Anthropic will watermark all Claude-generated text under EU AI Act rules

Anthropic has published how it intends to mark content generated by Claude, having signed the EU’s Code of Practice on Transparency of AI-generated Content. Two mechanisms are described: an imperceptible watermark woven into generated text, and C2PA signed provenance metadata attached to generated files. The legal trigger is Article 50 of the EU AI Act, which applies from 2 August 2026.

The scope is the part worth registering. This is an EU obligation, but Anthropic states that marking “will apply to output from supported models wherever Claude is offered, worldwide”, across Claude Platform (API), Claude, Claude Code, Claude Cowork and Claude Tag, and through AWS, Google Cloud and Microsoft Foundry.

On 14 August Anthropic followed the support documentation with an explainer covering how the text watermark actually works, which names the technique and sets out where it does and does not leave a usable signal. That detail is covered below.

Read the tense carefully before acting on any of it. The documentation is written almost entirely in the future and in-progress voice, and the detection tooling that would let anyone actually check a piece of text is still described as forthcoming in the newer explainer: “we will soon be offering a watermark detection API. We’re in the process of working out the details of its implementation.” This is a dated commitment, not a capability available today.

What Article 50 requires

Article 50(2) puts the obligation on providers of generative systems: outputs must be “marked in a machine-readable format and detectable as artificially generated or manipulated”, using solutions that are “effective, interoperable, robust and reliable as far as this is technically feasible”. Article 50 sits in Chapter IV of the AI Act, which applies from 2 August 2026.

The Code of Practice is the voluntary route to demonstrating compliance. The Commission published the final version on 10 June 2026, the Commission and the AI Board confirmed its adequacy in July, and roughly 190 companies had signed by the end of that month. Signing is not itself the legal requirement. The Article 50 obligation applies to providers in scope either way; the Code offers signatories a more predictable enforcement path.

One distinction is easy to lose: the Code requires machine-readable marking and detectability, not watermarking specifically. Watermarks plus C2PA are Anthropic’s chosen implementation, not a mandated design. What the newer explainer adds is that the choice is not proprietary either. Anthropic says watermarking “won’t be specific to Claude”, that other major developers who signed the same Code will implement their own, and that its own text watermark is a version of a method Google DeepMind published and open-sourced. Providers are landing on one technique to satisfy a rule that never specified one.

What Anthropic has committed to

Text. A supported model “weaves an imperceptible watermark directly into the text itself”. Anthropic says it does not change meaning, quality or readability, travels with the text through copying and pasting, and “may persist through some editing”. Two details matter more than the mechanism. It is applied at model level rather than per product, so no surface avoids it, and Anthropic states that embedded watermarks “will apply to all generated text”. Read “weaves into” loosely: as the section below sets out, nothing is inserted into the text at all.

Files. Generated .svg, .png and .jpg files carry signed provenance metadata following the C2PA standard, which also allows tamper detection. This is a different mechanism from the text watermark and worth keeping separate in your head: the credential sits in the file’s metadata and nothing in the file itself changes, so any C2PA-aware tool can read it, and stripping the metadata removes it. Anthropic says it will provide a drop-a-file checker of its own.

Timing. Models launched on or after 2 August 2026 support marking at launch. Earlier models fall under a transition period, and Anthropic says support for them will roll out “over the coming months”.

How does Claude’s text watermark work?

The technique is a version of SynthID-Text, published by Google DeepMind in Nature in October 2024 and released as open source. It belongs to a family of designs going back to a 2022 proposal by Scott Aaronson, and the shared principle is narrower than “watermarking” suggests.

A model generates one token at a time, picking from a list of candidates. Often several candidates are equally good: in “the weather today was cold and…”, nothing meaningful separates “overcast” from “grey”, and the choice is settled by a random number. Watermarking swaps the source of that randomness. Instead of an arbitrary generator, the choice is derived from a key plus the preceding words, so the resulting sequence can later be tested against the key for consistency. The Nature paper puts the scope of the intervention plainly: SynthID-Text “does not affect LLM training and modifies only the sampling procedure”.

Three consequences follow, and they answer most of the practical worries:

• Nothing is added to the text. No hidden characters, no invisible Unicode, no appended tokens. The pattern is in which words were chosen, not in anything inserted alongside them.
• No cost, speed or quality penalty. Because the watermark produces no extra tokens, generation is the same price. DeepMind tested quality by serving a watermarked model to a share of live Gemini traffic and found no statistically significant difference in thumbs-up and thumbs-down rates.
• It identifies the model, not you. Anthropic states there is nothing in the watermark or its key that would recover information about a user, their organisation or their chats. Someone with the key learns that Claude was probably involved, and nothing further.

The method also does not push the model toward odd vocabulary. Anthropic makes the point directly: it would not make Claude reach for “nubilous” in place of “overcast”, because the nudge only operates between candidates the model already considered plausible.

Which text carries a detectable mark?

This is the part that changes what the commitment means in practice, because the watermark needs free choices to live in and not all writing offers them. Where the output has to be exact, there is nothing to bias.

• Factual passages carry less. Anthropic’s example: after “Isaac Newton’s most famous work was called Principia…”, the next word has one right answer, so the watermark has nothing to act on.
• Code carries little. Exact output is the norm in code, so watermarking is generally sparser there. It can attach to genuinely arbitrary choices such as comments, but the effect on the code itself is described as negligible.
• Proofreading may leave nothing. If Claude only fixes grammar and punctuation, the mark can live in the handful of corrections, which may be too few to register at all.
• Translation carries a full mark. The opposite case, because every word in a translation is chosen by Claude.
• Short passages are unreliable. Fewer choices means less information, and confidence rises with length.

Set that against the headline claim that marking applies to all generated text. Both are true, and the reconciliation matters: the modified sampling runs across all generation, but the detectable signal it leaves is uneven, and on exact-output content there may be nothing to find. Density of choice, not editorial intent, decides what shows up.

The limitations, which the documentation states plainly

Anthropic is unusually direct about what the marks do not establish, and the caveats run in both directions.

A detected mark indicates content “may have been processed by Claude”, not that Claude wrote it. The reason given is that people use Claude to “proofread, translate, summarize, or convert files”, so a mark can sit on text whose substance came from a person. That maps onto an exception written into Article 50(2) itself, which carves out systems performing an assistive editing function or not substantially altering the input.

Translation is the sharpest version of the problem, and the newer explainer confirms it rather than softening it. A Claude translation carries a full mark precisely because Claude chose every word, even though every idea in it belongs to the author. The mark tests involvement, and involvement is not authorship. Anthropic is explicit that a watermark “cannot distinguish ‘Claude wrote this’ from ‘Claude heavily edited this’”, and says nothing about it changes ownership or legal responsibility for an output.

Absence of a mark proves nothing either. Anthropic lists the gaps: output from models released before marking support, text that has been heavily edited, paraphrased, translated or mixed into other writing, passages too short to carry a reliable signal, file metadata stripped by format conversion or screenshots, and platforms or file types where a marking type is unsupported. On deliberate removal it is equally direct. Light editing probably will not clear the watermark; replacing every word will, at which point, as Anthropic notes, whether the result still counts as AI-generated is itself arguable.

Does this touch search?

Not on any confirmed mechanism, and nobody has claimed otherwise. No platform has stated that provenance marks are used as ranking signals, which is the same position we recorded when Google brought SynthID and C2PA verification to Search and Chrome in May 2026.

What has changed is the reliability class of the question. Until now, working out whether text was machine-written meant running a third-party detector, and detectors are the weakest instrument in this field, prone to flagging human writing as machine-written. A provider marking its own output is a different kind of evidence: not a statistical guess about style, but a signal the generating system deliberately inserted. That distinction will matter as soon as the detection tooling ships, and it is a reason to treat detector-based statistics about the share of AI content on the web with continued caution rather than new confidence.

Anthropic draws the same line itself, and in doing so hands editors a small gift. Asked how watermarking differs from detection software such as Pangram, it explains that those services lack the key and so fall back on reading style: models “appear to be fond of the construction ‘this isn’t [X], it’s [Y]’”, and “use the word ‘quietly’ a lot more than you might expect”. Both sit on this site’s own list of writing tells. Treat that as a style note rather than a detection method, because the reasoning runs one way only. These patterns are common in machine-written text, which does not make text containing them machine-written, and a house style that avoids them changes nothing about the watermark underneath.

What Claude’s watermarking means for your content

1. Know what your content pipeline emits. If you generate copy through the Anthropic API or Claude Code and publish it, the output is intended to carry a model-level mark regardless of region. That is a fact about your published assets, not a penalty, and there is no indication any search engine reads it. Nothing about the mark degrades the copy, slows generation or costs extra tokens, so there is no output-quality reason to route around it.
2. The mark points at Claude, not at you. The most common worry about provenance marking, that published work becomes traceable to its author or their company, is one Anthropic rules out directly: the watermark and its key carry nothing that identifies a user, an organisation or a conversation. Client-confidential work does not become attributable because it passed through a model.
3. Expect the signal to be thin where output must be exact. Prose carries the watermark best. Code, technical specifications and dense factual passages carry much less, and a light proofread may carry none. If your interest is in what a future detector could show about your own archive, long-form generated prose is where it would show.
4. The worldwide scope is provisional. Anthropic says it is marking globally because it does not “yet have a durable way to scope it by region”, and that it will keep evaluating alternatives. This is an engineering constraint rather than a policy commitment, so the current global behaviour may narrow later.
5. Check whether Article 50 lands on you as a deployer, not only as a user. The Act places separate obligations on deployers, including disclosure where AI-generated text is published to inform the public on matters of public interest, with a carve-out where the content has undergone human editorial review. Anthropic’s own guidance is that anyone building with Claude “should independently assess what Article 50 requires”. Whether it applies to a given publisher is a question for their own legal assessment, not something this article can answer.
6. Do not treat this as detection yet. No public tool exists to check a Claude mark. Anyone selling one before Anthropic ships its detection API is guessing.

The editorial-review carve-out is the detail most likely to age well. It puts a legal frame around a distinction this site has argued on quality grounds for a long time: content a person genuinely reviewed and stands behind sits in a different category from output published straight from a pipeline.

Sources

• How Claude marks AI-generated content — Anthropic
• How Claude’s text watermark works — Anthropic
• Scalable watermarking for identifying large language model outputs — Nature
• Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems — EU Artificial Intelligence Act
• Code of Practice on Transparency of AI-generated Content — European Commission