SpaceXSI Output Watermarking page header for the Grok API AI watermark — Image credit: SpaceXSI Docs, Output Watermarking page

The AI watermark is no longer a lab idea. From November 7, 2026, text from the Grok API will carry an invisible watermark by default. SpaceXSI, the company formerly known as xAI, says it is doing this to comply with the EU AI Act.

I'm Nitin from the Debugged Pro team. We build chatbots, content tools and AI features for clients in India and the USA. A lot of that work runs on third-party model APIs, so a default change like this lands right on our desks.

This guide covers what changes, how the mark works, who can opt out, and what the EU rules actually ask for. I have kept it practical, with a checklist you can run this week.

What Changes on November 7

SpaceXSI added an Output Watermarking page to its developer docs that sets out the new default. TokenPost reported the change on October 31, a week before it goes live.

Here is the short version from the docs:

On by default: starting November 7, responses from supported models include a watermark.
No code change: there is no request parameter, and the response format stays the same apart from one header.
Every endpoint: it applies on the global endpoint, api.x.ai, and on regional endpoints.
All text APIs: it covers the Responses API and the Chat Completions API.
All text output: plain replies, structured outputs and tool call arguments are all covered.

Which Grok models get the AI watermark

The docs list seven model IDs:

grok-4.7
grok-4.6
grok-4.5
grok-4.3
grok-4.20-reasoning
grok-4.20-non-reasoning
grok-4.20-multi-agent

If your client app calls any of these, the change affects you. You don't have to do anything for it to start. That is exactly why you should know about it.

Screenshot of SpaceXSI docs explaining Grok API AI watermark starting November 7, 2026 — Screenshot: SpaceXSI Docs, Output Watermarking (captured November 2, 2026)

How the Grok AI Watermark Works

The mark is not a label or a hidden character. It is applied while the model writes. It slightly shapes which tokens the model picks, so the text looks normal to a reader.

Detection is statistical. SpaceXSI scores a piece of text and reports one of three results: watermarked, not watermarked, or uncertain. The docs say longer text gives a stronger signal.

A few points that matter for agencies:

Detection is gated. Access to the detection API is granted by application through a form. You can't just check any text yourself.
Short text is weak evidence. A tweet-length reply carries much less signal than a long article.
Quality and speed: SpaceXSI says watermarking does not change response quality or speed.

The x-watermark header

Each Responses API or Chat Completions API reply can include an x-watermark header. A value of true means that output was generated with the watermark. Any other value, or no header, means it was not.

This header is the easiest thing to log. If your backend already stores request IDs, add this header next to them. Later, when a client asks "was this text marked?", you will have a clean answer.

Who Can Opt Out of the AI Watermark

Opting out is possible, but it is not a casual toggle. Only team admins see the setting in the SpaceXSI Console. It is set per model, and it applies to every API key on the team.

The docs describe the steps like this:

Open the Team settings page and find the Model output watermarking row.
Open its settings and clear the box for each model you want to opt out.
Save, then confirm with Opt Out.

Changes apply to new requests within about 5 minutes. Every opt-in and opt-out is recorded in the team audit log.

The catch is the confirmation. To opt out, you confirm that an exception under applicable law applies to your use. You also accept that you are solely responsible for any marking or disclosure the law requires. Some models may also be locked on and can't be switched off from the Console.

For agencies, that means one thing. Don't let a developer flip this switch to fix a bug. It is a legal decision with an audit trail, and it should sit with whoever owns compliance on the account.

Why the EU AI Act Is Behind This

The European Commission FAQ on Article 50 of the AI Act explains the rule SpaceXSI is pointing to. Providers of generative AI systems must mark AI-generated text, images, audio and video in a machine-readable format so it can be detected.

The dates matter:

2 August 2026: Article 50 transparency duties start to apply.
2 December 2026: end of the grace period for marking duties on AI systems placed on the market before 2 August 2026.

The Commission also says providers outside the EU are covered if their system's output is used in the EU. That is the line Indian and American agencies should read twice.

European Commission FAQ page on AI Act Article 50 transparency and AI watermark rules — Screenshot: European Commission, Shaping Europe's digital future, Article 50 FAQ (captured November 2, 2026)

What the EU rules exclude

Not every output needs a mark. The Commission guidelines list some outputs that fall outside the marking duty:

Short sequences of numbers, symbols or letters
Source code
Machine-to-machine output that no human sees
Output used only in closed-loop industrial or product development, unless it is the final output

Assistive tools for standard editing are also left out. The FAQ also mentions a narrow exemption for some business-to-business or industrial uses, if the conditions in the guidelines are met.

Provider vs deployer: where your agency sits

The Act splits duties between providers, who build and ship the AI system, and deployers, who use it in their work. An agency that builds a branded chatbot for a client and ships it under its own name may be acting as a provider. A client using that chatbot is usually the deployer.

Deployers have their own duties. They must label AI-generated text published to inform the public on matters of public interest, unless it went through real human review or editorial control. The FAQ says spell-checks and grammar fixes don't count as review.

Fines for breaking these rules can reach 15 million euros or 3% of worldwide annual turnover, with some room for proportionality for SMEs. I'm not a lawyer, and this is not legal advice. But the numbers are big enough to get a proper legal opinion.

What This Means for Agencies in India and the USA

Most of our clients won't notice anything on November 7. The text will read the same and the API will respond the same. The real work is on paper and in your logs.

Here is how I'd think about it by type of project:

Project type	Risk level	What to do
Customer chatbot used by EU visitors	High	Keep the watermark on, add a clear "you are chatting with AI" notice, log the header
AI blog or news writer for EU readers	High	Keep the mark, add human editorial review, label unreviewed public-interest text
Internal tool, India or USA staff only	Low	Log the header, note the change in project docs
Backend pipeline, machine to machine	Low	Check if any output ever reaches a human, then document it

Take a common case. Say a US retail client has a product description generator that also feeds an EU store. That output is public, long, and seen by EU shoppers. We would keep the watermark on and add a human review step before anything goes live.

This also ties into wider AI governance. If you read our post on the robots.txt AI training opt-out signal, you will see the same pattern. Big AI companies are turning legal duties into product defaults, and agencies need to keep up.

AI Watermark Checklist for Your Team

Here is a 7-step checklist you can run before November 7:

List every Grok API call. Note the model ID, the client, and where the output ends up.
Mark EU exposure. Flag any app whose output is seen by people in the EU.
Log the x-watermark header. Store it with request IDs so you can prove what was marked.
Lock down the Console. Limit team admin rights and review the audit log each month.
Write an opt-out policy. No opt-out without written sign-off from legal or the client.
Check your other providers. Ask each model vendor how they plan to meet the 2 December 2026 marking date.
Update client contracts. Make clear who is the provider, who is the deployer, and who handles labels.

If your agents also take actions, not just write text, pair this with access controls. Our guide on AI agent security and human approval covers that side.

Common Mistakes to Avoid

Treating the mark as a label. The FAQ says deployers can't rely on machine-readable marks alone when a visible deepfake disclosure is needed.
Promising clients you can detect AI text. Detection is statistical, gated by application, and weaker on short text.
Opting out for convenience. It needs a legal basis and leaves a record in the audit log.
Forgetting tool call arguments. The docs say these are covered too, so check any pipeline that parses them.

If you need help mapping your AI stack against these rules, our software development consulting team does this kind of audit for clients.

Key Takeaways

From November 7, 2026, Grok API text carries an invisible AI watermark by default.
It covers seven Grok model IDs, all text APIs, structured outputs and tool call arguments.
Check the x-watermark header to see if a response was marked.
Only team admins can opt out, per model, and only with a legal reason they confirm.
EU AI Act Article 50 applies from 2 August 2026, with marking grace until 2 December 2026.
Agencies outside the EU are in scope when their system's output is used in the EU.

Frequently Asked Questions

What is the Grok API AI watermark?

It is an invisible statistical mark that SpaceXSI adds to text from supported Grok models. It slightly shapes which tokens the model picks, so it adds no characters or hidden text. SpaceXSI can later score text to say if it is watermarked, not watermarked, or uncertain.

When does Grok API watermarking start and which models are covered?

It starts on November 7, 2026. The SpaceXSI docs list grok-4.7, grok-4.6, grok-4.5, grok-4.3, grok-4.20-reasoning, grok-4.20-non-reasoning and grok-4.20-multi-agent. It covers the Responses and Chat Completions APIs, including structured outputs and tool call arguments.

How can I check if a Grok API response was watermarked?

Read the x-watermark header on the API response. A value of true means the output was generated with the watermark. Any other value, or no header, means it was not.

Can my agency turn the AI watermark off?

Team admins can opt out per model in the SpaceXSI Console, and the setting applies to every API key on the team. To opt out you must confirm that a legal exception applies to your use and that you are responsible for any marking or disclosure. Some models may be locked on.

Does the EU AI Act apply to agencies in India or the USA?

It can. The European Commission says providers outside the EU are covered if the output of their AI system is used in the EU. Article 50 applies from 2 August 2026, with a grace period to 2 December 2026 for marking duties on systems already on the market.

About the Author

Nitin Kumar is the Lead Project Coordinator at Debugged Pro. He works with developers and clients across India and the USA. He helps plan and ship AI features, web apps and integrations, with a focus on safe rollouts.