AI generated images: who adds a watermark, and who can verify it?

Almost every major AI lab now marks the images it generates. Each one does it its own way, and verification is scattered: OpenAI offers an API with very low limits, Google and Meta only offer a web tool, and many generators leave no trace at all. For anyone reviewing supporting documents, the practical question is simple: when an image or an AI generated document lands in a file, what can you read, and what does it prove?

AI watermarks at a glance

The table sums up, publisher by publisher, what the delivered file contains and who can verify it. Status as of November 8, 2026, based on our survey of images delivered by the APIs and on each lab's public documentation.

yes partial or limited no. "Trusted C2PA": valid signature from a signer on the C2PA trust lists. Partial: valid signature from an untrusted signer, self signed, or malformed.

Two families of markers

Metadata in the file

The file declares its origin in blocks added around the image. C2PA, or Content Credentials, is a manifest digitally signed by the tool that created or edited the image: it states which tool, which action, and when. The IPTC field "trainedAlgorithmicMedia" declares a generated image, without a signature. The Chinese TC260 label is an XMP marking required in China since September 1, 2025.

Any tool can read these markers. They disappear with the slightest screenshot, a pass through a messaging app, or a simple re-save.

The invisible watermark in the pixels

An imperceptible signal is woven into the image itself. It survives a re-save and sometimes a light edit. The main ones are SynthID at Google, also adopted by OpenAI, Content Seal at Meta, the Amazon Titan and Nova Canvas watermark, and the open source invisible-watermark library shipped with the Stable Diffusion code.

Each watermark can only be read with its owner's key. Only the Stable Diffusion one can be read by anyone, and it is also the most fragile.

Who can verify, and how?

OpenAI is the only lab with a usable verification API. It is free and reads OpenAI's C2PA and SynthID, and nothing else. In our October 6, 2026 test on 15 images, it capped at about 20 calls per hour. A public tool, openai.com/verify, is in preview. SynthID has been applied since May 2026, except on gpt-image-1 and its derivatives.

Google only verifies in house. SynthID can be checked in the Gemini app and on the SynthID Detector portal, opened to everyone in October 2026 according to the press. An enterprise API has been mentioned, with no official confirmation to date.

So does Meta. Content Seal, proprietary since July 2026, can only be checked on meta.ai/identification. Meta's open source tools do not read this watermark, and Muse Image files only carry an unsigned IPTC field.

Amazon offers an API, DetectGeneratedContent, in preview in Bedrock, limited to images from its own models.

Everywhere else, you read what the file declares. Black Forest Labs, ByteDance (Seedream) and Recraft sign with C2PA using a valid certificate that is not on the trust lists. xAI signs with a certificate it created itself, marked "LOCAL USE ONLY". Microsoft declares a watermark but ships a malformed manifest. Alibaba puts the TC260 label on its Qwen images. Midjourney publishes neither C2PA nor any known watermark.

Our survey: 37 models, 428 files

To build our training set, we had thousands of receipts edited by the generators available on OpenRouter. We kept 12 raw outputs per model, exactly as delivered by the API, and read their metadata with Koncile's AI image test. C2PA signatures were checked with the official SDK and the contentcredentials.org trust lists.

The results are clear. The most widely used American models all sign their images, but only OpenAI and Google do so with a trusted certificate. Ten models out of 37, from four publishers, deliver a file with no declaration at all. Tencent does not apply the Chinese label in files delivered through OpenRouter, while Alibaba applies it to every image.

What each marker proves, and what erases it

• Trusted C2PA. The signing tool created or edited the image, and any change after signing shows, because the integrity check fails. It disappears with a screenshot, a re-save, and most messaging apps and social networks.
• Untrusted or self signed C2PA. An intact declaration, with no recognized guarantor for the signer. Same weaknesses.
• IPTC and TC260 label. A plain declaration that any metadata editor can change.
• SynthID. The image came from one of the lab's models. In our test, a ChatGPT copy re-saved without metadata was still detected. A heavy crop or pasting the image onto another background can erase it.
• Content Seal. The image was generated or edited by Meta AI. Reuters found 55 % of images went unrecognized after a simple crop.
• invisible-watermark. The image came from the Stable Diffusion reference code. A JPEG at quality 90 is enough to erase it: on our photographed receipts, about two out of three had already lost it.

Regulation is pushing toward dual marking

European Union. Article 50 of the AI Act requires providers of generative systems to mark their output in a machine readable way. The obligation has applied since August 2, 2026. A delay to December 2, 2026 for systems already on the market has been floated in the omnibus package, without confirmation. The final code of practice, published on June 10, 2026, recommends two layers: signed metadata, and an imperceptible watermark that takes over when the metadata is gone. The code is voluntary, and signing it creates a presumption of conformity.

China. Since September 1, 2025, the CAC measures and the GB 45438-2025 standard require an implicit label in the metadata of all generated content. This is the TC260 marking we find on every Qwen image.

Both texts target those who build the models. An open source model run on a personal computer escapes any marking.

What this means for detecting a fake document

• Read the markers first. It is fast, free, and decisive when the marker is there. Koncile reads C2PA, IPTC, EXIF and the TC260 label on every image, including those embedded in a scanned PDF.
• Real files do contain them. Out of 35,917 files in our database, 10 real documents sent by customers declared an AI: six ChatGPT, one Google, two unsigned XMP and one edit.
• A file without a marker is still suspect. The 9,700 fakes in the public AIForge-Doc dataset all lost their metadata when they were posted online. That is the usual case for a fake in circulation.
• So you have to look at the pixels. A trained detector recognizes how generators build an image, even when every declaration is gone. It complements the markers without replacing them. We cover these methods in our guide to AI fraud detection and in our review of open source models to detect AI generated images.
• Lab APIs remain a supplement. They only read their own watermark, and their rate limits cannot handle a production flow.

Sources

• Koncile measurements: AI image test run on 35,917 files and test of OpenAI's Content Provenance API on 15 images (October 6, 2026), survey of 428 raw outputs from 37 models via OpenRouter (November 8, 2026).
• OpenAI, C2PA and SynthID in OpenAI generated images
• Google, Verify Google AI generated images with SynthID
• AWS, Titan Image Generator and watermark detection API
• Fstoppers, Reuters analysis of cropping
• Jones Day, final code of practice on marking AI generated content
• Covington, China's AI content labeling rules