Anthropic has begun embedding invisible machine-readable watermarks in text that Claude writes, according to its own support documentation, along with digitally signed provenance metadata on generated files. The marking applies to models launched in the European Union on or after August 2, 2026, and spans Claude, Claude Code, the Claude Platform, Claude Cowork, and Claude Tag. Marking generated images is common industry practice; marking plain prose is not, and this appears to be the first frontier lab to do it in a shipping product.
Key facts
- Claude-generated text now carries embedded, machine-readable watermarks on supported models; generated files carry digitally signed provenance metadata where supported.
- The scope is models launched in the EU on or after August 2, 2026, with older models still in a transition period.
- Article 113 of the EU AI Act sets August 2, 2026 as the general application date; Article 50 requires machine-readable marking of synthetic output.
- Primary source: How Claude marks AI-generated content.
Watermarking an image is conceptually easy: an image has millions of pixels and enormous room to hide a signal that survives resizing and recompression. Text has no such slack. A paragraph is a few hundred words, each one chosen from a vocabulary, and there is nowhere to hide extra information except in the choices themselves. Text watermarking works by nudging those choices -- biasing the model toward a particular pseudo-random subset of acceptable next words at each step, so the finished passage carries a statistical fingerprint that a detector holding the key can spot but a reader cannot. It is like a writer who, unprompted, always favors one synonym over an equally good one. No single sentence gives it away. A few hundred words do. Our lesson on how a model picks its next word covers the sampling step this hooks into, and content provenance and watermarking covers the broader family of techniques.
The legal driver is not subtle. Article 50 of the EU AI Act requires providers of AI systems, including general-purpose ones, that generate synthetic audio, image, video, or text to ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Article 113 of the same regulation sets general application from August 2, 2026. Anthropic's scope statement uses that exact date. We wrote about the deadline itself in The EU AI Act's transparency rules start today, the high-risk rules do not.
The confusion on launch night was earned rather than manufactured. Anthropic's older transparency hub page, from July 23, still described watermarking as work in progress, while the newer support article describes it as shipped for supported models. Both were live at once, which is why the top thread on the Claude community forum framed the change as an EU-forced rollout and asked, reasonably, whether it was actually on. The answer depends on which model you are using and when it launched.
The most important part of Anthropic's documentation is how much it declines to claim. A detected mark is described as a signal, not proof. The absence of a mark is explicitly not evidence that a human wrote something. And the mark degrades under exactly the conditions where you would most want it: heavy editing, paraphrasing, translation into another language, quoting a short excerpt, or output from a model that predates the rollout. Every one of those is a normal thing a person does with text they got from a chatbot. A student who rewrites two sentences in every paragraph has probably destroyed the signal without intending to.
File provenance is on firmer ground. The C2PA specification that underpins signed provenance metadata is cryptographically signed and tamper-evident, meaning you can tell if it has been altered. But it is still metadata attached to a file, and ordinary operations -- converting a format, re-exporting, screenshotting -- strip it. Tamper-evident is not tamper-proof; it means you notice the gap, not that the gap cannot be created.
The honest caveat is about what this is for. Read as an anti-cheating tool, text watermarking is weak, and Anthropic's own hedges say as much. Read as a compliance and ecosystem-hygiene measure -- letting platforms filter machine-written text out of training data, letting publishers check submissions at scale, letting a regulator confirm a provider met an obligation -- it is a reasonable first implementation of a rule that took effect eight days ago. The interesting question is what happens when a second lab ships a different, incompatible scheme, and every detector has to know whose key to try.
Originally published on Ground Truth, where every claim is checked against the primary source.
Top comments (0)