Anthropic has begun watermarking the text Claude writes. The mark is invisible to readers, it is built on SynthID-Text, the method Google DeepMind described in Nature in 2024, and it is going out worldwide rather than in Europe alone — the company says it has no reliable way yet to confine it to particular regions. The reason it exists is regulatory: in July 2026 Anthropic joined other major model developers and roughly 190 organizations in signing the EU Code of Practice on transparency for AI-generated content, which requires providers to mark the text their systems produce.
The mechanism sits inside something the model already does. Claude writes one word at a time, weighing candidates for the next one against everything written so far. At many positions several candidates are equally good. After "the weather today was cold and," the word "sweet" is essentially ruled out, while "overcast" and "gray" both fit, and a random number picks between them. Watermarking keeps the choice random but changes where the randomness comes from: instead of an arbitrary generator, a key and the preceding few words drive the draw. Read the full sequence back with that key and you get a probability that Claude produced it.
Two misreadings are worth closing off. The watermark does not give Claude a verbal tic — it will not start preferring "overcast" to "gray" across the board, and may pick one in a sentence and the other in the next, exactly as before. And it never pushes the model toward a word it was not already considering, such as nubilous, an obscure synonym for both.
On quality, Anthropic says internal testing found no effect on the content, creativity or readability of Claude's answers. The SynthID-Text work reports that DeepMind ran a watermarked model across part of Gemini's live request traffic and compared thumbs-up and thumbs-down rates against the unwatermarked model, finding no statistically significant difference. In a controlled study, people shown watermarked and unwatermarked answers side by side did not see a quality gap. This is the sharpest break from what the word "watermark" normally means: a banknote or a stamped document shows its mark to the eye, and this one shows nothing at all.
The cleanest picture of the method is a game of Monopoly. Normally players roll dice and move at random. Replace the dice with the digits of pi: start at a randomly chosen position — say the 1,012,845th digit after the decimal point, which is a 6 — and let each following digit set the next move. To the players, and to the outcome, the moves still look random. But anyone who reviews the full sequence of moves afterward and knows pi can work out how likely it is that those digits drove the game. The game has been marked without being altered. The lineage here is older than SynthID-Text, which belongs to a family of methods going back to a 2022 proposal by Scott Aaronson, all sharing the same move: change only the source of randomness in the choice between words.
The limits are where this gets interesting, and Anthropic states them directly. A key answers one question — how likely is it that Claude was partly involved in writing this — and nothing else. It does not confirm that a human wrote a text, and it cannot tell you whether some other AI system did: a different model has a different key, and may use a different marking method entirely.
Short passages check poorly, because there are fewer word choices in them and so less data to analyze; confidence rises with length. Factual passages carry less of the mark, because they offer fewer substitutions that survive being correct. After "Isaac Newton's best-known work was called Principia," the next word has to be "Mathematica," and there is nothing there for the watermark to act on. The same holds for proofreading: ask Claude to fix only grammar and punctuation and the mark can surface in a handful of corrections, which may not be enough to detect. The watermark applies only to words Claude chose, so on human text that is lightly edited there is almost nothing to mark.
Exact outputs are excluded by design. Where an alternative would be factually wrong or would break code, no nudge is applied. After "2 + 2 =" the obvious next token is "4"; inside a discussion of George Orwell's 1984, it is "5". Neither position has a second option of equal value. Code therefore carries less marking than other text, since much of it has to be exact, though comments and other free choices inside a file can still pick it up, with negligible effect on what executes.
The operational costs are small. The watermark produces no additional tokens, so serving and usage prices are unchanged and speed is barely affected. It identifies no one: neither the mark nor the key contains anything from which a user, their organization or their conversation with Claude could be reconstructed.
Files get a different treatment. When Claude produces a supported type — .png, .jpg, .svg — a cryptographically signed provenance record will be written into the metadata, using C2PA, the open industry standard camera makers and photo editors already use to record where an image came from. Any C2PA-capable tool can read it, and Anthropic will run its own service where a file can be uploaded and checked. That record is not a watermark: the file's content is unchanged and nothing is hidden inside it. As with text, it points only to Claude's involvement and carries no identifying data.
Removal is a matter of degree. Partial editing will probably not strip the mark; rewriting a text so that every word is replaced will, and at that point, Anthropic notes, it becomes arguable whether the result is still AI-generated. What remains is a probability that Claude was involved — the method does not separate "Claude wrote this" from "Claude edited it substantially." A translation Claude performs does carry the mark, because there every word is the model's choice. Models released before August 2, 2026 fall under a transitional period in EU law; Anthropic says it is preparing watermarking for them and plans to ship it within the coming months.
This is a different thing from the AI-text detectors already on the market, which have no Anthropic key and instead hunt for stylistic tells — models lean on constructions like "this is not [X], it is [Y]" and use the word "quietly" noticeably more often than expected. That is pattern-matching on style. A watermark check is arithmetic against a key. And neither says anything about ownership or authorship; Anthropic is explicit that the mark does not alter a user's rights under its terms.
Read the limitations as a single list and a pattern shows through. The watermark is weakest precisely where demand for detection is strongest: the essay a student wrote and had Claude tighten, the short paragraph pasted into an email, the corrected homework, the code file. Each of those is low-signal by the method's own design. What it catches reliably is long stretches of prose Claude generated unaided — which is also the material a reader is most likely to recognize without any key at all. The obligation in the EU code is met. The contested cases are the ones left out.
Notably absent from the announcement is a single number. No detection rate, no false-positive rate, no minimum length at which a check becomes meaningful, no threshold for what counts as "probably Claude." "Shorter texts work worse" is a direction, not a specification, and an institution deciding whether to act on a result needs the specification. The detection API — the piece that would let a university, a publisher or a regulator run the check themselves — is not shipped; Anthropic says the implementation details are still being worked out. Until it arrives, the only party that can read the mark is the party that holds the key.
The watermark was one of several things Anthropic put out. The company opened a research preview of the Model Hardware Standard, a common specification intended to let AI agents work safely with physical devices, with access going first to research laboratories and leading manufacturers. It began offering Claude free to 10,000 scientists worldwide: verified research leads receive a Claude Team plan and can then add their research team on standard seats at no cost, with premium seats at $15 a month for up to a year. And it launched a $5 million grant program for independent research into AI's effect on user wellbeing.
The strength of the mark is proportional to how much of a text Claude actually wrote, which means the case that prompted the rule — a person passing model output off as their own — is also the case a rewrite pass defeats. Anthropic's answer is that a fully rewritten text is arguably no longer AI-generated. That is a defensible claim about the text. It is a much weaker one about the person, and the obligation Anthropic signed in July is written about text.