How Claude's New Text Watermark Works

 Anthropic announced that future Claude models will generate text carrying a watermark, a method for determining the likelihood that Claude was involved in producing a given piece of writing. The change is arriving because the EU AI Act now requires it, not because Anthropic decided independently to add it. 

Key Points

• Future Claude models will generate text containing an invisible watermark, a change Anthropic is making to comply with the EU AI Act's requirement that AI providers mark AI-generated content.
• The watermark has no effect on output quality, speed, or cost, since it works by changing which random source decides between equally good word choices rather than adding, removing, or biasing any content.
• It cannot identify a specific user, organization, or chat, and it cannot confirm text is human-written or distinguish Claude's output from another AI's watermarked output.
• Watermark strength varies by content type, appearing more in open-ended creative writing and less in factual text, proofread edits, or code, since those leave fewer equally valid word choices for the watermark to use.
• A detection API is rolling out in private preview, currently limited to organizations with legal obligations under EU law, such as regulators, media, fact-checkers, and compliance-obligated enterprises.

What a Text Watermark Is

Claude generates text one word at a time, and at many points in that process, several candidate words would work equally well, according to Anthropic's explanation. In a sentence like "The weather today was cold and...", both "overcast" and "grey" fit fine, and normally that choice gets settled by an arbitrary random number. Watermarking replaces that arbitrary randomness with a specific key combined with the preceding words, so the resulting sequence of choices becomes checkable against the key afterward. The words Claude picks are still effectively random to a reader. They're just no longer arbitrary in a way that can't be traced back.

Why This Doesn't Change What Claude Writes

Anthropic states plainly that watermarking has no impact on the content, creativity, or readability of Claude's output, and that a watermarked response is indistinguishable from an unwatermarked one to a human reader. This is a meaningfully different concept than a watermark on a banknote or photograph, which is visible by design. The method Anthropic uses is a version of SynthID-Text, a technique Google DeepMind published in Nature in 2024, built on a design principle first proposed by Scott Aaronson in 2022. In DeepMind's own testing on Gemini traffic, and in Anthropic's internal and controlled human-rater studies, watermarked and unwatermarked responses showed no statistically significant difference in quality.

Where the Watermark Is Strong and Where It's Barely There

Watermarking depends on there being multiple equally good choices to nudge between, which means its strength varies significantly by content type. Factual passages, like completing "Isaac Newton's most famous work was called Principia..." with the only correct word, leave the watermark nothing to act on. The same logic applies to code, where an exact output is frequently required and a different token would simply break the program, so code generally carries less watermarking than open-ended prose, though comments with genuinely arbitrary phrasing can still carry some. Light proofreading of human-written text behaves similarly: since most of the words remain the person's own, there may be too few Claude-chosen words for the watermark to register at all. Translations are the clear exception, since every word in a translation is chosen by Claude, so the watermark applies fully there.

What the Watermark Can and Cannot Prove

A detected watermark can only establish the likelihood that Claude was involved in producing a piece of text at some point. It cannot confirm text was human-written, cannot distinguish "Claude wrote this" from "Claude heavily edited this," and cannot identify output from a different AI system, even one using its own watermark with a different key or method. Detection also becomes less reliable on short passages, since fewer word choices mean less information for the key to check against; confidence increases as the passage gets longer. A complete rewrite that replaces every word will likely remove the watermark entirely, though Anthropic notes that at that point it's arguable whether the result still qualifies as AI-generated in the first place.

Privacy, Cost, and Rollout Details

The watermark carries no identifying information tying it to a specific user, organization, or conversation, and Anthropic states it produces no extra tokens, meaning no change in speed or price for users. The requirement stems from the EU's Code of Practice on Transparency of AI-Generated Content, which Anthropic signed alongside roughly 190 other signatories in July 2026, and which took effect August 2, 2026. Anthropic is applying the watermark globally at launch rather than only in the EU, citing the lack of a durable way to scope it by region, and is extending the same treatment to models released before August 2, 2026, over the coming months. A separate detection API is currently in private preview, limited to organizations with legal obligations under the Act, such as regulators, law enforcement, media, fact-checkers, and compliance-obligated enterprises, with broader access planned over time. Images and other files get a different mechanism entirely: a C2PA content credential embedded in file metadata, an open industry standard also used by camera manufacturers, which is visibly different from text watermarking in that nothing in the file itself changes.