Claude will watermark its text. The EU is the reason

Anthropic confirmed on 14 August 2026 that future Claude models will carry a text watermark [1]. The viral version of this news gets two things wrong. The watermark is not hidden characters; it lives in the pattern of words Claude picks. And the stated reason is not Chinese labs copying Claude. It is the EU AI Act [1].

A social-media graphic spread the claim: “Claude will now invisibly watermark AI-generated text so it can be detected after being copied & pasted.” That sentence is surprisingly accurate, but “invisibly” sounds like hidden data has been added to the output. Anthropic’s technical explanation shows something quite different.

How does a watermark survive copy-paste without hidden characters?

Because the watermark is not attached to the text. It is the text. Claude marks its output through word choices made when several options work equally well. The Claude Help Center states the consequence directly: the watermark is part of the text, so it travels when the text is copied and pasted elsewhere [2].

Here is the mechanism as Anthropic describes it. A language model writes by repeatedly choosing the next word, and at many positions the choice barely matters because several words would fit. Normally the model picks among those acceptable words at random. Watermarking keeps the choices random but changes where the randomness comes from: instead of an arbitrary random number generator, the model uses a secret key together with a few of the preceding words to settle which option it takes [1]. Repeated over the many low-stakes choices in a passage, this leaves a pattern that no reader can see but that anyone holding the key can test for [1]. Nothing is added to the text, there are no hidden characters, and the watermark needs no extra tokens, so it does not make Claude more expensive to serve or use [1].

Anthropic is equally clear about what the watermark does not do: it never pushes Claude toward a word it would not have considered anyway. The announcement’s example is “nubilous”, an obscure synonym for overcast that Claude would almost never use; the watermark only changes how the choice among plausible words gets made [1].

The approach is borrowed, and openly so. Claude’s watermark is a version of SynthID-Text, which Google DeepMind published in the journal Nature in 2024, and the family of methods goes back to a proposal by Scott Aaronson in 2022 [1]. DeepMind’s own description matches Anthropic’s: SynthID adjusts the probability scores of candidate tokens during generation, and the final pattern of scores across the model’s word choices is the watermark [3].

The Nature paper is the reason I take the no-quality-loss claim seriously. In a live experiment in the Gemini production system covering close to 20 million responses, the thumbs-up rate of the watermarked model differed from the unwatermarked one by 0.01% and the thumbs-down rate by 0.02%, both statistically insignificant [4]. Anthropic reports the same from its own internal testing: no measured impact on the content, creativity or readability of Claude’s text [1].

Detection runs the same trick backwards. With the key, a detector can check whether a passage contains the word choices a watermarked generation would have preferred far more often than chance explains. The signal accumulates choice by choice, so confidence about Claude’s involvement grows with the length of the passage, and a very short one carries too few decisions to say anything [1]. The copy-paste claim is right because there is nothing attached to the text that can be stripped out. The explanation for the timing needs a separate look.

Why is Anthropic doing this?

To comply with the EU AI Act. Anthropic says so directly [1]. Article 50(2) of Regulation (EU) 2024/1689, published through EUR-Lex, requires providers of AI systems that generate text, audio, images or video to mark outputs in a machine-readable format that can be detected as AI-generated [5].

The dates explain the August timing. The European Commission’s FAQ on Article 50 states that the obligations apply from 2 August 2026, with one narrow grace period: systems already on the market before that date get until 2 December 2026 to meet the marking and detection obligation [6]. The stakes are not symbolic either, because fines can reach 15 million euros or 3% of total worldwide turnover for the preceding financial year [6].

Anthropic also chose the more predictable of the two compliance routes. In July 2026 it signed the EU Code of Practice on Transparency of AI-Generated Content [1], and the Commission’s page on the code spells out why a provider would: signatories can rely on the code’s measures to demonstrate compliance, while providers choosing their own approach must convince market surveillance authorities individually that their measures are adequate [7]. By the end of July 2026 about 190 organizations had signed, and the Commission’s examples of prominent AI signatories include Anthropic, Google, Meta, Microsoft, Mistral and OpenAI [8]. Text watermarking will not be unique to Claude.

What is the EU actually trying to prevent? The Commission’s guidelines on these transparency obligations describe the problem as AI content becoming hard to distinguish from human content, which raises risks of misinformation and manipulation at scale, fraud, impersonation and consumer deception [9].

One detail looks odd for an EU rule: the watermark ships worldwide. Anthropic’s explanation is operational rather than legal. It does not yet have a durable way to scope watermarking by region, so it applies the watermark globally at launch and says it will keep evaluating other approaches [1]. The Claude Help Center confirms the scope: marking applies to output from supported models wherever Claude is offered [2]. Keep that detail in mind, because it matters for the next section.

Is Claude’s watermark really aimed at Chinese labs?

Anthropic names EU compliance as Claude’s purpose, and I found no public statement connecting the watermark to Chinese labs [1]. The China theory is technically plausible, but it remains an interpretation of the timing and the separate research below, not documented fact. A company can still have more than one reason for the same release.

Why the China theory is plausible

The China theory connects two documented facts. Anthropic accused Chinese labs of model distillation, which means training a model on Claude’s output [10], and an arXiv paper presented at NeurIPS 2024 found that watermark traces can survive into the trained model [13]. The inference is that catching those labs is the real purpose and the EU AI Act provides convenient cover. That is also the second reading people drew from the viral graphic’s timing.

The distillation war is thoroughly documented. On 23 February 2026 Anthropic said it had identified industrial-scale campaigns by DeepSeek, Moonshot and MiniMax to extract Claude’s capabilities: more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts, aimed at Claude’s agentic reasoning, tool use and coding [10]. Reuters covered the accusations the same day and noted that none of the three companies immediately responded [11].

The June round was larger. On 24 June 2026 Reuters reported, citing a letter Anthropic sent to two US senators, that operators affiliated with Alibaba and its Qwen lab generated more than 28.8 million exchanges through almost 25,000 fraudulent accounts between 22 April and 5 June 2026, which Anthropic called the largest known attack of its kind on the company. Alibaba did not immediately respond either [12].

Watermark research supports the theory’s technical premise. In a paper presented at NeurIPS 2024, Tom Sander and colleagues showed that watermarks make language models “radioactive”: a model fine-tuned on watermarked text inherits weak but detectable traces of the watermark, and for an open-weight model they could prove training on watermarked instructions with high confidence even when only 5% of the training text carried a mark [13].

Other research shows the limits. An arXiv paper by Leyi Pan and colleagues, accepted at ACL 2025, tested whether watermarks can prevent unauthorized knowledge distillation and found two ways around them: paraphrasing the training data before distillation, and neutralizing the watermark at inference time after training. Both removed the inherited marks thoroughly, and the inference-time method did so while keeping the transferred capability and adding little overhead [14].

Researchers have since built watermarks for exactly this fight. In May 2026, Meta’s FAIR lab posted TextSeal on arXiv, a watermark designed to stay detectable through distillation and positioned directly against SynthID-Text; its authors include the lead researchers behind the radioactivity paper [15].

Why I still think the EU explanation fits better

The official documents still point to EU compliance. Anthropic gives the EU AI Act as the reason for the watermark [1], while its February post on the distillation attacks names a separate set of defenses: classifiers and behavioral fingerprinting for API traffic, detection of coordinated activity across accounts, stronger verification for the account types most often abused, and countermeasures meant to make outputs less useful for illicit distillation [10].

The worldwide rollout makes a distillation-first motive less convincing to me. Anthropic says it applies the watermark globally because it lacks a durable way to scope it by region, and it is still looking for one [1]. If catching distillation were the main goal, researching ways to switch the mark off outside Europe would be a strange product decision.

The timeline points me the same way. The watermark announcement landed twelve days after Article 50 began to apply and well ahead of the 2 December 2026 deadline for older systems; it followed the DeepSeek accusations by almost six months and the Alibaba letter by seven weeks. Put the two calendars side by side and the compliance explanation needs fewer assumptions: every watermark date tracks an EU obligation, while the distillation dates sit months away.

1. Feb 23, 2026

   Distillation accusations

   Anthropic names DeepSeek, Moonshot and MiniMax.

2. Jun 24, 2026

   Alibaba accusation

   Reuters reports 28.8 million exchanges via fraudulent accounts.

3. Jul 31, 2026

   Code of Practice tally

   The Commission counts about 190 signatories, Anthropic included.

4. Aug 2, 2026

   Article 50 applies

   New AI systems must mark generated content.

5. Aug 14, 2026

   Watermark announced

   Future Claude models will watermark their text.

6. Dec 2, 2026

   Deadline for older systems

   The marking obligation reaches systems from before 2 August 2026.

My read is that EU compliance explains this launch, while distillation detection is a possible side effect. The documented facts support that distinction: Anthropic fights the distillation war with named tools, and Claude’s watermark has one documented purpose, EU compliance. If watermarked Claude output ends up in someone’s training data, the radioactivity research suggests Anthropic may still gain a detection option whether or not anyone planned it that way [13]. What such a detection would establish is its own question.

What does Claude watermark detection actually prove?

That Claude was probably involved, and little more. Anthropic says its key estimates the likelihood that Claude partly wrote the text. A match cannot distinguish text Claude wrote from text Claude heavily edited. It also cannot confirm human authorship or recognize another company’s AI, which would use a different key or method [1].

A mark can even overstate involvement. The Claude Help Center notes that output can carry a Claude mark when the underlying ideas, text or data came from another source, so a detection says that Claude processed the words at some point, not where the ideas came from [2].

Short, edited and exact text can evade detection

A negative result proves even less. The help center lists the situations where marked content stops being detectable: the passage is very short, or the text has been heavily edited, paraphrased, translated or mixed into other writing [2]. Text can also come from a Claude model that does not mark yet, because models launched before 2 August 2026 are still in transition; Anthropic says watermarking for those models will roll out over the coming months [1] [2].

Translation cuts both ways. A translation produced by Claude carries a fresh watermark, since every word of it is Claude’s choice [1]. Running already-marked text through another translator replaces those word choices and can erase the signal [2].

The watermark is also uneven by design. Where only one output is correct, it is not applied, because choosing a different word would make the text wrong. Anthropic’s example is completing “Isaac Newton’s most famous work was called Principia”, where “Mathematica” is the only right answer, so the watermark has nothing to act on [1]. The same logic thins the mark in code, which mostly has to be exact; free choices such as the wording of comments can carry it, but Anthropic expects a negligible effect on the actual code produced [1]. Proofreading behaves the same way: when Claude only fixes grammar and punctuation in a human text, the watermark can only live in the handful of corrections, which may be too few to register [1]. That behavior happens to line up with the law, because Article 50 exempts AI that performs an assistive function for standard editing or does not substantially alter the input [5].

A complete rewrite can remove the watermark

Nobody outside Anthropic has tested Claude’s version yet, but the SynthID-Text family has been probed. In December 2024 the SRI Lab at ETH Zurich evaluated SynthID-Text on a locally deployed Llama model and found it harder to spoof than comparable schemes but easier to scrub: paraphrasing removed it more easily than it removed other state-of-the-art watermarks, even when the attacker used nothing more than off-the-shelf paraphrasing tools [16]. Anthropic itself concedes the endpoint: light editing probably will not remove the watermark completely, and a complete rewrite where every word is replaced will, at which point it is arguable whether the text is still AI-generated at all [1].

The mark identifies neither the user nor the owner

The watermark carries nothing about you: Anthropic states there is nothing in the watermark or its key that could recover information about the user, their organization or their conversations, and a mark changes nothing about ownership or a user’s rights [1]. For now, nobody outside Anthropic can check the mark either. Detection requires the key, which is why third-party AI detectors use different methods [1], and the detection API Anthropic says it will offer soon had no published implementation details, thresholds or access model as of 17 August 2026 [1].

What changes for Claude code, prose and files?

For everyday work, very little changes. Supported Claude models mark prose wherever they run, code carries little signal when exactness leaves few word choices, and supported files get a separate C2PA credential in their metadata [1]. The rollout follows models rather than individual Claude products [2].

That means a supported model marks its text everywhere it runs, whether that is the Claude apps, the Claude Platform API, Claude Code, Claude Cowork or Claude Tag, or access through AWS, Google Cloud and Microsoft Foundry [2]. Anthropic notes that some platforms or features may not support every marking type [2]. Models launched on or after 2 August 2026 mark from launch; older models get the capability as the transition work lands [2]. There is no single day when all Claude text becomes marked, which also means no single day when detection becomes reliable across the board.

For working programmers the practical footprint should stay small. Code mostly has to be exact, exact output is not watermarked, and Anthropic expects a negligible effect on the code Claude actually produces; in a coding session the signal lives mainly where wording is free, such as comments [1]. Ordinary prose is where the watermark has room to work, and there both Anthropic’s internal testing and DeepMind’s Gemini experiment say quality does not measurably move [1] [4].

Files use a separate C2PA credential

Files get a different treatment entirely. When Claude produces a supported file type, such as a .png, .jpg or .svg, it attaches a content credential: a small, cryptographically signed note in the file’s metadata recording that the file was made or processed with Claude [1]. The format is C2PA, from the Coalition for Content Provenance and Authenticity, an open technical standard for establishing the origin and edit history of digital content, and the same one camera manufacturers and photo-editing software use [1] [17]. Any C2PA-aware tool can read the credential, and Anthropic says it will provide its own checking tool [1].

My read of the two mechanisms is that they fail in opposite directions. The text watermark survives copy-paste because it is made of the words themselves, and it only fades as those words get replaced through editing [2]. The file credential leaves the file content untouched but lives in metadata, which is lost when someone takes a screenshot, converts the format or re-saves the file [2].

Property	Text watermark	C2PA file credential
Where the signal lives	In the pattern of word choices	In signed metadata attached to the file
Changes the content itself	✗ No	✗ No
Survives copy-paste	Yes, the mark is the text	Only if the metadata is carried along
What removes it	A rewrite that replaces the words	Screenshots, format conversion, re-saving
Identifies the user	✗ No	✗ No
How to check	Anthropic's key; a detection API is planned	Any C2PA-aware tool

Claude’s watermark is not the AI detector teachers and editors keep asking for. Without the key there is nothing to check, and even with it the answer is a likelihood, not a verdict [1]. Instead, Anthropic is building provenance into the models because a law demands it and about 190 organizations have agreed on how to deliver it [8]. My own next step is concrete: when the detection API appears, I will run my published articles and a stack of Claude transcripts through it and write down what the confidence numbers actually do at different lengths.