On August 14, Anthropic published an explainer, "How Claude's text watermark works," giving the first systematic account of how the watermark is implemented: text generated by future Claude models will carry a statistical watermark that readers cannot perceive but that holders of the key can detect. The driver was not a product roadmap but a regulatory timetable — since August 2, the EU AI Act's content-marking obligations apply, and Anthropic, along with Google, Meta, Microsoft, OpenAI, Mistral and other major providers, signed the same Code of Practice on Transparency of AI-Generated Content in July.
The timeline is more worth recording than any technical detail. The EU requires generative AI providers serving its market to mark AI-generated content, an obligation in force since August 2, 2026. To give companies a clear compliance path, independent experts drafted the Code of Practice on Transparency of AI-Generated Content, assessed as adequate by both the Commission and the AI Board. By the end of July, about 190 organizations had signed: Section 1 (AI system providers) counts 82, including Anthropic, Google, Meta, Microsoft, OpenAI, Mistral, Cohere, Aleph Alpha, Black Forest Labs and Synthesia; Section 2 (deployers) counts 152, including Getty Images, Lenovo and Lufthansa. In September the EU will launch two task forces to gather implementation feedback and advance the standard.
What carries the most weight in these facts is the competitive picture: before market mechanisms could select a unified approach, rival frontier labs were pushed within weeks toward the same class of technical behavior by the same document. Internet standards are usually born of struggle or compromise between giants; this time, the standard arrived ahead of the competition.
Two details in Anthropic's rollout stand out. First, the watermark applies globally, not only to EU users — the company says it has no durable way to scope the marking by region yet, and will evaluate approaches over time. Second, models released before August 2 enjoy a transition period, with watermarking to be added over the coming months. Images and files take a different technical route: files Claude produces (.png, .jpg, .svg and other supported types) get a C2PA content credential in their metadata — a small, cryptographically signed note recording that Claude was involved in making or processing the file, the same open industry standard used by camera manufacturers and photo-editing software.
The principle is more elegant than the intuition of "marking the text." Large language models generate text one word at a time; whenever several candidate words are nearly equally suitable — "The weather today was cold and __," where "overcast" and "grey" leave the meaning almost unchanged — the choice is settled by a random number. Watermarking replaces the source of that randomness: the key plus the preceding words jointly decide the pick. The text still reads as random, but the passage carries a statistical pattern that only a key holder can verify.
Anthropic's analogy is Monopoly: swap the dice for consecutive digits from somewhere in the decimal expansion of pi, and no player can tell the difference, the game's outcome is unaffected, yet after the game the full sequence of moves reveals whether pi was used. Watermarks work the same way — the reading experience is unchanged, but verification after the fact becomes possible.
The lineage is clear: it is a version of the SynthID-Text approach Google DeepMind published in Nature in 2024, tracing back to a proposal by Scott Aaronson in 2022. Anthropic's promise list is restrained too: nothing is added to the text, no hidden characters, no extra tokens, no impact on speed or price, and nothing that could trace output back to a user, organization or chat. On quality, DeepMind served a watermarked model to a slice of real Gemini traffic and found no statistically significant difference in thumbs-up and thumbs-down ratings; human raters comparing answers side by side saw no difference either.
The more informative list is what it cannot do. Detection is unreliable on short samples, and confidence grows with length. Factual passages leave sparse traces — after "Isaac Newton's most famous work was called Principia," the next word has essentially one right answer, leaving the watermark nothing to act on. Code, which must be exact, carries little watermarking outside comments. Text that Claude merely proofreads for a human may contain too few Claude-chosen words to register. Light editing probably won't fully remove the watermark; a word-by-word rewrite will. It cannot distinguish "Claude wrote this" from "Claude heavily edited this," and it cannot prove a passage was written by a human or by a different AI. That is a fundamentally different approach from external AI detectors such as Pangram, which lack the key and rely on stylistic tells — AI models' fondness for the "this isn't X, it's Y" construction, and a suspiciously frequent use of "quietly."
Judgment one: this is governance news first, technology news second. The algorithm is not new — Aaronson's proposal is four years old, and the SynthID paper two. What is newsworthy is the mechanism of adoption: a regional regulation, through the soft instrument of a code of practice, moved the world's leading labs to accept the same class of constraint within weeks, even pushing Anthropic to apply marking globally rather than only in the EU. The AI Act is often criticized as heavy-handed and slow, but this time it accomplished something the market had not: a cross-vendor, verifiable, standard signature for AI-generated content.
Judgment two: the watermark's value must rest on acknowledging its fragility. The academic record is not pretty: an empirical study from July 2026 found that across 846 paraphrase runs, every initially-detected KGW and Unigram text lost its watermark after paraphrasing — 100% conditional removal — with the SynthID family at 98.3%; even before any attack, false-negative rates ran 70–83%, and SynthID flagged 5.4% of paraphrased human-written controls as AI-generated. An earlier robustness study reported that light paraphrasing, copy-paste rearrangement and back-translation all sharply degrade SynthID detection. My position: treating the watermark as an anti-counterfeit seal is misuse — it cannot provide courtroom-grade evidence. What it actually covers is the middle ground of good faith: platforms screening content farms, publishers auditing after the fact, institutions demonstrating diligence. Overstating it ultimately burns the trust it could have accumulated.
Judgment three: who holds the key matters more than the shape of the lock. Detecting Claude's watermark requires Anthropic's key, and the company says only that a detection API is coming, with implementation details still being worked out. There is a structural asymmetry here: the seller of the words is also the only one who can verify them. The API's final shape — who gets access, whether it returns probabilities or verdicts, whether the misjudged have an appeal channel — will decide whether this becomes public trust infrastructure or another platform wall. The two EU task forces convening in September, plus the unwritten terms of that API, deserve more attention than the August 14 explainer.
My position: support the signature, resist the myth. Watermarking gives machine-written text a uniform signature for the first time, which deserves credit. But a signature is only ink; its meaning depends on who is allowed to read it, and how. For ordinary users, all of this is nearly invisible: nothing perceptible changes, there is no extra cost, the watermark carries no personal identity, and ownership and legal responsibility are unchanged. The real contest is between platforms, regulators and detection power — and it has only just begun. The seller of the words is also the only one who can verify them; that line deserves a place on every detection API's launch page.