Google opened its AI-content detection tool to everyone, and OpenAI started watermarking outputs for European users. The usual first reaction is relief: finally, we can check. We suggest a calmer reading — these tools are useful, but they are not evidence, and no business decision should rest on them alone.
What a detector actually tells you
A watermark is a signal, not a signature. If a tool says "this image was probably generated", that is a useful hint. If it says nothing, that does not mean a human made it: watermarks can be stripped, a screenshot removes many of them, rewriting through a second model erases the traces, and most self-hosted models mark nothing at all. OpenAI's own EU labelling has been openly described as unreliable and easy to remove.
In practice there are two different failures. A false positive means accusing someone of something they did not do. A false negative means accepting content you thought was human. The first one costs more in reputation than the second. That is why a detector should never be the only argument for rejecting anyone.
Hiring: stop grading text, start grading work
Cover letters and "send us your take on this" assignments are dead as signals. There is no point in bolting a detector check onto a process that measures a skill a model performs for free in five seconds. Rebuild the process instead: a small, real task from your actual context, followed by a 20-minute conversation where the candidate explains their choices and answers follow-ups.
And the simplest step of all: ask directly. "Which AI tools did you use for this, and what did you change yourself?" A ban is unenforceable; an honest declaration is not. A candidate who can clearly describe where the machine helped and where they intervened is usually the better hire compared to one who claims to have used nothing.
Procurement: put it in the contract
If you buy copy, images, code or translation, do not write "no AI allowed" into the contract — you cannot verify or enforce it. Write two other things instead. First, a disclosure obligation: the supplier states where and how generative tools were used. Second, accountability for the result: rights are clean, facts are checked, and your customer data never went into a third-party model. That shifts the conversation from "did a machine make this?" to "who is answerable for it?" — the only question with commercial meaning.
Your own content: decide the rule before someone asks
EU transparency requirements are gradually arriving in products, and soon in client questionnaires. We recommend a one-page internal rule rather than waiting for the regulation to settle. Three answers are enough: what we label (for example, generated images and video in campaigns), what we do not label (language editing, structuring a draft, internal summaries), and who reviews before publication. Add a light trail — which tool was used and who approved it. It takes a few minutes a week and saves an awkward conversation later.
Where detection does earn its place
An honest nuance: mass detection has real value. If you receive hundreds of new accounts, reviews, image uploads or applications, an AI-content signal is a reasonable one filter among many, alongside account age, IP patterns and behaviour. The recent streaming-royalty fraud case — mass-generated tracks plus thousands of bot accounts, millions siphoned off — shows these patterns are real and already in court records.
But that is also where the line sits. For a decision about one individual — rejecting a candidate, terminating a supplier, warning an employee — a detector score is not enough. That requires a conversation, context and a person who takes responsibility. Our experience building these systems points the same way: the tool gives a signal, the process gives the decision. If all you have is the tool, you do not really have anything.