on January 1, 2027. Still not you.
So the compliance panic is misplaced. I want to be plain about that, because a lot of consultants are currently selling the panic.
The part that does reach you is quieter and more interesting. The law does not make you mark your content. It makes your vendors mark it for you, by default, without asking.
What is actually being embedded
There are two mechanisms and they behave very differently. Confusing them is where most of the bad advice comes from.
C2PA Content Credentials are cryptographically signed metadata attached to the file. Rich context: what made it, when, what was edited. Adobe, Microsoft, OpenAI, Meta, and a long list of camera manufacturers emit it. Microsoft started adding it to Microsoft 365 content in February 2026.
It is also brittle. A screenshot kills it. A re-encode kills it. Plenty of upload pipelines strip it on the way through. If your compliance plan depends on C2PA surviving a trip through a phone, a chat app, and a CMS, your compliance plan is decorative.
Embedded watermarks like Google's SynthID are different. The signal lives in the pixels or the waveform, not the file header, so it survives re-encoding and light editing far better. Google reports over 100 billion files watermarked since 2023. In May 2026 OpenAI and Google announced a dual-layer approach, pairing signed metadata with an embedded watermark, on the reasonable theory that one of the two will usually survive.
Text is the weak link and you should know this. Text watermarking is fragile against paraphrase. If someone runs machine-written text through a rewrite pass, most of the signal is gone. Which brings me to the thing I most want you to take away.
Do not buy an AI detector
Especially not for text. Especially not to police your staff or your contractors.
The false positive rate on text detection tools is bad enough that accusing an employee of AI use based on a detector score is a genuinely reckless management decision. You will eventually be wrong about a person who did the work themselves, and you will not get that trust back. I have watched an agency do this to a junior writer. It cost them the writer.
Provenance is a signal about origin. It is not a lie detector, it is not a quality score, and it is not evidence in a personnel matter.
What a watermark actually tells you
That a machine was involved. That is the entire claim.
It does not tell you the content is false. It does not tell you the content is bad. It does not tell you nobody thought about it. An AI-marked image can be the product of six hours of art direction and forty rejected drafts. An unmarked document can be a human being copying a competitor's blog post badly.
The absence of a watermark tells you even less, because the absence is the default state of everything made before 2024 and everything that passed through a pipeline that stripped it.
The three things to do this quarter
Check what you are already emitting. Run a few of your recent flyers, thumbnails, and social graphics through contentcredentials.org/verify. If you generated them with a mainstream tool, you are probably shipping provenance metadata you did not know about. Not a problem. But you should know, because a client may ask.
Write your disclosure position down before a client asks you. One paragraph. Where do you use AI in client work, where do you not, and what does a client get told. Deciding this under pressure in an email thread, after a client has noticed something, is the worst possible time to decide it. Deciding it now costs you twenty minutes.
Check your client contracts. This is the unglamorous one that actually bites. Some agreements already restrict processing client data through third-party services. That clause was probably written about subcontractors and it now reads onto your AI tools. Worth an hour with the two or three contracts that matter most.
The part that matters for the next five years
Marking is going to become universal and boring. That is the direction of the regulation and the direction of the platforms, and it is the correct direction.
When every machine-made artifact is labeled machine-made, the label stops distinguishing anything. Everyone has it. It becomes the floor, not the differentiator.
What remains scarce is the judgment behind the output: knowing which of the forty drafts to ship, knowing when the confident answer is wrong, knowing which problem was worth solving in the first place. No watermark can certify that, and no detector can measure it. That work has never been visible in the file. It is visible in whether the thing worked.
So the honest answer to "what do AI watermarks mean for my business" is: less than the headlines suggest, legally, and more than you think, competitively. They are about to make the machine-made portion of your work legible to everyone. The part that is actually yours will still have to prove itself the old way.
Next week I start a seven-part series on why AI projects stall out and what the ones that work do differently. First post: the difference between having an AI project and having an AI strategy.