Somewhere in the next paragraph Claude writes for you, the model will hit a fork where “overcast” and “grey” would both work. Until this month it settled that with a random number. Now it settles it with a cryptographic key, and the pattern that leaves behind is a watermark.
Anthropic began embedding that watermark in text generated by Claude models launched on or after August 2, 2026, the day the EU AI Act’s transparency obligations became enforceable. The company detailed the mechanics in an August 14 post and in a support document confirming it had signed the Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content. Models shipped before August 2 fall under a transition period running to December 2, 2026.
What makes this more than a compliance filing is the geography, or the absence of it. The marks apply to the developer API, the Claude apps, Claude Code, Cowork, and Claude served through AWS, Google Cloud and Microsoft Foundry, worldwide. Anthropic’s explanation is unusually unvarnished: “We’re applying watermarking globally at launch because we don’t yet have a durable way to scope it by region.” The company said it would continue evaluating approaches.
The technique is SynthID-Text, published by Google DeepMind in Nature in 2024 and descended from a 2022 proposal by Scott Aaronson. It adds no tokens, no hidden characters and no cost. DeepMind’s own live A/B test on a slice of Gemini traffic found no statistically significant difference in thumbs-up ratings between watermarked and unwatermarked models. Because the signal lives in word choices rather than in metadata, it survives copy-paste.
It also has holes Anthropic names itself. The watermark thins wherever the right word is the only word. “Watermarking is sparser on factual passages,” the company wrote, and code, which usually has to be exact, carries little beyond its comments. Proofreading leaves almost nothing to attach to. Short passages do not register. And the strongest available claim is weak by design: “A watermark can only determine that Claude was likely involved with the content at some point. It cannot distinguish ‘Claude wrote this’ from ‘Claude heavily edited this.’”
One widely repeated framing needs a correction. The line that the mark can be stripped by resaving, reformatting or screenshotting is accurate, but it describes the C2PA provenance metadata Anthropic attaches to .png, .jpg and .svg files, a signed note that sits beside the file rather than inside it. The text watermark fails differently: “Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will.”
Researchers who have attacked SynthID-Text put that threshold far below a full rewrite. In a December 2024 evaluation, Nikola Jovanović, Thibaud Gloaguen and Martin Vechev of ETH Zurich’s SRI Lab pointed off-the-shelf paraphrasers at the scheme and recorded removal rates above 90 percent. “For naive adversaries only using off-the-shelf paraphrasers, SynthID-Text is easier to scrub compared to other SOTA schemes,” they wrote. “This can further be boosted to nearly 100% by using black-box queries to first steal the watermark before scrubbing it.” The same group showed at ICML 2024 that watermarking schemes could be reverse-engineered through a public API for under $50. The findings were not all bad for Anthropic: SynthID-Text proved harder to forge than its rivals, with spoofing success falling to 4 percent once repeated-context caching was enabled, and forgery attempts left detectable traces.
Brussels wrote the escape hatch into the statute. Article 50(2) demands machine-readable marking that is “effective, interoperable, robust and reliable as far as this is technically feasible.”
Why It Matters
The penalties are real: up to €15 million or 3 percent of worldwide annual turnover, whichever is higher, enforced by national market surveillance authorities, the Commission’s AI Office and the European Data Protection Supervisor. The Code of Practice Anthropic signed, published July 31, two days before the rules bit, carries about 190 signatories, 82 on the provider section and 152 on the deployer section. Google, Meta, Microsoft, OpenAI and Synthesia signed as providers; Getty Images, Lenovo and Lufthansa as deployers.
“Europeans have a right to know whether what they see, hear or read has been made or altered by AI, especially when such content can shape public debate,” said Henna Virkkunen, the Commission’s Executive Vice-President for Tech Sovereignty, Security and Democracy. “Transparency is how we protect trust.”
This is the Brussels effect in its purest form: a rule written for 450 million people reshaping a product for everyone, not because the law reaches Ohio but because maintaining two Claudes costs more than maintaining one. It is also a fair test of whether provenance marking can work at all. The honest answer from the literature is that watermarks raise the cost of laundering AI text without building a wall. They will catch the incurious. A motivated influence operation with a paraphraser and a modest budget walks through. Meanwhile the visible-label duty under Article 50(4) sits with deployers, the newsrooms and marketing teams publishing the output, not with the lab that stamped it.
What to Watch
The detection API. Anthropic says one is coming but has not shipped it: “We’re in the process of working out the details of its implementation.” Until it exists, no one outside Anthropic can check a Claude mark, which makes the transparency largely notional. Watch December 2, when legacy Claude models must comply. Watch the two Commission task forces convening in September to fill in the technical detail the law left blank. Watch whether Anthropic eventually finds its “durable way” to scope watermarking by region, and quietly turns it off outside Europe. And watch the false positives, because a probabilistic signal that says a human’s lightly edited draft “may have been processed by Claude” will land in front of an editor, a professor or a compliance officer who reads it as proof.
“For naive adversaries only using off-the-shelf paraphrasers, SynthID-Text is easier to scrub compared to other SOTA schemes. This can further be boosted to nearly 100% by using black-box queries to first steal the watermark before scrubbing it.”— Nikola Jovanović, Thibaud Gloaguen and Martin Vechev, Researchers, SRI Lab, ETH Zurich