Anthropic has set out in detail how Claude AI text watermarking will work, confirming that future Claude models will embed an invisible statistical pattern into generated output, one that ordinary readers cannot detect but that a keyed detector can identify with meaningful confidence.
The move comes as Anthropic joins a broad coalition of AI providers that signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. IEU Monitoring reported that around 190 signatories in total committed to the code, which sits under the EU AI Act’s requirements for AI providers serving the European market. Anthropic is among the first to publish specifics on implementation, and it has confirmed the watermark will apply globally at launch, not just inside the EU.
‘We’re applying watermarking globally at launch because we don’t yet have a durable way to scope it by region,’ Anthropic explained in a blog post. Models launched before 2 August 2026 are covered by the EU’s transition period, and Anthropic says it is working to add watermarking to those older models over the coming months.
How Claude AI Text Watermarking Works Under the Hood
The underlying technique is based on Google DeepMind‘s SynthID-Text approach, and the intellectual lineage goes back further than that: IEU Monitoring notes that the core idea traces to a proposal by Scott Aaronson in 2022, predating its incorporation into production AI systems.
The mechanics are worth understanding, because this is not a matter of stamping a label onto finished text. AI models generate responses token by token, each step involving a probabilistic choice among plausible next words. Anthropic’s watermarking system intercepts that process. Rather than appending hidden characters or modifying the completed response, it changes the source of randomness used when the model faces a low-stakes choice between equally reasonable options.
‘Watermarking uses low-stakes choices like these (which occur many times over a piece of generated text) to leave a pattern in Claude’s responses. That pattern is undetectable to the reader, but is detectable to anyone who has a key that encodes it,’ Anthropic explained. Instead of an arbitrary random number generator selecting the next token, the watermarking system uses a secret key combined with the preceding words to influence the selection. The words chosen still appear random to any reader, but the sequence carries a statistical signature that a detector holding the key can measure.
‘Nothing is added to the text and there are no hidden characters,’ Anthropic noted. Watermarking requires no additional tokens and has a negligible effect on generation speed, the company says, adding that internal testing found no impact on creativity, readability, or the content of Claude’s responses.
Where the Watermark Does Not Apply, and What the Detection API Will Offer
The system has deliberate exceptions. Where only one correct answer exists, factual completions, arithmetic, or code where substituting one term for another would break the output, the watermark is not applied. ‘Where an exact output is required, where there isn’t a choice, and something would be factually wrong or a piece of code would break if a different term was chosen, the watermark isn’t applied,’ Anthropic stated. Code therefore carries generally less watermarking than open-ended prose, though comments within code, where arbitrary phrasing is possible, can still carry the pattern.
Detection reliability also scales with text length. Longer outputs provide more token choices for the statistical pattern to accumulate across, making confident detection easier. Short samples offer fewer data points. Light human proofreading (correcting a handful of grammar or punctuation errors) may leave enough of the pattern intact, but a complete rewrite where every word is replaced will remove it. Anthropic also says a translation produced by Claude carries a watermark because Claude chooses every word in the translated output, while a human text that Claude only lightly corrected may contain too little Claude-generated material for reliable detection.
Crucially, the watermark can only confirm that Claude was likely involved at some point; it cannot distinguish between ‘Claude wrote this’ and ‘Claude heavily edited this’, and it cannot identify text generated by a different AI provider’s model, since other providers use different keys and potentially different methods.
Anthropic plans to offer a watermark detection API that will return a probability estimate of Claude’s involvement in a given piece of text. For generated image files (PNG, JPG and SVG) the company is taking a different route: Claude will attach cryptographically signed C2PA provenance metadata to the file rather than embedding a watermark inside it.
With around 190 organisations now signed up to the EU code and Anthropic rolling out the capability globally from launch, the pressure on the rest of the industry to follow with comparable transparency will be real, and measurable.
