By Khush Kashyap, Senior Director of Governance, Risk and Compliance at Vanta
Transparency goes hand in hand with AI. Or at least it’s meant to.
Until now, transparency has mostly depended on how forthcoming people are about using AI. Detection tools can’t carry that weight on their own.
That is now changing. The EU AI Act’s transparency requirements, which came into effect this August, call on providers and deployers of certain AI systems to label or disclose content that is generated or manipulated by AI. Now, providers such as Anthropic and OpenAI have started to act.
This reflects a broader shift in AI regulation: transparency and traceability are moving from principles to practical requirements.
But, for businesses, the picture is far from clear. First, as regulators attempt to establish workable standards for identifying AI-generated content, the technology itself continues to evolve, making it a moving target. Second, while parts of the EU AI Act’s regulatory framework are moving forward, others, such as high-risk AI obligations are being pushed back.
This leaves businesses with a clear choice: wait for every detail to be settled, or start building the visibility and accountability that meaningful transparency requires.
Watermarking is only the tip of the AI governance iceberg
Watermarking is seen by many to reflect the EU AI Act requirements. But businesses must consider the limitations of the technology and whether it can provide reliable, lasting proof that content was generated or manipulated by AI.
A text watermark doesn’t survive much. Paraphrase it, translate it, or run it through a model that doesn’t watermark, and it’s gone. OpenAI’s own approach to EU text provenance rules makes the point with numbers: replacing a quarter of the words with synonyms dropped detection from roughly 92% to 17%, and shorter passages are far harder to detect in the first place.
The debate around watermarking tells us a lot about the practical challenges of regulating AI. This approach may help demonstrate transparency, but it cannot explain how AI is being used, whether human oversight took place or who is accountable for the outcome.
Look at how differently two providers have answered the same rule: Anthropic watermarks everywhere, while OpenAI turns it on by default only in the EU. If the technical layer is this unsettled, your governance can’t depend on it.
For this, broader AI governance is what’s needed.
The wider context of the EU AI Act
These implications extend far beyond watermarking.The Digital Omnibus, a separate amending regulation finalised in July, has pushed the high-risk deadlines out — to December 2027 for Annex III systems and August 2028 for AI in regulated products — and has also changed some of the Act’s definitions.
For instance, the definition of a “safety component” has been narrowed, so systems used purely for user assistance, performance optimisation, automation or convenience no longer automatically qualify — though the carve-out falls away the moment a failure could endanger health or safety.
These changes may affect which systems fall into the highest-risk categories, but requirements and prohibitions demonstrate that the regulatory direction of travel remains towards greater accountability, transparency and evidence.
My advice is simple: don’t set your pace by regulatory deadlines. If you wait for every standard to be finalised before you act, you end up doing it all in a rush — and that’s how you get security theatre, where more time goes into proving security than improving it.
The combination of new transparency requirements and extended timelines gives businesses two things they rarely have: clarity about the direction of travel, and more time. They should therefore treat it as a rare opportunity to build meaningful governance infrastructure before they are forced to do so.
Three priorities organisations should tackle now
Action doesn’t always equal governance. If organisations focus on producing labels or paperwork without understanding how AI is being used in practice, they are still exposing themselves to the same risks. They may understand whether their organisation uses AI, but not where it appears across products, workflows and customer interactions.
The following priorities can help businesses build the foundations they will need as future obligations take effect.
Build a complete AI asset inventory
Everything starts with visibility. Begin by identifying every AI system across your organisation, including tools introduced informally by teams or embedded within existing products and across your network.
Then understand what each system does, the data it processes, who owns it and its likely risk classification under the EU AI Act. This can help you understand where controls and evidence are still missing, and where risk is likely to grow.
Conduct AI impact assessments
For higher-risk AI systems, establish documented evaluations before deployment and when your systems change.
Assess factors such as bias, human oversight, transparency, accountability, security and data handling in a structured way. These assessments can serve a similar practical purpose to GDPR’s DPIAs by recording the risks identified, the controls applied and the decisions made.
The Act has its own fundamental rights impact assessments for certain deployers, but those sit in the delayed high-risk package — another reason to build the muscle now.
Create clear AI governance structures
Develop practical AI policies that cover acceptable use, data handling, human review and third-party AI tools. As part of this, assign clear ownership for AI governance across your organisation’s security, privacy, legal, compliance and product teams.
Be sure to maintain audit trails that show how systems were approved, what controls were applied and how risks are monitored over time. Governance should be proportionate to risk and scale as regulation evolves. This is how it supports responsible innovation, instead of slowing it down.
Turning transparency into action
Whatever side you take, the watermarking debate tells us that AI regulation is becoming increasingly tangible.
But we must avoid interpreting delays in the EU AI Act as reduced regulatory ambition or a free pass from responsibility. Instead, it must be treated as additional preparation time. Organisations that spend this time building robust AI governance programmes that give them the confidence to understand how AI works, the evidence to show how it is governed and the means to build better, more trusted products.
Right now, we are focused on whether AI-generated content can be identified. Instead, we need to ask ourselves if we can explain where AI is being used, what risks it creates and what controls are in place to manage it. So that transparency goes beyond the checkbox and becomes an ongoing capability.
