Method to enforce watermarking instructions by a security module in a receiving device, said receiving device further comprising a descrambling module for descrambling scrambled audio/video data using at least a content key, and a watermarking module to embed a watermark into the descrambled audio/video data based on a watermarking data which comes from said audio/video data or another source, said method comprising the steps of: - receiving a security message by the security module, comprising at least the content key, a watermark instruction and security message signature, said watermark instruction activates or deactivates the watermarking module, - decrypting the security message with a transmission key, - verifying the security message signature, and in case of successful verification, performing the following steps: - in case said watermarking data comes from said audio/video data: - postponing the verification of the watermarking data in order to: a) transmit the content key to the descrambling module and the watermark instruction to the watermarking module in view to watermark said audio/video data if said watermark instruction instructs to activate the watermarking module, and b) descramble said audio/video data to extract the watermark data and to transmit the watermarked data to the watermarking module, - reading the watermarking data by the security module from the watermarking module, - verifying the authenticity of the watermarking data, and in case of unsuccessful verification, blocking further transmission of subsequent content keys to the descrambling module; - in case said watermarking data comes from another source: - reading the watermarking data by the security module from the watermarking module, - verifying the authenticity of the watermarking data, and in case of successful verification, transmitting the content key to the descrambling module and the watermark instruction to the watermarking module for watermarking said audio/video data if the watermark instruction activates the watermarking module; wherein the verification of the authenticity of the watermarking data comprises the step of calculating a signature of the watermarking data and verifying the signature; and wherein the security message signature is a signature of the watermark instruction and the content key based on an authentication key, said authentication key being used by the security module to verify the security message signature. - receiving a security message by the security module, comprising at least the content key, a watermark instruction and security message signature, said watermark instruction activates or deactivates the watermarking module, - decrypting the security message with a transmission key, - verifying the security message signature, and in case of successful verification, performing the following steps: - in case said watermarking data comes from said audio/video data: - postponing the verification of the watermarking data in order to: a) transmit the content key to the descrambling module and the watermark instruction to the watermarking module in view to watermark said audio/video data if said watermark instruction instructs to activate the watermarking module, and b) descramble said audio/video data to extract the watermark data and to transmit the watermarked data to the watermarking module, a) transmit the content key to the descrambling module and the watermark instruction to the watermarking module in view to watermark said audio/video data if said watermark instruction instructs to activate the watermarking module, and b) descramble said audio/video data to extract the watermark data and to transmit the watermarked data to the watermarking module, - reading the watermarking data by the security module from the watermarking module, - verifying the authenticity of the watermarking data, and in case of unsuccessful verification, blocking further transmission of subsequent content keys to the descrambling module; - in case said watermarking data comes from another source: - reading the watermarking data by the security module from the watermarking module, - verifying the authenticity of the watermarking data, and in case of successful verification, transmitting the content key to the descrambling module and the watermark instruction to the watermarking module for watermarking said audio/video data if the watermark instruction activates the watermarking module; wherein the verification of the authenticity of the watermarking data comprises the step of calculating a signature of the watermarking data and verifying the signature; and wherein the security message signature is a signature of the watermark instruction and the content key based on an authentication key, said authentication key being used by the security module to verify the security message signature.