Every piece of text Claude generates now carries an invisible mark. Since August 2, Anthropic has been embedding a statistical watermark into Claude’s output — across the API, Claude.ai, Claude Code, and cloud integrations on AWS, GCP, and Azure. The mechanism is subtle enough that you’ll never notice it reading the text. The compliance implication it creates, however, is one most coverage is glossing over: Anthropic’s compliance doesn’t cover yours.
What Triggered This #
The EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content officially took effect on August 2, 2026. It requires providers of generative AI systems to make synthetic outputs machine-detectable as AI-produced – across all modalities: text, images, audio, and video. Roughly 190 organizations signed the Code of Practice by end of July, including Google, OpenAI, Meta, Microsoft, Mistral, and Cohere. The penalties for ignoring it: up to 15 million euros or 3% of global annual turnover, whichever is higher.
Anthropic signed the Code and went live with watermarking on the same day the obligations kicked in. Notably, it applied the marking globally, not just to EU users – a deliberate choice that avoids complex geographic gating and signals that Anthropic considers this the right baseline, not just regulatory hygiene. The Next Web reported that new Claude models launched from August 2 support marking at the model level.
How the Claude Watermark Works #
The text watermark uses a technique developed by John Kirchenbauer and colleagues at the University of Maryland in 2023. At each decoding step, a secret key held by Anthropic – combined with a window of previously generated tokens – partitions Claude’s vocabulary into green and red tokens. Green token logits get a small upward nudge before sampling, making them slightly more likely to appear. Individual word choices look completely unremarkable. Across 100 or more tokens, the pattern becomes statistically detectable.
Two details worth noting: the model itself has no idea this is happening, since the mechanism runs below the model in the sampling pipeline. And the nudge only applies where near-equivalent alternatives exist, so output quality is unaffected. Short responses under about 100 tokens do not carry a reliable signal at all.
For files, Claude attaches C2PA-compliant cryptographically signed provenance metadata: a tamper-evident manifest recording what tool produced the content, which model, and what edits occurred. The limitation: most social platforms, image editors, and screenshot tools strip C2PA metadata on export.
The Part Most Coverage Is Missing #
Here is the thing to understand clearly: Anthropic being compliant does not make you compliant.
Anthropic’s official guidance states that developers using Claude in products must independently assess the transparency requirements that apply to their services under Article 50. As a deploying organisation building on top of Claude, you have separate Article 50 obligations – potentially including disclosing to your end users that content is AI-generated, implementing UI-level transparency, or maintaining your own detection pipeline. Anthropic holding up their end does not satisfy yours.
If any of your products serve users in the EU and use Claude under the hood, this needs an audit now, not when the first enforcement action arrives.
The Detection API Problem #
The EU Code of Practice requires providers to expose detection APIs for third-party use. Anthropic has confirmed a text detection API is coming but has not shipped it yet. When it does, it will create a structural tension worth understanding: a working detector is also a perfect evasion oracle.
A tool already dubbed Four Cents strips Claude watermarks by running one paraphrase pass through a cheaper model – cost: approximately $0.04 per 1,000-word article. A July 2026 forensic study across 846 runs found that one paraphrase pass removes KGW-style watermarks at 100%, and SynthID-Text at 98.3%. CMU researchers have formally described this as no free lunch in LLM watermarking – the evasion oracle problem is structural, not a bug Anthropic can patch. The regulation’s own requirements create the attack surface.
What the Mark Proves and Does Not #
The watermark proves that Claude processed the text. That is it. It does not prove Claude authored it – a user could paste in human-written text, ask Claude to lightly rephrase it, and the output carries the mark. It does not mean the content is accurate. It does not survive heavy editing; enough manual rewrites degrade the statistical signal. Treat it as a provenance signal, not an authorship certificate, and certainly not a quality or accuracy guarantee.
What Developers Should Do Now #
For developers building on Claude, four concrete steps: Audit your EU exposure. Which of your products or user bases fall under EU jurisdiction? Article 50 applies to you as a deploying organisation, not just Anthropic as the provider.Review your terms of service and disclosure language. Are you telling users when content is AI-generated? If not, that is likely a compliance gap.Do not strip watermarks. The EU Code of Practice explicitly prohibits this. Attempting to remove Anthropic’s markings adds Article 50 risk, not just technical trouble.Watch for the detection API. When Anthropic ships text detection, integrate it into your content verification pipeline if you need to audit Claude-generated content in your systems.
The watermark robustness debate – whether it can be reliably evaded – is almost academic for most builders. The evasion-oracle problem is inherent to the regulation’s design. The compliance gap, on the other hand, is something developers can and should address now.