Claude will watermark its text. The EU is the reason

Anthropic confirmed on 14 August 2026 that future Claude models will carry a text watermark [1]. The viral version of this news gets two things wrong. The watermark is not hidden characters; it lives in the pattern of words Claude picks. And the stated reason is not Chinese labs copying Claude. It is the EU AI Act [1].

The trigger was a graphic going around social media: “Claude will now invisibly watermark AI-generated text so it can be detected after being copied & pasted.” As one-sentence summaries go, that is surprisingly accurate. The wrong part is what people read into it. “Invisibly” gets taken to mean hidden characters smuggled into the output, and the timing gets read as Anthropic arming itself against the Chinese labs it accused of illicitly extracting Claude’s capabilities earlier in 2026. The first reading misunderstands the mechanism, and the second one runs ahead of the documentation. Both deserve to be taken apart slowly.

How does a watermark survive copy-paste without hidden characters?

Because the watermark is not attached to the text. It is the text. Claude marks its output through which words it picks at moments where several options would work equally well, and the Claude Help Center states the consequence directly: the watermark is part of the text, so it travels along when the text is copied and pasted elsewhere [2].

Here is the mechanism as Anthropic describes it. A language model writes by repeatedly choosing the next word, and at many positions the choice barely matters because several words would fit. Normally the model picks among those acceptable words at random. Watermarking keeps the choices random but changes where the randomness comes from: instead of an arbitrary random number generator, the model uses a secret key together with a few of the preceding words to settle which option it takes [1]. Repeated over the many low-stakes choices in a passage, this leaves a pattern that no reader can see but that anyone holding the key can test for [1]. Nothing is added to the text, there are no hidden characters, and the watermark needs no extra tokens, so it does not make Claude more expensive to serve or use [1].

Anthropic is equally clear about what the watermark does not do: it never pushes Claude toward a word it would not have considered anyway. The announcement’s example is “nubilous”, an obscure synonym for overcast that Claude would almost never use; the watermark only changes how the choice among plausible words gets made [1].

The approach is borrowed, and openly so. Claude’s watermark is a version of SynthID-Text, which Google DeepMind published in the journal Nature in 2024, and the family of methods goes back to a proposal by Scott Aaronson in 2022 [1]. DeepMind’s own description matches Anthropic’s: SynthID adjusts the probability scores of candidate tokens during generation, and the final pattern of scores across the model’s word choices is the watermark [3]. The Nature paper is the reason I take the no-quality-loss claim seriously. In a live experiment in the Gemini production system covering close to 20 million responses, the thumbs-up rate of the watermarked model differed from the unwatermarked one by 0.01% and the thumbs-down rate by 0.02%, both statistically insignificant [4]. Anthropic reports the same from its own internal testing: no measured impact on the content, creativity or readability of Claude’s text [1].

Detection runs the same trick backwards. With the key, a detector can check whether a passage contains the word choices a watermarked generation would have preferred far more often than chance explains. The signal accumulates choice by choice, so confidence about Claude’s involvement grows with the length of the passage, and a very short one carries too few decisions to say anything [1]. So the copy-paste half of the viral graphic is right, and for a reason the graphic cannot show: there is nothing in the text to strip out. The “why now” half is where the story usually goes wrong.

Why is Anthropic doing this?

To comply with the EU AI Act. Anthropic says so directly: it is implementing watermarking, along with several other major AI providers, to comply with the Act [1]. Article 50(2) of the law, Regulation (EU) 2024/1689, requires providers of AI systems that generate text, audio, images or video to mark outputs in a machine-readable format, detectable as artificially generated [5].

The dates explain the August timing. The European Commission’s FAQ on Article 50 states that the obligations apply from 2 August 2026, with one narrow grace period: systems already on the market before that date get until 2 December 2026 to meet the marking and detection obligation [6]. The stakes are not symbolic either, because fines can reach 15 million euros or 3% of total worldwide turnover for the preceding financial year [6].

Anthropic also chose the more predictable of the two compliance routes. In July 2026 it signed the EU Code of Practice on Transparency of AI-Generated Content [1], and the Commission’s page on the code spells out why a provider would: signatories can rely on the code’s measures to demonstrate compliance, while providers choosing their own approach must convince market surveillance authorities individually that their measures are adequate [7]. By the end of July 2026 about 190 organizations had signed, and the Commission’s examples of prominent AI signatories include Anthropic, Google, Meta, Microsoft, Mistral and OpenAI [8]. Whatever text watermarks turn into, they will not be a Claude quirk.

What is the EU actually trying to prevent? The Commission’s guidelines on these transparency obligations describe the problem as AI content becoming hard to distinguish from human content, which raises risks of misinformation and manipulation at scale, fraud, impersonation and consumer deception [9].

One detail looks odd for an EU rule: the watermark ships worldwide. Anthropic’s explanation is operational rather than legal. It does not yet have a durable way to scope watermarking by region, so it applies the watermark globally at launch and says it will keep evaluating other approaches [1]. The Claude Help Center confirms the scope: marking applies to output from supported models wherever Claude is offered [2]. Keep that detail in mind, because it matters for the next section.

The China theory, taken seriously

The competing explanation deserves more than a dismissal, because every fact it stands on is real. The theory goes like this: Anthropic spent 2026 accusing Chinese labs of distillation, the practice of training your own model on another model’s output, and research shows that watermarks can survive into models trained on marked text. So the watermark must really be a tool for catching those labs, and the EU AI Act is convenient cover.

The distillation war is thoroughly documented. On 23 February 2026 Anthropic said it had identified industrial-scale campaigns by DeepSeek, Moonshot and MiniMax to extract Claude’s capabilities: more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts, aimed at Claude’s agentic reasoning, tool use and coding [10]. Reuters covered the accusations the same day and noted that none of the three companies immediately responded [11]. The June round was larger. On 24 June 2026 Reuters reported, citing a letter Anthropic sent to two US senators, that operators affiliated with Alibaba and its Qwen lab generated more than 28.8 million exchanges through almost 25,000 fraudulent accounts between 22 April and 5 June 2026, which Anthropic called the largest known attack of its kind on the company. Alibaba did not immediately respond either [12].

The research half holds up too. In a paper presented at NeurIPS 2024, Tom Sander and colleagues showed that watermarks make language models “radioactive”: a model fine-tuned on watermarked text inherits weak but detectable traces of the watermark, and for an open-weight model they could prove training on watermarked instructions with high confidence even when only 5% of the training text carried a mark [13].

The counter-research is just as real. A paper by Leyi Pan and colleagues, accepted at ACL 2025, tested whether watermarks can prevent unauthorized knowledge distillation and found two ways around them: paraphrasing the training data before distillation, and neutralizing the watermark at inference time after training. Both removed the inherited marks thoroughly, and the inference-time method did so while keeping the transferred capability and adding little overhead [14]. The arms race has since produced watermarks built for exactly this fight: in May 2026 researchers at Meta’s FAIR lab, among them the lead authors of the radioactivity paper, posted TextSeal, a watermark designed to stay detectable through distillation and positioned directly against SynthID-Text [15].

So the theory is coherent. What it lacks is documentation. There is no public statement tying Claude’s watermark to distillation; the reason Anthropic gives is the EU AI Act [1]. Anthropic’s February post on the distillation attacks names its own set of defenses, and the watermark is not on that list: classifiers and behavioral fingerprinting for API traffic, detection of coordinated activity across accounts, stronger verification for the account types most often abused, and countermeasures meant to make outputs less useful for illicit distillation [10]. And the rollout detail from the previous section now does its work. Anthropic applies the watermark globally only because it lacks a durable way to scope it by region, and it is still looking for one [1]. A lab that built the watermark to catch distillation would not be researching ways to switch it off outside Europe.

The timeline points the same way. The watermark announcement landed twelve days after Article 50 began to apply and well ahead of the 2 December 2026 deadline for older systems; it followed the DeepSeek accusations by almost six months and the Alibaba letter by seven weeks. Put the two calendars side by side and the compliance explanation simply needs fewer assumptions: every watermark date tracks an EU obligation, while the distillation dates sit months away.

1. Feb 23, 2026

   Distillation accusations

   Anthropic names DeepSeek, Moonshot and MiniMax.

2. Jun 24, 2026

   Alibaba accusation

   Reuters reports 28.8 million exchanges via fraudulent accounts.

3. Jul 31, 2026

   Code of Practice tally

   The Commission counts about 190 signatories, Anthropic included.

4. Aug 2, 2026

   Article 50 applies

   New AI systems must mark generated content.

5. Aug 14, 2026

   Watermark announced

   Future Claude models will watermark their text.

6. Dec 2, 2026

   Deadline for older systems

   The marking obligation reaches systems from before 2 August 2026.

None of this proves motive, and a company can hold two reasons while publishing one. What I can separate is the documented from the undocumented. The distillation war is real, and Anthropic fights it with named tools. The watermark has exactly one stated purpose, EU compliance. And if watermarked Claude output does end up in someone’s training data, the radioactivity research suggests Anthropic gains a detection option as a side effect, whether or not anyone planned it that way [13]. What such a detection would actually establish is its own question.

What does a positive detection actually prove?

That Claude was probably involved, and little more. Anthropic states that its key answers one question, the likelihood that a text was partly written by Claude. A match cannot separate “Claude wrote this” from “Claude heavily edited this”, cannot confirm that a text is human-written, and cannot recognize another company’s AI, which would use a different key or method [1].

A mark can even overstate involvement. The Claude Help Center notes that output can carry a Claude mark when the underlying ideas, text or data came from another source, so a detection says that Claude processed the words at some point, not where the ideas came from [2].

A negative result proves even less. The help center lists the situations where marked content stops being detectable: the passage is very short, or the text has been heavily edited, paraphrased, translated or mixed into other writing [2]. Text can also come from a Claude model that does not mark yet, because models launched before 2 August 2026 are still in transition; Anthropic says watermarking for those models will roll out over the coming months [1] [2]. Translation needs a precise sentence here, because it cuts both ways: a translation produced by Claude carries a fresh watermark, since every word of it is Claude’s choice [1], while running already-marked text through another translator replaces the word choices and can erase the signal [2].

The watermark is also uneven by design. Where only one output is correct, it is not applied, because choosing a different word would make the text wrong. Anthropic’s example is completing “Isaac Newton’s most famous work was called Principia”, where “Mathematica” is the only right answer, so the watermark has nothing to act on [1]. The same logic thins the mark in code, which mostly has to be exact; free choices such as the wording of comments can carry it, but Anthropic expects a negligible effect on the actual code produced [1]. Proofreading behaves the same way: when Claude only fixes grammar and punctuation in a human text, the watermark can only live in the handful of corrections, which may be too few to register [1]. That behavior happens to line up with the law, because Article 50 exempts AI that performs an assistive function for standard editing or does not substantially alter the input [5].

Can someone strip the watermark on purpose? Nobody outside Anthropic has tested Claude’s version yet, but the SynthID-Text family has been probed. In December 2024 the SRI Lab at ETH Zurich evaluated SynthID-Text on a locally deployed Llama model and found it harder to spoof than comparable schemes but easier to scrub: paraphrasing removed it more easily than it removed other state-of-the-art watermarks, even when the attacker used nothing more than off-the-shelf paraphrasing tools [16]. Anthropic itself concedes the endpoint: light editing probably will not remove the watermark completely, and a complete rewrite where every word is replaced will, at which point it is arguable whether the text is still AI-generated at all [1].

Two more limits matter. The watermark carries nothing about you: Anthropic states there is nothing in the watermark or its key that could recover information about the user, their organization or their conversations, and a mark changes nothing about ownership or a user’s rights [1]. And for now, nobody can actually check. Detection requires the key, which is why third-party AI detectors use different methods [1], and the detection API Anthropic says it will offer soon had no published implementation details, thresholds or access model as of 17 August 2026 [1].

What this means for code, files and everyday work

Detection may be closed for now, but marking is not waiting, so it pays to know where the marks will and will not appear. The rollout follows models, not products: watermarking is applied at the model level, so a supported model marks its text everywhere it runs, whether that is the Claude apps, the Claude Platform API, Claude Code, Claude Cowork or Claude Tag, or access through AWS, Google Cloud and Microsoft Foundry [2]. Anthropic hedges that some platforms or features may not support every marking type [2]. Models launched on or after 2 August 2026 mark from launch; older models get the capability as the transition work lands [2]. There is no single day when all Claude text becomes marked, which also means no single day when detection becomes reliable across the board.

For working programmers the practical footprint should stay small. Code mostly has to be exact, exact output is not watermarked, and Anthropic expects a negligible effect on the code Claude actually produces; in a coding session the signal lives mainly where wording is free, such as comments [1]. Ordinary prose is where the watermark has room to work, and there both Anthropic’s internal testing and DeepMind’s Gemini experiment say quality does not measurably move [1] [4].

Files get a different treatment entirely. When Claude produces a supported file type, such as a .png, .jpg or .svg, it attaches a content credential: a small, cryptographically signed note in the file’s metadata recording that the file was made or processed with Claude [1]. The format is C2PA, from the Coalition for Content Provenance and Authenticity, an open technical standard for establishing the origin and edit history of digital content, and the same one camera manufacturers and photo-editing software use [1] [17]. Any C2PA-aware tool can read the credential, and Anthropic says it will provide its own checking tool [1].

My read of the two mechanisms is that they fail in opposite directions. The text watermark survives copy-paste because it is made of the words themselves, and it only fades as those words get replaced through editing [2]. The file credential leaves the file content untouched but lives in metadata, which is lost when someone takes a screenshot, converts the format or re-saves the file [2].

Property	Text watermark	C2PA file credential
Where the signal lives	In the pattern of word choices	In signed metadata attached to the file
Changes the content itself	✗ No	✗ No
Survives copy-paste	Yes, the mark is the text	Only if the metadata is carried along
What removes it	A rewrite that replaces the words	Screenshots, format conversion, re-saving
Identifies the user	✗ No	✗ No
How to check	Anthropic's key; a detection API is planned	Any C2PA-aware tool

What ships here is not the AI detector teachers and editors keep asking for, and Anthropic does not pretend otherwise: without the key there is nothing to check, and even with it the answer is a likelihood, not a verdict [1]. What ships is provenance built into the models themselves, because a law demands it and about 190 organizations have agreed on how to deliver it [8]. My own next step is concrete: when the detection API appears, I will run my published articles and a stack of Claude transcripts through it and write down what the confidence numbers actually do at different lengths.