The Mechanics of Claude’s Text Watermark

Anthropic has confirmed that future Claude models will embed a statistical watermark in generated text, a change driven by the EU AI Act's transparency requirements. The company says the watermark has no practical effect on output quality, adds no hidden characters, requires no extra tokens, and carries no identifying information about users. Enforcement begins as the EU's marking obligation for AI-generated content took effect on August 2, with Anthropic signing the EU Code of Practice on Transparency of AI-Generated Content in July 2026 alongside roughly 190 total signatories.

Background: Why watermarking is arriving now

The EU now requires AI providers serving its market to mark AI-generated content. Because Anthropic lacks a durable way to scope watermarking by region, it is applying the system globally at launch rather than only within the EU. The company says it will keep evaluating regional approaches.

How the watermark works

Claude generates text one word at a time, choosing among plausible candidates. In sentences like "The weather today was cold and…", words such as "overcast" or "grey" carry nearly identical meaning, so the choice is normally settled by a random number. Watermarking changes only the source of that randomness: instead of an arbitrary generator, a key plus a few preceding words determines the pick. The text remains random, but the sequence becomes checkable against the key, yielding a probability that Claude was involved.

The method is a version of Google DeepMind's SynthID-Text, published in Nature in 2024, and traces back to a 2022 proposal by Scott Aaronson. Google DeepMind tested quality impact by serving watermarked output to a portion of Gemini traffic and comparing thumbs-up and thumbs-down ratings, finding no statistically significant difference; human raters in a controlled study also saw no quality gap.

Where detection works, and where it does not

Detection answers only one question: how likely is it that Claude was partly involved? It cannot confirm human authorship or identify another AI's output, since other providers use different keys or methods. Short samples give weak signals; confidence rises with passage length. Factual passages offer fewer free choices—"Isaac Newton's most famous work was called Principia Mathematica" has one correct continuation—so watermarking is sparser there. The same applies to proofreading, code, and light edits of human text, where few words are Claude's own. Translations are fully watermarked because Claude chooses every word. Editing can weaken a watermark; a complete rewrite replacing every word removes it.

Access, files, and cost

A detection API is in private preview for eligible organizations, including regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, and EU civil society groups, plus enterprises with their own compliance obligations. Files such as .png, .jpg, and .svg carry a C2PA content credential—a cryptographically signed metadata note readable by C2PA-aware tools—rather than a watermark. Watermarking adds no tokens, so serving cost and speed are unchanged, and nothing in the watermark or its key can be traced to a user, organization, or chat.

What to watch

The EU law includes a transition period for Anthropic, and the company says it will share updates as its approach evolves. The open questions are how quickly detection access expands beyond the private preview and whether watermarking holds up as users edit, rewrite, or route text through other models.