Claude is going to watermark its text. That proves something else than you think.

By day I work on digital identity and on the question of how you can trust that something online is genuine. By night I write pieces here that come together with Claude, illustrated by a model running on my own laptop. Since yesterday those two things run into each other, because Anthropic is going to mark what Claude produces.

The scheme itself is simple. What sits underneath it is not, because a mark like this answers a different question than the one most people are asking.

What was announced

Anthropic has signed the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content, and a support article sets out how it plans to honour that. Two techniques, side by side.

The first is an imperceptible watermark in generated text. It does not sit in the app but in the model, so it makes no difference which product the text arrives through. Anthropic writes that the mark does not change the meaning, quality or readability, that it travels with the text when you copy and paste it, and that it “may persist through some editing”. How it works was left out at first; three days later a FAQ appeared naming the method, and that sits further down this piece.

The second is signed provenance metadata on files. When Claude generates a .svg, .png or .jpg, metadata is attached following the C2PA standard, the open standard also used by Adobe, Microsoft and Google. That signature shows the file passed through Claude, and whether it was tampered with afterwards.

The coverage is wide: the API, Claude itself, Claude Code, Cowork and Tag, plus models called through AWS, Google Cloud or Microsoft Foundry. With those cloud partners the text watermark applies while the signed metadata may not, depending on what each platform supports. And it applies everywhere Claude is offered, not only in the EU. The reason is now in the FAQ: there is no durable way yet to switch the marking on or off per region. A European rule the rest of the world inherits because the technique has no border.

The date it all hangs on

This is where it gets more interesting than the announcement suggests. The promise reads: models launched on or after 2 August 2026 carry the mark from day one. Models from before that date fall under a transition period written into the law, and Anthropic says it is working on those.

Now look at the launch dates. Sonnet 5 arrived on 30 June, Opus 5 on 24 July, Fable 5 was redeployed on 1 July. Anthropic’s newsroom lists no new model since 2 August. So no Claude model currently falls under the first promise, which means nothing you use today carries a mark yet. That started as my own reading of those dates; the FAQ of 14 August opens by saying it outright, that future Claude models will generate watermarked text. For older models the same text says the mark arrives “over the coming months”.

That is not a gotcha, it is exactly what a transition period is for. But it does change how you read the announcement. This is a commitment about the next generation, not a switch that was flipped yesterday.

What does hang on a hard date is enforcement. Article 50 of the AI Act has applied since 2 August 2026, and Article 99 attaches fines of up to fifteen million euros or three percent of worldwide annual turnover, whichever is higher. That is why this exists now.

What a mark does and does not tell you

Anthropic is strikingly candid about the limits, and that section is the best part of the whole article. Two things stand there, both worth having.

A detected mark does not prove Claude wrote it. People use Claude to proofread, translate, summarise and convert. The output carries a mark while the idea, the text or the data came from somewhere else entirely. And anything could have happened to it afterwards.

A missing mark proves just as little the other way. It could be an older model, the text could have been heavily rewritten, the passage could be too short to carry a reliable signal, or the metadata died in a screenshot or a format conversion.

And there is a third limit, one that only surfaced in the FAQ and that runs against the intuition: the mark thins out the more factual your writing is. It feeds on choices that do not matter, on the spot where “overcast” and “grey” would both do. In “Isaac Newton’s most famous work was called Principia…” only one continuation is right, so there is nothing to steer and no signal left behind. The tighter, shorter and more fact-dense a passage, the weaker the mark. A five-hundred-word anecdote is easier to recognise than a two-hundred-word news item somebody checked.

Put those three together and what is left is smaller than the word “provenance” suggests. The mark answers: did this text pass through a machine from this vendor? It does not answer the question people are actually asking, which is who thought of this, and did anyone check it before it went out. That is the same boundary I keep hitting in my day job. A verifiable attribute tells you something about whoever issued the attribute, not about the truth behind it.

How the mark works

On 14 August, Anthropic published a FAQ that does spell out the mechanics. It is a version of SynthID-Text, the approach Google DeepMind described in Nature in 2024, from a family that traces back to a 2022 proposal by Scott Aaronson.

The principle is simpler than it sounds. A model picks one word at a time, and for many of those picks the reader could not care less which candidate wins. After “the weather today was cold and”, both “overcast” and “grey” will do, and normally a random number settles it. Watermarking replaces only the source of that randomness: instead of an arbitrary random number, a key plus the preceding few words decide which candidate comes out. The choices still look random, but anyone holding the key can check whether the sequence matches what that key would produce, and attach a probability to it.

So nothing is added to the text. No hidden characters, no extra tokens, no higher price, and a negligible effect on speed. And there is no user information in it: not in the mark, not in the key, so a mark cannot be traced back to a person, an organisation or a conversation.

On quality, Anthropic says internal testing shows no difference in content, creativity or readability. That leans on the SynthID research itself, where a slice of Gemini traffic was served with watermarking and showed no statistically significant difference in thumbs up and thumbs down, plus a controlled study where raters compared marked and unmarked answers side by side. It is research by the party that built the technique, which is exactly one step better than a promise.

Two things still come only from the thread by Thariq (@trq212, Claude Code at Anthropic) rather than from the documentation. The model knows nothing about its own mark, so you cannot ask Claude to confirm it or leave it out. And the sharpest example for this audience is his: you will be able to check whether a pull request was written by Claude Code. That follows from “all generated text”, but the sentence only lands once someone holds a pull request next to it.

The detection API has since made it into the official text: “We will soon be offering a watermark detection API”, implementation details still being worked out. For files there will be an Anthropic C2PA checker you can drop a file into. Neither carries a date.

On stripping it, the FAQ is short and honest. Light editing probably will not remove the mark, a complete rewrite will, and at that point it is arguable whether the text still counts as AI-generated.

What this means for this site

Concretely, because I sit right on the fault line.

The text of this piece comes together with Claude. The moment I am on a model that marks, what you read here will carry a watermark, even though I steered every paragraph, read the sources myself and threw half of it away. That mark says nothing about any of that editing.

The images are the mirror image. The covers here come out of a Bonsai model running on my own laptop, outside any cloud, something I wrote about earlier. Those files get no C2PA signature, because they never went near Claude. Made entirely by a machine, and entirely unmarked.

So one page will soon hold marked text I edited myself next to an unmarked image a model invented on its own. Anyone reading the mark as an AI detector reads that page exactly backwards.

I am not going to change how I work, and I am going to change what I say about it. Every piece here already ends with a fact-check paragraph listing what I verified and what I could not. That is the kind of transparency I find useful, because it is about my work rather than about my tools. The mark will sit on top of that, which is fine, as long as nobody thinks the two measure the same thing.

The caveat

The default shifts from disclosing to detecting. Until now, being open about AI use was something you wrote down yourself. Soon it sits in the material regardless of what you say about it. That is a gain against people who lie, and a loss of nuance for everyone who was honest: the difference between “AI wrote this” and “AI helped me write this” is precisely the difference a watermark cannot draw.

Responsibility lands with whoever reads the mark, not whoever made it. Anthropic states plainly that a mark is not proof of authorship. But the party who will act on it, a teacher, an editor, a client, reads a result rather than that disclaimer. Anyone deploying such a detector has to supply the nuance the signal lacks. Do not count on that happening.

What drains away is the question of whether anyone checked. A mark is cheap to measure and sounds objective, so it crowds out the more expensive question: is this right, and who stands behind it. I see that risk most clearly in my own images, made entirely by a model and staying unmarked. A system that leans on marks waves those through and puts a question mark over text I went through line by line.

Frequently asked questions

Can I check whether a text carries a Claude watermark?

Not yet. In its FAQ of 14 August, Anthropic says a detection API is coming soon and that the implementation is still being worked out. For files there will be an Anthropic C2PA checker. Neither has a date, so treat it as a promise rather than a tool. Without Anthropic’s key, nobody else can read the mark at all.

Does the watermark also sit in code that Claude Code writes?

According to the support article it applies to all generated text, and code falls under that. An Anthropic employee gives the example of checking whether a pull request was generated by Claude Code. For teams working with an agent, that is the most concrete consequence of this announcement.

Does a watermark cost me extra tokens or money?

No. Nothing is appended, so no characters and no tokens are added; only the way the model picks between equally good words changes. The price per token stays the same and the effect on speed is negligible, according to Anthropic.

Are there hidden characters in the text?

No. That is the most persistent misconception here, probably because tools exist that paste invisible unicode into text. This does not work that way. The mark lives in which words were chosen, not in something inserted between them, so you cannot strip it by pasting into a plain text editor or retyping it.

Can anyone tell from the mark that it was me?

No. There is no information about the user, the organisation or the conversation in the mark or in the key. Whoever runs detection gets a probability that Claude was involved, and nothing else.

Does this only apply in Europe?

No. The trigger is European, but the marking applies everywhere Claude is offered. If you build a product on Claude, note that you have to assess for yourself what Article 50 asks of your service; Anthropic does not make that assessment for you.

Does a watermark mean my text is sent back to Anthropic?

No. The mark sits in the output itself, not in a connection. Detection is a separate act someone performs afterwards on material they already hold.

Will C2PA metadata survive my CMS?

Usually not. Metadata dies in screenshots, in re-saves and in format conversion, and plenty of systems convert by default on upload. So do not build a workflow that assumes the signature still exists at the other end.

Sources

• Anthropic, “How Claude marks AI-generated content”, support article, accessed 11 August 2026 — support.claude.com
• Anthropic, “How Claude’s text watermark works”, FAQ, 14 August 2026 — anthropic.com
• S. Dathathri et al., “Scalable watermarking for identifying large language model outputs” (SynthID-Text), Nature, October 2024 — nature.com
• EU AI Act, Article 50 (transparency obligations) and Article 99 (penalties), applicable since 2 August 2026 — artificialintelligenceact.eu/article/50
• Anthropic newsroom, for the launch dates of Sonnet 5, Opus 5 and Fable 5 — anthropic.com/news
• Thariq (@trq212), Claude Code at Anthropic, thread on X about the announcement, 11 August 2026 — x.com/trq212

Checked on 11 August 2026, updated on 14 August 2026. The coverage and the limitations come verbatim from Anthropic’s support article; the mechanics, the cost, the privacy question and the detection API from the FAQ of 14 August. Both are primary sources and I read them myself. The fine comes from Article 99 of the AI Act, which I verified through a summary rather than in the text of the regulation itself. That no Claude model currently falls under the first promise started as my own conclusion from the launch dates; Anthropic now confirms it with “future Claude models”. That the watermark does not affect quality, and that light editing will not remove it, is Anthropic’s own account, leaning in part on Google DeepMind research into the technique it adopts. That Nature paper is published and peer reviewed, but how robust Anthropic’s own implementation is has been tested by nobody outside that chain, and there is no detection tool I could measure it with myself. That the model knows nothing of its own mark, and the pull request example, come from an Anthropic employee’s thread I read myself rather than from the documentation.