Text leaving Claude has carried a hidden statistical mark since early August 2026, written into the model’s word choices rather than added to the file. Anthropic built it to satisfy the EU AI Act, applied it worldwide, and kept the detection key. The promised verification tool has not shipped, which leaves everyone outside the company marking on trust.
Table of Contents
Since 2 August 2026, text produced by newly launched Claude models has carried a mark no reader can see. Anthropic writes it during generation, in the instant the model picks between words that would serve a sentence equally well, and applies it wherever Claude is sold — the consumer app, the Claude Platform API, Claude Code, Claude Cowork, and the resold endpoints on AWS, Google Cloud and Microsoft Foundry — rather than only inside the European Union that forced the change. Files are handled separately: images and vector graphics leave with a signed provenance record attached under the C2PA standard.
What Anthropic has not built is a label. Nothing in a Claude response announces itself as machine-written, and users cannot switch the marking off. The signal is addressed to a detector, and that detector is not yet public. Anthropic holds the key that makes the mark legible, has not released the detection API it promised, and has published no false-positive rate. So the question of how Claude marks generated text has a precise technical answer and an uncomfortable practical one. The mechanism is real, documented and running in production. The verification that would make it useful to an editor, an examiner or a court is still a company promise.
The compliance clock that started on 2 August
Article 50 of the EU AI Act became applicable on 2 August 2026. It requires providers of generative systems to ensure that synthetic audio, image, video and text is marked in a machine-readable format and detectable as artificially generated or manipulated. The European Commission published its guidelines on those obligations on 29 July, three days ahead of the deadline, alongside a Code of Practice on transparency drafted by independent experts — first draft in December 2025, final text in June 2026, roughly 190 organisations signed by the end of July.
Anthropic’s answer landed within days. Claude models launched on or after 2 August 2026 mark their text at generation time. Older models are being retrofitted; systems already on the market when the rules took effect have until 2 December 2026 to comply, and Anthropic has said its backfill will run over the coming months.
The geography is the part worth pausing on. Nothing in Article 50 obliges a provider to mark output served to a customer in São Paulo or Seoul. Anthropic marks everywhere. A rule written for one internal market has become the default behaviour of the model itself, for the ordinary reason that maintaining a marked and an unmarked build of the same weights costs more than marking once and shipping one artefact.
The penalty schedule explains the urgency. A breach of Article 50 exposes a provider to fines of up to €15 million or 3% of worldwide annual turnover, whichever is greater. The Commission has also conceded something that shapes every provider’s engineering plan: it has identified no single marking technique that currently meets the Act’s standards, which pushes companies toward layering several imperfect ones. Anthropic’s two-layer design — statistical marking for text, cryptographic signatures for files — is a direct reading of that concession rather than an independent product decision.
Inside the sampling step where the mark is written
The method is SynthID-Text, published by Google DeepMind in Nature in October 2024 and, by Anthropic’s own account, descended from a 2022 proposal by Scott Aaronson. It works on the sampling step. When the model has finished computing a probability distribution over the next token, the watermarked sampler draws several candidates and runs them through a tournament: each candidate is scored by a pseudorandom function seeded from a secret key and the preceding context, winners advance through successive layers, and the survivor is emitted.
The consequence is subtle. Individual word choices remain random in the ordinary sense, but they are random in a way that correlates with the key. Anthropic’s explainer puts it plainly — one can check a sequence of words and see whether it is consistent with the choices Claude would make while holding that key. Detection therefore needs the key, not the model weights, which is why a verification service can run without exposing anything proprietary about Claude itself.
Nothing is added to the text. There is no zero-width character, no hidden Unicode, no metadata field, and so nothing that a paste into a plain-text box or a strip-formatting command can remove. The signal travels with the words because it is made of the words. That is the property that distinguishes this class of watermark from every earlier attempt at text provenance, all of which relied on attachments that a single copy-paste destroyed.
The quality question has an unusually good evidence base for a claim of this kind. The Nature authors report that with two competitors per tournament match the scheme is non-distortionary at the single-token level: averaged over the random seed, the output distribution matches the unwatermarked model. They also ran the scheme live across nearly 20 million Gemini responses and found thumbs-up rates differing by 0.01% between watermarked and unwatermarked variants. Anthropic adds that marking consumes no extra tokens and has negligible effect on latency — a company statement rather than an audited result, but consistent with how the algorithm works.
Passages Claude leaves unmarked, and why they slip through
The watermark needs somewhere to hide, and that somewhere is entropy. Where the model has many acceptable ways to say a thing, tournament sampling has room to encode a signal. Where it has one, it has none. Anthropic is explicit that the mark is sparse or absent in factual passages with constrained wording — its own illustration is a statement as fixed as two plus two equals four — and absent in code where an exact identifier or syntax is required. Comments inside code can carry the mark; the executable lines generally cannot.
The same logic applies to short outputs. Statistical confidence accumulates across tokens, so a two-sentence reply carries far less evidence than a two-thousand-word essay. The Nature paper is direct about this: detectability improves with length and degrades in low-entropy settings. A marked paragraph is not a proven paragraph.
Editing work sits in the most awkward position. If a user pastes their own draft and asks Claude to fix punctuation, the returned text is overwhelmingly the human’s word choices, and the model had almost no sampling freedom in which to write anything. Anthropic states that such minimally edited text is not reliably marked. The corollary is the one that has irritated users most: translation and heavy rewriting are marked, because there the model chooses nearly every word. A writer who drafts in Slovak and has Claude produce the English version has produced, by this measure, a fully marked document.
The Act’s own carve-outs point the same way. Article 50(2) exempts short sequences of characters, source code, machine-to-machine outputs never shown to a person, closed industrial workflows and systems performing an assistive editing function. The engineering limits and the legal limits happen to coincide, which is convenient for providers and confusing for anyone who assumes an unmarked text is human.
Two marking layers doing different jobs
Text and files are marked by different machinery with different failure modes, and conflating them produces most of the bad advice circulating about Claude provenance. The text watermark is statistical, model-level and unremovable except by rewriting. The file layer is cryptographic, container-level and removable by anyone who takes a screenshot.
For supported formats — PNG, JPG and SVG — Claude attaches signed provenance metadata following the C2PA specification, the same standard used across camera hardware and photo-editing software. A C2PA manifest is tamper-evident: alter the asset and the signature no longer validates. It is not tamper-proof. Converting the format, re-encoding the file or capturing the screen discards the manifest entirely and leaves a clean-looking image with no claim of any kind attached.
The two provenance layers Claude applies
| Layer | Applies to | Survives copy-paste | Removed by |
|---|---|---|---|
| Statistical text watermark | Generated prose, translations, code comments | Yes | Heavy rewriting, paraphrasing, very short output |
| C2PA signed metadata | .png, .jpg and .svg files | Not applicable | Format conversion, re-encoding, screenshots |
Support for the metadata layer also varies by cloud platform, whereas the text watermark rides inside the model and therefore behaves the same on every endpoint that serves it.
That difference matters for anyone designing a provenance workflow. A newsroom checking submitted images needs a C2PA validator and should expect most real-world files to arrive stripped. A newsroom checking submitted prose needs something that does not yet exist outside Anthropic.
The two layers can also contradict each other inside a single deliverable. A report generated by Claude, exported as a document and illustrated with a Claude-made chart can arrive with an intact statistical mark in the prose and no valid signature on the image, because the chart was screenshotted into a slide on the way. An investigator reading only the file metadata would conclude nothing was machine-made. An investigator reading only the prose would reach the opposite view about the same artefact. Provenance checks that sample one layer will return confident and contradictory answers.
The key stays with Anthropic, and so does the verdict
Detection is where the announcement stops being a technical story and becomes a governance one. The watermark is only meaningful to whoever holds the key, and that is Anthropic. The company has said a detection API is coming and that technical documentation will follow. As of mid-August 2026 neither has appeared, and no accuracy figures — no false-positive rate, no false-negative rate, no confidence thresholds — have been published in any form a third party could audit.
Anthropic’s own framing is careful in a way that deserves more attention than it has received. A detected mark indicates that content may have been processed by Claude. It does not establish that Claude wrote it, that a human did not, or that another model was not involved. Absence of a mark establishes even less: the text may come from an older Claude build, from a competitor, from a rewrite, or from a passage too short to score.
Compare the neighbours. Google ships a public SynthID detection surface. OpenAI joined the C2PA steering committee, became a conforming generator and extended SynthID watermarking to images and, from July 2026, audio — but has published nothing equivalent for text, the modality where the commercial and reputational stakes are highest. Anthropic is first to production on text and last to production on verification, and the order of those two facts is the substance of the current criticism. Users quoted in reporting since the announcement have objected that work they largely wrote can be flagged as Claude-processed with no published threshold, no appeal route and no way to see the evidence.
The Act anticipates part of this. Detection mechanisms are meant to be effective, interoperable, robust and reliable, and provided free in general — with interoperability expectations pushing into 2027. Until the API exists, the obligation is satisfied in principle and unusable in practice.
The labelling duty sits with the publisher, not the model
A widespread misreading of the August changes holds that Anthropic’s watermark discharges the disclosure obligation for everyone downstream. It does not, because Article 50 splits the duty in two.
Article 50(2) binds providers and concerns machine-readable marking — the invisible signal. Article 50(4) binds deployers and concerns human-readable labelling: anyone publishing AI-generated or manipulated text to inform the public on matters of public interest must clearly disclose that origin. These are separate obligations with separate audiences. The first talks to detectors; the second talks to readers.
The exemption in 50(4) is where editorial practice actually lands. Text that has undergone substantive human review, with an identifiable person or organisation holding editorial responsibility and the authority to approve, alter or reject it, does not require a label. Spell-checking does not qualify; fact-checking with the power to spike the piece does. An article drafted with Claude and genuinely edited by a named editor carries no labelling duty, while the same draft published untouched does — and it will carry Anthropic’s mark either way.
That asymmetry produces an outcome regulators may not have intended. The invisible mark tracks model involvement. The visible label tracks editorial accountability. A text can be heavily marked and lawfully unlabelled, or unmarked and legally required to carry a label. Anyone building compliance workflows on the assumption that the two signals agree is building on sand.
Evidence that the mark bends under pressure
Watermarking research has spent three years demonstrating that these schemes degrade, and the literature is worth reading before treating a detection result as evidence of anything.
The most direct threat is scrubbing. A 2025 paper describing a self-information rewrite attack showed near-total watermark removal across seven published schemes by identifying high-information tokens, masking them and reconstructing the passage — at a reported cost of $0.88 per million tokens. SynthID-Text was not among the schemes tested, so the result does not transfer directly, but it establishes the shape of the problem: targeted paraphrasing is cheap and effective against statistical marks in general.
The second threat runs the other way. Spoofing means generating text that carries a victim model’s watermark in order to attribute damaging content to it. Work presented at NeurIPS 2025 treats scrubbing and spoofing as a joint design problem and reports large reductions in spoofing false-positive rates against baseline schemes — which is a way of confirming that untreated baselines are exposed. If a detection API is ever opened to third parties, spoofing resistance becomes the property that matters most, and it is the one nobody has published numbers for in this deployment.
A quieter limitation is dilution. Real documents are mixtures — a human paragraph, a model-drafted section, a translated quotation, an edited conclusion. Statistical detection scores a passage as a whole, so a heavily marked page inside a mostly human report can pull the document toward a positive result while a lightly marked page inside a mostly generated one produces nothing. Neither answer describes what actually happened. Until the detection interface reports per-passage evidence rather than a single document-level score, the output will be least reliable in precisely the mixed-authorship cases that disputes are made of.
There is also an institutional record to consider. Heuristic AI detectors, a different technology with the same social function, were shown in 2023 to systematically misclassify writing by non-native English speakers as machine-generated. Statistical watermarking is a stronger instrument — it looks for a specific key rather than guessing from style, and it should not carry that bias. But the failure mode that damaged students and applicants was never purely technical. It was institutions treating a probabilistic score as a verdict. Nothing about the new mechanism prevents that from happening again, and the absence of published thresholds makes it more likely.
Decisions facing editors, universities and engineering teams
For publishers, the practical work is documentary rather than technical. Since the 50(4) exemption turns on demonstrable editorial control, the defensible position is a record showing who reviewed a piece, what they changed and what authority they held to reject it. That record is worth more than any detection result, and it can be built today without waiting for tooling.
For universities and employers, the correct posture through the rest of 2026 is restraint. No public detector exists, no error rates have been published, and Anthropic itself says a mark indicates possible processing rather than authorship. Treating a future watermark hit as proof of misconduct would repeat the 2023 detector failures with better mathematics and identical consequences. The narrower use — asking a candidate or student to describe their process when other evidence already raises a question — remains sound.
For engineering and product teams, the operational facts are that output arrives marked, there is no opt-out, and no additional tokens are consumed. That is immaterial for most applications and material for a few: products that resell generated prose as human-authored, translation pipelines where the entire output is model-chosen, and any workflow where a client contract asserts human origin. Those assertions need rewriting now, not after a dispute.
For agencies and freelancers, the exposure is contractual rather than legal. A deliverable polished by Claude may be marked; a deliverable translated by Claude almost certainly is. Clauses promising work is not AI-generated were drafted when nobody could check. That assumption expires the moment a detection API opens.
The test that will settle whether marking means anything
The evidence supports a narrow conclusion. Anthropic has shipped a technically credible marking system, ahead of its main competitors on the hardest modality, and has done so globally rather than carving out one jurisdiction. That is a real commitment and it deserves acknowledgement. It is also, as of today, a system whose output only its author can read.
Three observable developments would change the assessment. If the detection API ships with published false-positive rates and access on reasonable terms to newsrooms, universities and platforms, the mark becomes public infrastructure and the criticism largely dissolves. If it ships restricted to enforcement partners or priced out of reach, the mark functions as private enforcement tooling that happens to satisfy a regulator. If it does not ship, Article 50(2) compliance rests on a signal nobody can verify, and the market surveillance authorities now responsible for enforcement will have to decide whether marking without accessible detection satisfies a requirement written in the language of detectability.
Two dates will supply most of the answer. Legacy Claude models must be marked by 2 December 2026, which tests whether the retrofit is engineering reality or intention. Interoperability expectations arriving in 2027 will test whether the industry converges on a common verification path or ends with a separate proprietary key per vendor — a fragmentation that would leave every downstream institution querying four APIs to ask one question.
There is a further possibility that neither the Act nor the announcement addresses. Marking succeeds only while the marked models are the ones people use. Open-weight systems running on a laptop have no provider to bind, no key to hold and no incentive to sample differently, and anyone determined to pass off generated text has an unmarked alternative that improves every quarter. The regime therefore polices the compliant middle of the market — the agency, the student, the newsroom, the working writer — while leaving the deliberate bad actor an exit that costs nothing. That is not an argument against marking; it is an argument against expecting it to carry weight it was never built to hold.
The judgement to hold in the meantime is straightforward. A watermark hit will be a reason to ask a question, never an answer to one, and any institution that inverts that relationship will produce injustices faster than the technology produces clarity.
Quick answers on Claude’s marking, detection and disclosure
No. The marking is statistical and imperceptible. Readers see no notice, and the text’s meaning and readability are unchanged.
A watermark written into the model’s token choices using SynthID-Text, keyed on a secret held by Anthropic and the preceding context. Nothing is appended to the text itself.
Text marking applies across Claude, the Claude Platform API, Claude Code, Claude Cowork and Claude Tag, including endpoints served through AWS, Google Cloud and Microsoft Foundry.
No. Marking is automatic for supported models and there is no opt-out for consumer or API users.
No. Because the signal lives in the word choices rather than in metadata, it survives copy-paste and light editing. Heavy rewriting or paraphrasing removes it.
Supported formats — PNG, JPG and SVG — receive signed C2PA provenance metadata, which is tamper-evident but can be stripped by format conversion, re-encoding or screenshotting.
Not yet. Anthropic has said a detection API and technical documentation are coming, but neither was available as of mid-August 2026.
No. Anthropic states that a mark indicates content may have been processed by Claude, which includes translation, summarisation and rewriting of human drafts.
Only under Article 50(4), and only for text published to inform the public on matters of public interest. Substantive human review with identifiable editorial responsibility removes the obligation.
The EU AI Act triggered it, but the watermark operates inside the model’s sampling process, so applying it globally is simpler than maintaining separate marked and unmarked builds.
Author:
Jan Bielik
CEO & Founder of Webiano Digital & Marketing Agency
This article is an original analysis supported by the sources cited below
How Claude’s text watermarking works Anthropic’s own explanation of the sampling-level mechanism, the key-based detection logic, the low-entropy exclusions and the forthcoming detection API.
How Claude marks AI-generated content Anthropic’s help-centre documentation establishing product coverage, the absence of an opt-out, C2PA file formats and the company’s stated limits on what a detected mark proves.
Guidelines on transparency obligations for providers and deployers of certain AI systems The European Commission guidelines of 29 July 2026 setting out the machine-readable marking duty, the compliance pathways and the assistive-editing exceptions.
Transparency obligations under Article 50 of the AI Act The Commission FAQ specifying the Article 50(2) exemptions, the Article 50(4) deployer labelling duty and the 2 December 2026 grace period for systems already on the market.
Commission publishes first draft Code of Practice on marking and labelling AI-generated content Source for the Code of Practice drafting timeline, the split between provider marking rules and deployer labelling rules, and the 2 August 2026 application date.
Scalable watermarking for identifying large language model outputs The peer-reviewed Nature paper describing tournament sampling, the single-token non-distortion property, the 20-million-response Gemini evaluation and the entropy and paraphrasing limits.
EU finalises transparency rules for AI-generated content Legal analysis establishing the penalty ceiling, the Commission’s admission that no single marking technique meets the standard, and the interoperability expectations extending into 2027.
The EU AI Act’s transparency rules: a practical guide to Article 50 Independent reference confirming the scope of Article 50 across providers and deployers and the editorial-control exemption for published text.
Anthropic’s text watermarks signal new front in AI detection Reporting that fixed the 2 December 2026 legacy-model deadline, the worldwide scope of the rollout and OpenAI’s image-and-audio-first compliance posture.
Anthropic plans to add an invisible mark to AI text as the industry scrambles to police AI slop Reporting on the model-level implementation and the fairness objection that a single mark conflates light editing with wholesale generation.
How Anthropic plans to watermark Claude’s AI-generated text Technical reporting on key handling, detection without model access, the token and latency cost, and the specific low-entropy exclusions for arithmetic and code.
Anthropic adds AI text watermarking to Claude models worldwide Confirmation of the surfaces covered, the retrofit of pre-August models and the unavailability of detection tooling at launch.
Claude will now leave a watermark on everything it writes Source for the published criticism — absent accuracy thresholds, no dispute procedure, and user objections to attribution of substantially human work.
Revealing weaknesses in text watermarking through self-information rewrite attacks Research establishing near-total watermark removal across seven schemes by targeted paraphrasing, with the reported attack cost per million tokens.
Enhancing LLM watermark resilience against both scrubbing and spoofing attacks NeurIPS 2025 work defining the joint scrubbing and spoofing threat model and quantifying how exposed baseline watermarking schemes are to false attribution.
GPT detectors are biased against non-native English writers The study underpinning the institutional caution in this article, showing systematic misclassification of non-native English writing by heuristic AI detectors.
Advancing content provenance for a safer, more transparent AI ecosystem OpenAI’s provenance commitments, used to establish its C2PA steering-committee role and its coverage of images and audio without an equivalent text watermark.
| Citing this article? Brief excerpts are welcome. Please credit Webiano.digital, name the author where stated, and include a link to https://webiano.digital and to this original article. Full or substantial republication requires prior written permission. Read our Copyright and Content Use Policy. |
This article was prepared with the assistance of artificial intelligence tools. The content underwent expert human review, and Webiano Digital & Marketing Agency assumes editorial responsibility for its final version and publication.
