Claude’s invisible text watermark: what it proves, and what it doesn’t

What Anthropic announced

Anthropic committed to embedding machine-readable marks in content generated by its models, under the European Union’s Code of Practice for Article 50(2) of the AI Act. The obligation date is August 2, 2026, and the rollout applies to models launched on or after that date; Anthropic says it is working on adding marks to current models as well.

Two kinds of marking were announced: invisible watermarks inside generated text, and signed provenance information for generated files. The text watermark is not metadata sitting alongside the output — in Anthropic’s description, “it will travel with the text when it’s copied and pasted elsewhere, and may persist through some editing.”

The marks apply worldwide, not only to European users, and ride the supported models wherever they are offered — the API, the consumer apps, and the major cloud platforms. Anthropic also said it will publish technical details for detecting its watermarks, which is the part that matters most for anyone who checks content: third-party verification becomes possible once that specification exists.

How an invisible text watermark works

An invisible text watermark is not a hidden character or a tag you can find by inspecting the file. The established approach — used in published schemes from other labs — subtly biases the model’s word choices as it generates, in a pattern that reads perfectly naturally but is statistically distinctive to a detector built for it. The text is the watermark.

That design is why the mark survives copy-paste: there is nothing to strip, because there is no separate layer. It is also why detection requires the publisher’s cooperation — you can only test for the pattern if you know what pattern to test for, which is what Anthropic’s promised technical details would provide.

Anthropic has not yet published its specific scheme, its detection method, or robustness numbers. Until it does, statements about exactly how strong the mark is — how much editing it survives, how short a text can be and still carry it — are guesses, including ours. This guide sticks to what was announced.

What a present watermark proves

Style-based AI detection — every detector on the market today, ours included — produces a probability: this text reads like model output. A verified watermark is a different kind of statement: this text came from this provider’s model. It is closer to a signature than a signal.

For the people who deal with AI-writing questions daily — teachers, editors, reviewers — that difference matters. A verified mark ends the guessing for that specific text. It also changes the conversation: “the detector thinks this is AI” invites argument; “this carries the provider’s mark” mostly doesn’t.

The limits still deserve stating. A watermark identifies the origin of generated text, not the intent — AI-assisted writing is legitimate in many settings, and a mark is not an accusation. And a mark says nothing about the parts of a document that were written by a person around pasted model output.

What an absent watermark does not prove

The watermark only exists in text from supported Claude models generated after the rollout. Text from other providers’ models, from older Claude models, from local open-weight models, or from before August 2026 carries no mark and never will. For years, the overwhelming majority of AI-generated text in circulation will be unwatermarked.

Anthropic’s own phrasing — the mark “may persist through some editing” — is an honest hedge, and it cuts both ways: some editing may preserve it, and heavier rewriting may not. Paraphrasing tools exist precisely to launder AI text. A determined evader is the least likely person to hand you a marked document.

So the asymmetry is the whole story: presence is strong evidence, absence is no evidence. Any workflow that treats “no watermark found” as “human-written” has built a hole exactly where the dishonest cases walk through.

The regulation behind it — three blocs, one direction

Article 50(2) of the EU AI Act requires providers of AI systems that generate synthetic text, images, audio or video to ensure the outputs are marked in a machine-readable format and detectable as artificially generated. The obligation applies from August 2, 2026. A Code of Practice operationalises it, and Anthropic is a signatory — which is why the announcement lands on that exact date.

China moved a year earlier. Its Measures for Labeling AI-Generated Synthetic Content, with a mandatory national standard (GB 45438-2025), took effect on September 1, 2025 — and go further than the EU in two ways. They require both explicit labels (visible notices a person can see) and implicit labels (machine-readable marks in the content or its metadata), and they put duties on distribution platforms too: platforms must check for labels and flag suspected AI content even when it arrives unlabelled. Maliciously removing, altering, forging, or concealing a required label is itself prohibited — as is providing tools to do it.

South Korea’s AI Basic Act took effect on January 22, 2026 — the first comprehensive national AI framework law after the EU’s. Its transparency provisions require businesses providing generative-AI products or services to indicate that outputs were AI-generated; content that could be mistaken for reality must be clearly labelled, by human-visible or machine-readable means. Enforcement of the transparency provisions carries a grace period of at least a year, with fines deferred except in cases of serious harm — the duty exists now; the penalties wait.

The strategic consequence: Anthropic is unlikely to remain alone. With three major blocs requiring identifiable AI content — one of them already making label-checking a platform duty — the share of provenance-carrying AI text grows, and content checking gradually shifts from pure statistical guessing toward verification. That shift will take years, but its direction is now set by regulation on three continents, not by any one company’s choice.

What changes for AI detection

When Anthropic publishes its detection details, checking for the mark becomes a deterministic test: the mark is verifiably present, or it is not found. That is the first tier — provenance verification. It is proof-grade for the text that carries a mark, and silent about everything else.

The second tier is what exists today: style-based analysis, which estimates the probability that prose reads as model-generated, and which remains the only tool for the unwatermarked majority. Its honest framing does not change — a probability with evidence, a signal rather than proof, abstention when there is too little prose to judge.

Where Stipple stands: we do not detect Claude’s watermark today — nobody outside Anthropic can, until the technical details are published. When they are, watermark verification is a natural deterministic check in front of our style analysis, the same way our fact-check tool already reads the provenance markers some AI-exported documents carry. Until then, the only honest claims are the ones on this page.

What to do differently now

If you review submitted writing: keep asking for process evidence — drafts and version history remain stronger evidence of authorship than any detector score, and they will remain stronger than watermark absence too.

If you publish with AI assistance: expect provenance marking to spread, and disclose AI use where your context calls for it — transparency ages better than discovery.

If you rely on detection tools: prefer ones that show their evidence and state their limits. A tool that claims certainty from style alone was overclaiming before watermarks; it is overclaiming after them too.