The EU now requires watermarks on AI content. Does that include you?

You may have seen the headlines over the summer: the EU now requires AI-generated content to be watermarked, around 190 companies have signed up to a code on labelling it, and the fines run to €15 million. All of that is true. Almost none of the coverage answers the only question a busy owner actually has: does any of it apply to my business?

For most UK firms, the honest answer is: less than the headlines suggest, for a reason worth understanding. The new duties follow two things — your role (do you make AI systems, or just use them?) and your market (does the AI, or what it produces, reach people in the EU?). Answer "use them" and "no", and this law is mostly your software suppliers' problem. But three of the duties attach to businesses that use AI, and if you sell into Europe you should know what they are.

What the new rules actually require

Four things, in plain English. Since 2 August, under the EU's AI Act:

• Makers of generative AI must watermark what it produces. Outputs have to carry a machine-readable mark identifying them as artificial. This is the headline duty, and it belongs to the companies building the tools; the EU's Code of Practice on the transparency of AI-generated content (published in June, with roughly 190 signatories by the end of July) sets out how they comply.
• If people interact with your AI, they must be told. A chatbot has to be disclosed as one, unless it is already obvious.
• Deepfakes must be labelled. Realistic AI images, audio or video of real people and events carry a disclosure duty that sits on the business deploying them as well as the toolmaker.
• AI-written text published to inform the public must say so — on matters of public interest, unless a human editor has reviewed it and taken responsibility.

Two footnotes on timing. The Commission published its implementation guidelines on 20 July, and an amendment package agreed in the spring gives tools that were already on the market until 2 December 2026 to add the machine-readable marks, per analysis by law firm Latham & Watkins (the package was still completing formal adoption as we wrote). Penalties for breaching these transparency rules reach €15 million or 3% of worldwide turnover.

Does any of it reach a UK business?

Only through the EU market. There is no UK watermarking law, and no UK equivalent of the AI Act; the UK regulates AI through existing regimes, data protection first among them. The EU's rules reach a UK business when it puts AI systems on the EU market, or when the AI's output is used by people in the EU.

Translated into cases: a UK firm using AI to draft product copy for UK customers is out of scope. A customer-facing chatbot on a site that serves EU customers carries the disclosure duty. AI-generated video published into EU markets needs its label. The postcode that matters is your customers', not yours.

Where the coverage overstates it, and where it doesn't

The overstatement is the watermark itself. It is the makers' job. If your business uses mainstream AI tools, the marking is being built into them by the people you already pay, and you do not need a watermarking project any more than you need a project to put serial numbers on your laptops. The mark goes in at the factory.

The understatement is the other three duties, which do land on businesses, and the reach, which follows your customers whether or not you ever think about Brussels. If deepfakes or public-facing AI content are anywhere near what your business publishes into Europe, this law is yours to read properly, and a blog is not legal advice: pay for an hour with someone who does this for a living.

One more honest note: the technology is younger than the law. Watermarks on AI content can be weakened or stripped, which is why the legal wording leans on "technically feasible" and why the code and the December grace period exist. This is machinery still bedding in.

And for most UK firms the sharper compliance question was never this law at all. If you run customer data through AI tools, your data protection duties already govern that, today, at home — we wrote about what GDPR compliance actually requires last week, and it applies whether or not the EU's AI rules ever touch you.

How we handle it in the systems we build

Disclosure by design, mostly. When we put an AI assistant into a client's system it introduces itself as one, and it can only read what the signed-in person is already allowed to see; the containment rules are written down in the AI laws a business needs. Where AI drafts something, a person reviews it and saves it under their own name; nothing goes out on a machine's authority. That pattern happens to be exactly how the public-interest text duty is satisfied, though it predates the law here: a business system should not act on anyone's behalf without a human deciding so.

In the same spirit: the hero image on this post is AI-generated. So are the others on this blog. Now you know, and it cost us nothing to say.

The two-question test

Do you make AI systems or products? Do your AI tools, or what they produce, reach people in the EU?

Two nos, and the watermark story is headlines rather than homework, at least for now. A yes, and the duties above are worth an hour of proper reading. Either way, one of the four is worth adopting without any law: when a machine is talking, say so. Customers forgive automation; they do not forgive disguise.