# Anthropic Details How Claude's Text Watermark Will Work > Source: > Published: 2026-08-15 20:46:22+00:00 ## What happened In an August 14, 2026 explainer, Anthropic said future Claude models will generate text carrying a statistical watermark, implemented as a version of Google DeepMind's SynthID-Text, to satisfy EU AI Act transparency rules. The post describes the method and its limits but does not name the models, give a start date, or launch a detector. Anthropic published an explainer on August 14, 2026 describing how a text watermark will work in future Claude models. The company frames the change as compliance with the EU AI Act: it says that as of August 2, 2026, providers serving the EU market must mark AI-generated content, and that Anthropic was among roughly 190 signatories to the EU Code of Practice on Transparency of AI-Generated Content in July 2026. The post is documentation of an approach rather than a launch announcement. It does not name which models will carry the watermark, give a date when marking begins, or say whether it is live in any product today. The method is described as a version of SynthID-Text, the scheme Google DeepMind published in Nature in 2024, which the post places in a family of designs going back to a 2022 proposal by Scott Aaronson. Language models pick each next token partly at random among candidates that are roughly equally good. Watermarking replaces that arbitrary random source with a pseudorandom one derived from a secret key and the preceding words, so a sequence of choices can later be tested for consistency with the key. Anthropic says nothing is inserted into the text, there are no hidden characters, no extra tokens are produced, and price and speed are unchanged. It also says the watermark carries no identifying information and cannot be traced to a person, organization, or conversation. Anthropic is explicit about limits. A detection result only estimates the likelihood that Claude was involved in producing a passage. It cannot show that text was human-written, and it cannot identify other AI systems, which would use different keys or different methods entirely. Detection works poorly on short samples, and the mark is sparser wherever wording is constrained — factual statements with one correct completion, arithmetic, and code, where the post says the effect on the code itself is negligible and the watermark mostly lives in comments. Light proofreading of human text may leave too few Claude-chosen words to register. A complete rewrite removes the mark; light editing, the company says, probably will not. The post also states that a watermark says nothing about ownership, authorship, or legal responsibility for an output. Alongside text, Anthropic says files Claude produces in supported formats such as .png, .jpg, and .svg will carry C2PA content credentials — a cryptographically signed note in file metadata, part of an open industry standard, recording that Claude was involved without altering the file itself. The company says a watermark detection API is coming but that implementation details are still being worked out, and that it will provide its own tool for checking C2PA credentials. Watermarking will be applied globally at launch because, Anthropic says, it has no durable way to scope it by region. Claude models released before August 2, 2026 fall under a transition period in the EU law and are to be covered over the coming months. [Read the primary source: anthropic.com ↗](https://www.anthropic.com/news/claude-text-watermark) ## Why it matters Key-based watermarking is stronger evidence than style-based AI detectors, but it answers only a narrow question: whether one vendor's models likely touched a long enough passage. A negative result proves nothing, and the technique is weakest exactly where disputes are common — code, short text, and lightly edited human writing. Provenance has become a practical problem for schools, courts, publishers, hiring, and platform moderation, and most tools in use today are statistical detectors that infer authorship from stylistic tells — an approach with well-documented false-positive problems. A key-based watermark is a different class of evidence: the party holding the key tests for a pattern it deliberately placed rather than guessing from style. That is a real improvement in principle, but only for the narrow question it answers. The asymmetry matters for anyone tempted to use this in a disciplinary or legal setting. A positive result suggests Claude involvement; a negative result establishes nothing, because the text may have come from another model, from an older Claude model still in the transition period, from a heavily edited draft, or from a passage too short or too constrained to hold a mark. Anthropic says the watermark cannot separate "Claude wrote this" from "Claude heavily edited this." Institutions that treat a detector output as proof of misconduct would be building on a signal its own maker describes as probabilistic. The evidence behind the "no quality impact" claim is uneven in a way worth naming. Anthropic cites internal testing that has not been published, plus the SynthID-Text paper, in which DeepMind reported no statistically significant difference in thumbs-up and thumbs-down ratings when a watermarked model served a portion of Gemini traffic, and no perceived difference in a controlled side-by-side human rating study. That is genuine external evidence, but it concerns a different company's model and traffic. No measurement of watermark strength, false-positive rate, or minimum passage length has been published for Claude specifically. The regulatory mechanics also reach beyond Europe. Because Anthropic says it cannot yet scope the watermark by region, an EU transparency obligation is being met by changing outputs for users worldwide. The Code of Practice binds many providers, so comparable marks are expected from other developers, each with its own key and possibly its own method. That points toward a fragmented verification landscape: no single detector covering all models, checks running through vendor-controlled endpoints, and open-weight models — where sampling is controlled by whoever runs the model — sitting largely outside the scheme. ## What to watch next The unreleased detection API will decide whether this is usable in practice: access terms, confidence scores, false-positive tuning, and minimum text length are all unspecified. Also open: which models ship with it, how quickly pre-August 2026 models are retrofitted, and whether global application is later narrowed to the EU. The detection API is the piece that determines whether any of this is usable. Unresolved: who gets access, whether it is free or metered, what confidence scores it returns, what false-positive rate it is tuned for, and what minimum text length it requires. Those choices decide whether the watermark becomes a careful forensic aid or a blunt instrument in classrooms and HR investigations. Anthropic has given no release date. Second, coverage. The post does not identify which upcoming models carry the watermark or when they ship, and retrofitting models released before August 2, 2026 is described only as rolling out over the coming months. Until that is finished, a large volume of existing Claude output remains unmarked, and any detector will have blind spots that downstream users cannot easily reason about. Third, robustness. Researchers have repeatedly probed watermarking schemes with paraphrasing, cross-model translation, and token-level edits, and Anthropic's own account concedes a complete rewrite defeats the mark. Expect published attacks — and, once the detection API exists, independent false-positive analyses. Those results, rather than vendor documentation, will establish how much weight the signal can bear. Finally, watch whether the global application narrows. Anthropic says it will keep evaluating regional scoping and share updates. Also worth tracking: how other Code of Practice signatories implement their own marks, whether any shared verification layer emerges, and whether EU regulators issue guidance on what counts as adequate marking for code, short outputs, and lightly edited human text — the cases where this technique is weakest by design.