Anthropic announced it will embed invisible watermarks into text produced by new Claude models, including content created through its API, coding tools, and cloud partners. The company laid out the plan in a support document, explaining that Claude models released in the EU on or after August 2, 2026, will carry machine-readable marking from launch. The watermark is designed to help developers trace the source of AI-generated text or code, though Anthropic cautions it's not robust enough to prove where content originated.

The marking applies globally across all supported Claude products, including Claude API, Claude Code, Claude Cowork, and Claude Tag. Text generated through AWS, Google Cloud, or Microsoft Foundry will also include the watermark when those platforms run a supported model. Because the mark is inserted at the model level, it carries over into applications built on Claude. Text receives a watermark hidden within the words themselves, while files such as SVGs, PNGs, and JPGs get a digital signature using the C2PA standard. The change responds to Article 50's transparency requirements under the EU AI Act, which took effect August 2 and mandate that providers of generative AI systems make synthetic output detectable in a machine-readable format. Anthropic signed the accompanying Code of Practice alongside OpenAI, Google, Meta, Microsoft, and Mistral.

Anthropic says the watermark "will travel with the text when it's copied and pasted elsewhere, and may persist through some editing." The company acknowledges that editing, paraphrasing, translating, or combining Claude's response with other text may weaken or remove the watermark. Short excerpts may not contain enough signal to detect, and the absence of a watermark doesn't prove Claude wasn't involved—the output may have come from an older model, may be too brief to carry a detectable signal, or may have been altered in an application pipeline. Finding a watermark doesn't prove authorship either, since Claude may have simply proofread, translated, or reformatted material written by a person. According to Anthropic, a detected mark means only that the content "may have been processed by Claude," not that Claude created the underlying work.

Alex Cui, CTO and co-founder of AI detection company GPTZero, wrote in a technical explainer that watermarking systems fast enough to run on streaming frontier models often work by adjusting the probabilities the model uses when selecting its next token. The report explains that code presents a different challenge because the model has fewer valid choices—seemingly minor changes can break working code, and the watermark must selectively alter words in parts of the text that can tolerate synonyms, such as variable names. Cui noted that in his testing, the watermarks don't survive intense paraphrasing, especially when you combine word choice and syntax attacks, and free paraphrasing tools he tested were able to bypass Google DeepMind's SynthID text watermark. The "Watermarks in the Sand" paper found that, under defined assumptions, attackers can remove watermarks without severely damaging content quality.

Anthropic plans to give users and third parties a way to detect its marks, but hasn't said whether that will take the form of a local tool, a detection API, or access limited to selected organizations. Cui warned that if Anthropic releases the watermark detector publicly, it would defeat its own watermark, since people find reliable removal strategies by testing against the detector. The company tells customers to determine how Article 50 applies to their own products and says more technical documentation is coming, but until those details arrive, teams won't know how they'll detect the marks, how key rotation will work, or how well the watermark will survive common changes to code and application output. For developers, Claude's watermark is best treated as another clue, not a replacement for audit logs or provenance tracking. The tension between compliance and durability will likely sharpen as enterprises discover whether regulatory mandates can survive the editing workflows that define production AI systems.