The EU’s new AI transparency rules are pushing model providers to mark generated text at the moment of creation. And frontier model companies are responding: as of August 2, Claude-generated text is going to carry something its readers cannot see: a statistical signal woven into the words as the model produces them.

Anthropic says supported Claude models will embed imperceptible watermarks in generated text. Generated files, including supported image and SVG formats, will use a separate system of digitally signed provenance metadata. The change applies across Claude, Claude Code, Claude Cowork, Anthropic’s API and supported cloud platforms.

The immediate driver is the European Union’s AI Act. Its implications will extend far beyond Europe.

Why is this happening now?

Article 50 of the EU AI Act began applying on August 2, 2026. It requires providers of systems that generate synthetic text, images, audio or video to make their output machine-readable and detectable as artificially generated or manipulated.

The distinction between the law and the accompanying Code of Practice is important. The EU Code of Practice on Transparency of AI-Generated Content is voluntary. The transparency requirements in Article 50 are legal obligations. Companies may decline to sign the Code, but they must then demonstrate that their alternative compliance measures are adequate.

The requirements are already in effect for new systems. Providers of AI systems that were on the market before August 2 have a limited transition period, until December 2, 2026, for the marking and detection requirement. Content generated before August 2 does not need to be labelled retroactively. According to the European Commission’s Article 50 guidance, violations can attract fines of up to €15 million or 3% of the company’s worldwide annual turnover.

Anthropic has committed to supporting machine-readable marking in Claude models launched in the EU on or after August 2. Marks from supported models will be applied worldwide, wherever Claude is offered. Anthropic is still adding support to models released before the deadline. This means that not every piece of Claude-generated text necessarily contains a watermark today. Anthropic will publish additional technical and detection documentation as implementation expands.

Google has already deployed text watermarking. Its SynthID-Text system has been used in Gemini responses and is available to developers. OpenAI has researched text watermarking and has publicly described its limitations, but its current provenance documentation confirms SynthID for supported images and audio rather than active watermarking of ChatGPT text.

What is a text watermark?

A text watermark is not a faint logo, (unlike our illustration) a hidden Unicode character or a permanent list of suspicious words. It is a statistical pattern created through the model’s word choices and it happens during inference.

When a language model writes, it predicts a range of possible next tokens. A token may be a whole word, part of a word or a piece of punctuation. After the phrase “the company announced a major,” for example, the model might assign different probabilities to change, shift, revision and overhaul.

A watermarking system adds several elements to that normal generation process:

1. A secret key. The provider maintains a private cryptographic key or configuration.

2. A context calculation. The key and a short portion of the preceding text generate a pseudorandom score for possible next tokens.

3. A modified sampling process. The model slightly favours some acceptable tokens over others. In a simplified system, the vocabulary can be divided into “green” and “red” candidates, with green candidates receiving a probability boost.

4. Repeated embedding. A new set of scores is generated at every step, so the favoured words continually change. A word that is favoured in one sentence may be unfavoured in another.

5. A detector. The provider can later use the secret configuration and the text’s preceding context to reconstruct the expected pattern and calculate how closely the actual token choices follow it.

One favoured word proves nothing. A long passage containing a persistent bias can provide strong statistical evidence.

Suppose unmarked text would select a green token 50% of the time. In a 400-token passage, approximately 200 green selections would be expected by chance. If the passage contains 240, that accumulated difference may be statistically unlikely enough to support a positive watermark result. A real detector uses a more sophisticated score and must account for repeated phrases, text length, token dependence and the amount of choice the model had at each step.

Google’s production-oriented SynthID-Text uses a more sophisticated sampling system rather than a simple red-versus-green vocabulary split. The underlying principle remains the same: the generation process creates a secret, context-dependent correlation between the token sequence and a watermark key.

Where and when does watermarking happen?

For the production-oriented systems described publicly so far, the watermark is usually added during inference: the stage when a trained model is generating an answer. It is generally not inserted during pre-training and does not require changing the model’s underlying weights.

The sequence looks like this:

1. The prompt and the text generated so far enter the trained model.
2. The model calculates its normal probabilities for the next token. These raw scores are called logits.
3. Ordinary generation controls, such as temperature, top-k and top-p, narrow or reshape the available choices.
4. A watermarking component uses the private key and recent token context to score or slightly reweight the remaining candidates.
5. The sampler chooses the next token from that adjusted distribution and streams it to the user.
6. The process repeats for every subsequent token.

Google describes SynthID-Text as a “logits processor” placed in the generation pipeline after top-k and top-p processing. It requires no additional model training; the watermark configuration is activated when the model’s generation function runs. This placement also explains how watermarking can work with streamed output: each token can be marked immediately before it is released.

Anthropic says Claude’s text watermark will operate “at the model level,” ensuring that it appears across Claude products, APIs and supported cloud platforms. That phrase should not be interpreted as confirmation that the mark is learned during pre-training. Anthropic has not yet disclosed Claude’s precise implementation. A generation-time or inference-time system is the most plausible explanation based on the company’s description and current production practice, although this remains an inference until Anthropic releases its technical documentation.

Other types of text watermarking do exist:

Stage	Method	Typical purpose and relevance
Pre-training or fine-tuning	Data-driven watermarking teaches the model special trigger-response patterns	Usually used to identify copied model weights or unauthorized model extraction. There is no public evidence that this is how Claude’s Article 50 text mark works.
Inference and token sampling	Generative watermarking modifies the selection of each next token	The leading production approach for ordinary text provenance and the most likely family of method for Claude.
After generation	Edit-based systems replace synonyms, alter formatting or insert hidden characters	Easier to add, but often easier to notice or remove. Anthropic instead uses signed C2PA metadata for supported files.

Training-level watermarking is therefore possible, but it solves a somewhat different problem. It can help prove that another company copied a model or its training process. The EU requirement concerns the provenance of individual outputs, making generation-time marking more practical. It can be switched on for particular models, updated without retraining and paired with rotating secret keys.

Will watermarking reduce writing quality?

Watermarking uses some of the model’s freedom to choose among plausible next words/tokens. A crude or aggressively configured watermark can therefore create a trade-off between detectability, quality and diversity. A stronger statistical signal gives the model less freedom to make its preferred selection.

Production systems are designed to make that effect extremely difficult for readers to notice. Some methods are described as non-distortionary because, when their behaviour is averaged across secret keys or seeds, they preserve the model’s original probability distribution. Individual responses are still steered, while the overall distribution remains substantially unchanged.

Google tested SynthID-Text in a live experiment involving nearly 20 million watermarked and unwatermarked Gemini responses. Its peer-reviewed study in Nature found no statistically significant difference in thumbs-up or thumbs-down rates. A separate controlled evaluation also found no significant difference in grammar, coherence, relevance, correctness, helpfulness or overall quality.

That result does not establish that every watermark is quality-neutral in every setting. Anthropic says its watermark will not change Claude’s meaning, quality or readability, although the company has not yet published the technical implementation or a comparable quality evaluation.

The greatest technical difficulty occurs when the model has very little freedom. There are many ways to write marketing content. There may be only one correct way to provide an exact quotation, number, equation or piece of code. Short and predictable outputs contain less room for a statistical signal.

In those cases, a responsible system should allow the watermark to become weaker rather than encourage an incorrect or broken answer. Business users should therefore expect lower detection confidence for:

● short responses;

● facts, equations and exact quotations;

● low-temperature or highly deterministic output;

● code and structured data;

● text that has been extensively edited, translated or mixed with other material.

Watermarking may also modestly reduce variation across repeated responses even when average quality remains stable. Organizations with tightly controlled terminology, regulated language or a distinctive brand voice should test output again when a provider activates marking or introduces a newly watermarked model.

How is the watermark detected?

Detection does not necessarily require another general-purpose AI model. A watermark detector can be a relatively compact statistical verifier that knows the secret watermark configuration. It does not ask an LLM whether the passage “sounds like AI.” It tests whether the token sequence contains the precise correlation that the generator was designed to create.

The detector ordinarily performs five operations:

1. Retokenize the passage. It converts the submitted text into tokens using the same tokenizer or a compatible one.
2. Reconstruct each watermark challenge. For every eligible token, it combines the preceding token window with the secret key to recreate the scores or favoured candidates that existed during generation.
3. Score the actual choices. It checks whether the token appearing in the passage received the kind of high watermark score expected from marked generation.
4. Aggregate the evidence. It combines hundreds of individually weak token-level observations into a statistical score.
5. Apply decision thresholds. The result may be watermarked, not watermarked or uncertain, depending on the score and the provider’s chosen tolerance for false positives and false negatives.

Google’s SynthID-Text implementation provides a Bayesian detector, while simpler green-list systems can use a conventional z-score or hypothesis test. Some detection components use machine-learning techniques, so they can reasonably be called AI systems in a broad sense. They don’t need the original frontier model, access to its weights or an understanding of the passage’s meaning. Google’s published technical study describes detection as measuring the correlation between the observed tokens, the recent context and the watermark key.

The secret key does not have to be given to every organization that wants to check a passage. A provider can retain the detector privately and offer a verification API: a customer submits text, the provider runs the keyed test and returns the result. It can also release a detector publicly or reserve detection for approved institutions. Anthropic has promised to enable users and third parties to detect Claude’s marks, but says the specific detection mechanism is still forthcoming.

This is also where watermark detection differs from services like Pangram. Pangram can independently estimate whether writing resembles AI output. It cannot recreate Claude’s secret token-level watermark without access to Anthropic’s detector, key or verification service. Once Anthropic supplies one, a system such as Pangram could call that service and combine the watermark result with its existing classifier as a second, independent signal.

What can a watermark establish?

A detected Claude watermark would indicate that the text was processed by a supported Claude model. Its evidentiary value stops there.

Claude may have written the passage from scratch. It may also have proofread human writing, translated it, summarized it or reformatted it. The watermark does not establish who originated the ideas, who entered the prompt, whether the facts are correct or how much human work followed.

The absence of a detectable watermark is equally limited. The text may have come from an older or unsupported model. It may be too short to test. It may have been translated, heavily paraphrased or combined with human writing. It may have been generated by another system with no compatible watermark.

Anthropic has not said that its ordinary text watermark will identify an individual user or account. Businesses should not interpret a provider-level provenance signal as an employee-tracking mechanism unless a provider explicitly introduces that capability and discloses how it works.

How businesses could use watermark detection

Machine-readable marking can become one component of several business processes:

● Content provenance: Publishers and platforms can determine whether a supported AI system processed submitted text.

● Moderation and spam control: Services can use watermark evidence to classify high-volume synthetic submissions.

● AI governance: Companies can audit whether approved models are being used in regulated or sensitive workflows.

● Vendor management: Buyers can test claims that deliverables were created without generative AI or with an approved provider.

● Education and recruitment: Institutions can identify work that may require further examination, provided the result is never treated as proof by itself.

● Regulatory compliance: Providers and deployers can retain machine-readable signals alongside public labels, editorial records and system logs.

Watermarks are also vulnerable to deliberate removal. Intensive paraphrasing, translation and human substitution can replace enough token choices to erase the statistical pattern. Research including Watermarks in the Sand has demonstrated removal attacks, while watermark-stealing research has shown that attackers may approximate some schemes by repeatedly querying a model or detector. That can allow them to scrub a real watermark or plant a misleading one.

The technology is most useful against ordinary, unmodified use at scale. It raises the effort required to conceal provenance. It does not prevent a determined person from laundering text through another model or rewriting it substantially.

Watermark detectors and systems such as Pangram answer different questions

Pangram, GPTZero and similar products are generally described as AI-writing classifiers. They look for patterns the detector has learned from collections of human and machine-generated writing. They do not need the generator’s secret watermark key.

According to Pangram’s published methodology, its classifier was initially trained on approximately one million human and AI-generated documents and then refined using difficult false-positive examples. Pangram has also stated explicitly that it analyzes linguistic and structural patterns rather than hidden watermark codes.

Watermark detector	Generic AI-writing detector
Looks for a deliberately implanted, keyed statistical signal	Infers origin from structural, stylistic and semantic patterns
Usually detects output from a participating provider	Attempts to detect text from many models, including unwatermarked systems
Can provide provider-specific provenance when the mark remains intact	Usually cannot establish which provider generated the text with certainty
Becomes weaker when text is extensively rewritten	Can sometimes continue detecting rewritten text, but is also vulnerable to evasion and distribution shifts
Produces false positives and false negatives according to its statistical threshold	Produces false positives and false negatives according to its training data and calibration
Best used as direct evidence that a supported system processed the text	Best used as a screening signal that prompts further review

Pangram would not automatically recognize Claude’s secret watermark unless Anthropic provides a detector, verification API or compatible technical standard. Pangram could eventually incorporate an Anthropic verification result as an additional signal. Its existing classifier would continue operating independently and might identify AI-like writing after a watermark had been removed.

That independence does not make a generic detector conclusive. A company’s published accuracy reflects particular datasets, thresholds and testing conditions. Performance can change with new models, unfamiliar subject matter, short passages, non-native writing and adversarial editing. Neither class of detector should be used alone to accuse an employee, reject a candidate, cancel a contract or discipline a student.

The business-user obligations vs the provider obligations

Article 50 places the machine-readable marking obligation primarily on AI providers. It also creates disclosure duties for organizations that deploy AI-generated deepfakes and certain public-interest material.

For text, the EU disclosure requirement applies when AI-generated or manipulated material is published to inform the public on matters of public interest. The Commission includes economic, financial, political, scientific and cultural developments among the potentially covered subjects.

Substantive human review creates an important exemption. Public-interest text that has undergone meaningful human review or editorial control and is subject to human editorial responsibility doesn’t need the same AI-generated label. A spelling or grammar check is insufficient. The review will fact check, examine substance, sources and accuracy, with an editor holding authority to approve, alter or reject the content and accepting ultimate responsibility for publication.

For a news publisher, research company or regulated communications team, a documented editorial process now has compliance value in addition to its existing editorial QA value.

What business users should do now

1. Inventory models and access routes. Record which models employees use through chat products, APIs and cloud platforms. Marking support may vary by model version, feature, file type and provider.

2. Separate AI generation from AI assistance. Define what the organization means by drafting, editing, translation, summarization and substantive human authorship. A watermark can be present after relatively limited AI processing.

3. Retain the production record. Keep prompts, original outputs, model names, dates, revisions, source material and document history for important work. This evidence is more informative than a detector score alone.

4. Assign a responsible human editor. For public-interest publications, document who checked the facts and sources, who had authority to change or reject the text and who accepted editorial responsibility.

5. Update vendor and freelancer contracts. Specify permitted AI tools, disclosure expectations, record-retention requirements and the consequences of inaccurate provenance claims. Avoid defining “no AI” solely as “no detectable watermark.”

6. Treat detector results as triage. A positive result should initiate a review. It should not automatically trigger discipline, rejection or a public allegation.

7. Test quality-sensitive workflows. Compare marked and unmarked model versions, where available, on brand voice, legal language, code, structured output and factual precision.

8. Do not confuse embedded marking with visible disclosure. A hidden machine-readable signal may help a platform or regulator detect AI processing. It may not satisfy every obligation to tell a reader that content was generated or manipulated by AI.

9. Use several provenance signals together. Combine watermarks with signed metadata, model logs, document history, human review records and clear disclosure policies.

A provenance signal, not an authorship verdict

Text watermarking changes AI output before it leaves the model. For most ordinary business writing, a well-designed implementation should have little or no perceptible effect on quality. The larger change is procedural: generated text may now carry evidence of the system that processed it, even after it has been copied into another application.

That evidence has defined limits. A detected mark does not prove that Claude originated the underlying work. An undetected mark doesn’t prove human authorship. Extensive rewriting can remove the signal, while routine proofreading or translation can cause human-originated material to acquire one.

Businesses should treat watermarking as one layer in a verification and QA system. Reliable decisions will still require records, context, human review and accountable editorial judgment.