xAI Starts Watermarking Grok API Text Under EU AI Act Pressure

As of November 7, 2026, xAI's Grok API adds an invisible, machine-readable watermark to the text it generates by default, across seven models, with no code changes required from developers — a move xAI's own developer documentation says is meant to satisfy transparency duties under Article 50 of the EU AI Act. The company has not signed the European Commission's voluntary Code of Practice on Transparency of AI-Generated Content, a pact that Anthropic, OpenAI, Google, Meta, Microsoft and Mistral have all joined, which makes xAI's approach a unilateral technical fix rather than a reporting commitment to Brussels.

What changed on November 7

According to the "Output Watermarking" page in xAI's developer documentation, text responses from supported Grok models now carry an invisible watermark that is applied during generation. The documentation describes the mechanism as something that "subtly influences token selection" without adding any visible characters, markup, or hidden text to the output. It covers standard text generation, structured outputs, and tool call arguments across both the Responses API and the Chat Completions API, on xAI's global endpoint and its regional endpoints alike.

The watermark is on by default for seven current models: grok-4.7, grok-4.6, grok-4.5, grok-4.3, and the three grok-4.20 variants — reasoning, non-reasoning, and multi-agent. Several of those models were introduced only months earlier; xAI's own release notes list grok-4.7 as a September 2026 addition and grok-4.6 as an August 2026 one, so the watermark default arrived close behind the models it now covers rather than as a retrofit to long-established releases. xAI's documentation says no request parameter is needed and no change to existing integration code is required; the only visible difference is a new response header. Retired models, such as grok-3, are not covered by the change. The documentation does not state that grok.com, the consumer Grok apps, or Grok on X carry the same default watermark, and no date has been given for extending it there.

How the watermark works, and how to detect it

xAI's documentation describes the watermark as a statistical signal baked into word-choice patterns rather than anything a reader or a plain-text diff would notice. There is no added character, no zero-width Unicode trick, and no footer text. Detection is correspondingly indirect: xAI offers a detection capability that scores a piece of text as watermarked, not watermarked, or uncertain, with the documentation noting that longer passages produce a stronger, more reliable signal than short ones. Access to that detection capability is granted per application through a form, rather than being open to all developers.

For day-to-day use, the simpler signal is the x-watermark HTTP response header returned alongside each API call. A value of true indicates the specific response was generated with the watermark active; any other value, or the header's absence, indicates it was not. This gives developers a cheap way to confirm, per request, whether a given completion was marked — useful for logging, compliance records, or simply satisfying curiosity about which calls are covered.

Which models and endpoints are covered

The table below summarizes the scope as described in xAI's documentation.

Some reporting on the change has noted that xAI's own console and documentation refer to the API operator by the internal name "SpaceXSI" in places rather than "xAI" — a naming detail worth flagging for accuracy, though it does not change the substance of what the feature does.

Who can turn it off, and what that requires

Individual developers cannot opt out on a per-key basis. According to xAI's documentation, only a team admin can change the setting, and only at the level of an entire team's API usage. The process runs through the Console's Team settings page, where a "Model output watermarking" row lets an admin view the status as On, Off, or Custom, then choose which models to exclude. Saving a change requires the admin to explicitly confirm that an applicable legal exception applies to their use case, at which point responsibility for any related disclosure or compliance obligation shifts to the team itself rather than xAI. Changes propagate to all API keys on the team within roughly five minutes and are recorded in the team's audit log. The documentation also notes that some models may be locked on for a given team, in which case no opt-out checkbox is available at all.

That combination — opt-out available, but gated behind a legal attestation and limited to administrators — effectively pushes the compliance judgment call onto each customer rather than resolving it centrally. A team that disables watermarking for a model is, per xAI's own framing, taking on the obligation to mark or disclose AI-generated content some other way if EU rules require it for that use case.

The EU AI Act rule behind the change

xAI's documentation states plainly that the feature exists "to comply with the EU AI Act." The relevant provision is Article 50 of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), which sets out transparency obligations for certain AI systems — including a requirement that synthetic audio, image, video and text content be marked in a machine-readable way so it can be detected as artificially generated or manipulated. Those transparency obligations took effect on August 2, 2026, two years after the regulation entered into force, with systems already on the market before that date subject to a transition period that multiple analyses have placed around December 2, 2026. November 7 — the date Grok's default watermark activated — falls inside that window, rather than after some separate Grok-specific deadline.

Article 50 does not, by itself, specify a watermarking method; it sets a transparency goal and leaves providers to implement a technical means of meeting it. That is the gap the European Commission's Code of Practice was designed to fill.

The voluntary Code of Practice xAI did not sign

Separately from the binding statute, the European Commission published a Code of Practice on Transparency of AI-Generated Content that providers and deployers can sign to demonstrate a Commission-endorsed path to Article 50 compliance. The Commission's own page is explicit that "adherence to the code of practice is voluntary," and that declining to sign does not, on its own, amount to non-compliance with the AI Act. According to the European Commission's published signatory information, roughly 190 organizations had signed by the end of July 2026, and the list of named signatories to the section covering generative-AI providers and model makers includes Anthropic, Google, Meta, Microsoft, Mistral and OpenAI. xAI does not appear on that list.

That puts xAI's watermark rollout in a different category from, say, Anthropic's own text-watermarking commitment: Anthropic's move was folded into a Code of Practice pledge made publicly to the Commission, while xAI — the company Elon Musk founded in 2023 and later merged with X, according to its Wikipedia entry — has instead made a product change described only in its own API documentation, built around its own default-on mechanism and its own opt-out criteria, with no parallel public commitment to the EU's voluntary framework. Both approaches are aimed at the same Article 50 obligation; they simply arrive by different routes, one through a multilateral pact and the other through a unilateral engineering decision disclosed in a docs page and a response header.

What it means for developers and enterprise users

For most API users, the practical change is minor: no code needs to be rewritten, no new parameter needs to be passed, and xAI's documentation states that output quality and response speed are unaffected — though that is xAI's own claim, not something Pandromeda has independently measured. The bigger practical question is for teams operating in regulated or disclosure-sensitive contexts, such as those generating marketing copy, journalism-adjacent text, or customer-facing content in the EU, where Article 50's labeling expectations may already apply regardless of what the underlying model does. For those teams, the x-watermark header offers a lightweight way to log, per request, which outputs the provider itself considers marked for EU purposes — useful evidence to keep on file even if a given team ultimately decides to apply its own labeling as well.

Teams that genuinely need to disable the feature — for example, if they operate entirely outside the EU and have a documented legal basis for exemption — have to go through an admin-level attestation rather than a lightweight toggle, which means the decision will typically need sign-off from whoever owns compliance risk for the account, not just the engineer wiring up the API call.

Limitations and open questions

A few things remain unresolved or only partially documented. xAI's own pages do not give a public technical specification for the watermarking algorithm, nor independent, third-party verification of the "no quality or speed impact" claim. The detection capability is gated behind an application process rather than open access, so outside researchers cannot freely stress-test how robust the mark is to paraphrasing, translation, or short outputs. xAI's documentation also does not commit to extending default watermarking to grok.com, the consumer Grok apps, or Grok's presence on X, leaving a gap between the API's new default and the much larger population of everyday Grok users. None of these gaps are unusual for a first rollout of this kind, but they are worth tracking as the December 2, 2026 transition deadline for pre-August systems approaches and as the Commission's Code of Practice task forces, which the Commission's own materials say were due to convene from September 2026, continue their work.

What to watch next

Three things are worth monitoring in the coming weeks. First, whether xAI publishes any further technical detail on the watermarking method, beyond the high-level description in its current docs — our earlier look at Grok's model lineup and pricing and specs versus Gemini 4 Carbon found that the company tends to disclose capability details gradually rather than all at once. Second, whether the EU AI Office treats a unilateral technical measure like Grok's watermark as satisfying Article 50 on its own, or whether non-signatories to the Code of Practice face closer scrutiny — a dynamic to watch alongside other recent regulatory and market pressure on AI labs, including the way scrutiny has weighed on AI company valuations this year. Third, whether xAI extends default watermarking beyond the API to grok.com and the consumer Grok apps, which today remain outside the scope of this change. Pandromeda will update this article if xAI's documentation changes or if the Commission or AI Office issues further guidance specific to Grok.

Written byTheo Park

Theo Park runs the AI desk at Pandromeda. He follows model launches from the frontier labs and the open-weight community, tracks the assistants and developer tools built on them, and explains what each release changes on pricing, capability and safety. His reporting leans on primary sources: model cards, technical reports, API documentation and the companies' own announcements.

More from Theo ParkAll AI coverage