Anthropic has started marking Claude’s output. Text generated by the model now carries an imperceptible, machine-readable watermark, and generated files in supported formats carry signed provenance metadata built on the C2PA standard.

The trigger is Article 50 of the EU AI Act, whose transparency obligations attached on August 2, 2026 — the same date the high-risk regime partially came into force. The scope is not limited to the EU. Anthropic’s documentation states that marking applies to output from supported models wherever Claude is offered, worldwide.

Here is what it actually does, what it does not do, and why the caveats matter more than the feature.

The two mechanisms

They are different technologies solving different halves of the problem, and conflating them produces most of the confusion in the coverage.

Text watermarking. An imperceptible signal embedded directly in the generated text. Anthropic states it does not change the response’s meaning, quality, or readability. It survives copy-paste and may persist through some editing.

The general technique in the literature works by biasing token selection during generation — at each step, the model’s sampling is nudged toward a pseudo-randomly selected subset of acceptable next tokens, keyed by a secret. Across enough tokens, the statistical skew becomes detectable by anyone holding the key, while remaining invisible to a reader because every individual choice was a legitimate one. The output is fluent because the bias operates within the space of good continuations, not against it.

C2PA provenance metadata. For supported file types — SVG, PNG, JPG — Claude attaches cryptographically signed metadata following the Coalition for Content Provenance and Authenticity open standard. This is not statistical inference; it is a signature. It either verifies or it does not.

Coverage

Per Anthropic’s documentation, marking applies across the Claude API, Claude, Claude Code, Claude Cowork, and Claude Tag, plus cloud partner deployments on AWS, Google Cloud, and Microsoft Foundry.

Models launched in the EU on or after August 2, 2026 support marking at launch. Existing models are being brought in during a transition period.

The API inclusion is the significant part. This is not a consumer-product feature; it applies to output that developers pipe into their own applications.

The caveats, which Anthropic states plainly

Give the company credit for this, because the industry norm has been to oversell detection: Anthropic’s own documentation is unusually forthright about the limits.

A detected mark means the content may have been processed by Claude. It does not prove Claude authored it.

This distinction is doing enormous work. If you paste your own writing into Claude and ask it to fix the grammar, the output is marked — and it is substantially your writing. The mark records that text passed through the system, not that the system originated the ideas. “Processing” and “authorship” are not the same thing, and the watermark cannot distinguish them.

The absence of a mark establishes nothing. No watermark does not mean human-written. It could be another model, an older model, a heavily edited output, or text that went through a translation pass.

Marks degrade. Anthropic lists the failure modes: heavy editing, translation, or format conversion can strip marks, and short passages may lack sufficient text for reliable detection. That last one is a hard mathematical limit, not an engineering gap — statistical watermarking requires a sample size. A tweet does not have one.

Detection tooling is forthcoming. Anthropic says it will support users and third parties in detecting the marks via technical documentation to come. It is not fully available yet.

Where this goes wrong in practice

The technology is honest about itself. The people who will deploy it mostly will not be.

Academic misconduct. Within a semester, someone will build a plagiarism-detector integration that flags student work as AI-generated based on a watermark hit. A student who used Claude to fix comma splices in an essay they wrote themselves will be accused of cheating on evidence that, read correctly, shows only that text touched the service. Educational institutions have an established record of treating probabilistic AI-detection output as dispositive — the previous generation of detectors, which had no watermark and worked on perplexity heuristics alone, produced a documented pattern of false accusations that fell hardest on non-native English speakers. A watermark is far more reliable than those tools, which makes it more likely to be treated as proof, which makes the authorship-versus-processing gap more dangerous rather than less.

The asymmetry problem. Anthropic marks its output. Whether every competitor does, and whether open-weight models running on someone’s own hardware ever will, is a different question — a watermark implemented in the sampling layer of a model you control is a watermark you can remove. So the honest actors’ output becomes labeled and the rest does not, and “unmarked” gradually reads as “human” to people who do not understand the system. That inference is exactly backwards, and it is the failure mode most likely to actually hurt someone.

Employment and platform enforcement. The same misreading, applied by an employer to a report, or by a platform to a submission, with no appeal process and no understanding of what the signal means.

The privacy question nobody is asking

Here is the part relevant to this blog, and it is not the obvious one.

A watermark makes text attributable, and attribution is the thing anonymity depends on not having.

Consider a person using an AI assistant to help draft something they need to publish anonymously: a whistleblower complaint, a piece of political dissent under a hostile government, a description of abuse, a coming-out letter. That text now carries a signal saying it was processed by a specific commercial service.

What that signal enables depends entirely on what the detection key permits, and this is the design question that matters:

  • If the watermark is detectable but not decodable — it says “Claude touched this” and nothing more — the anonymity exposure is modest. It narrows the authorship pool to everyone who uses Claude, which is not a narrow pool.
  • If the watermark encodes anything session-, account-, or time-specific, it is an identifier attached to text the author intended to be unattributable, and that is a categorically different object.

Nothing in Anthropic’s public documentation suggests the second design. The description is consistent with a single global marking scheme rather than per-user keying. But the documentation also does not address whether marking can be disabled, and it does not carry an explicit statement about what detection requests reveal or whether they are logged.

Those are the two questions worth pressing on, and they are answerable without revealing anything that would weaken the watermark:

  1. Does the mark encode any per-user or per-session information? (The security-relevant answer is no, and if it is no, say so unambiguously.)
  2. When a third party runs detection, what is logged, and does Anthropic learn what text was checked? A detection service that receives submitted text is a service that receives text — including, potentially, the private document an employer is checking on an employee.

The second one is the sleeper. Content-authenticity infrastructure is, structurally, a system that people voluntarily feed sensitive documents into.

The C2PA half is better

The file provenance piece deserves more attention than it is getting, because it does not have any of these problems.

C2PA is a signature, not an inference. It says “this file was produced by this issuer at this time,” it verifies cryptographically, and it fails cleanly — a stripped or altered manifest does not verify, and nobody is left interpreting a probability. It is supported by an industry coalition spanning camera manufacturers, Adobe, and the major platforms, which means it composes: a photo can carry a chain from capture device through editing tools through publication.

The limitation is equally clean. C2PA metadata is trivially removable. Screenshot the image, re-encode it, run it through any tool that strips metadata, and the manifest is gone. It is a system for proving provenance when someone wants to prove it, not for catching someone who does not.

That is a modest claim, and modest claims are the ones that survive.

What to actually do with this

  1. If you are an educator or an employer: do not treat a watermark hit as proof of authorship. Anthropic says explicitly it is not. Read the vendor documentation of any detection tool you buy, and if it claims more certainty than Anthropic’s own docs do, the tool is lying.

  2. If you are accused on this evidence, cite the source. Anthropic’s help documentation states that a detected mark indicates content may have been processed by Claude, and that absence of a mark establishes nothing. That is the strongest exculpatory document available and it comes from the company that built the watermark.

  3. If you need genuine anonymity, do not route the text through a commercial AI service. This was already true — logs, retention, and legal process were always the bigger exposure — but the watermark makes the artifact itself carry a signal. Write it yourself, on a machine you control.

  4. Retype rather than paste if you have used an assistant and the marking is not something you want carried into a document. Marks degrade with heavy editing and do not survive being manually re-entered. This is not a subversion technique; it is a reasonable thing to do with text you consider yours.

  5. Watch for the detection tooling and how it is gated. Who gets a key, and what a detection query logs, will determine whether this is a transparency feature or a surveillance surface.

The pattern

Article 50 of the AI Act asked for machine-readable marking of synthetic content, and it asked for a reasonable thing. Anthropic implemented it, applied it beyond the jurisdiction that required it, and documented its limits more honestly than the market usually documents anything.

And it will still be misused, because the gap between what the system says — this text may have passed through a service — and what people want it to say — a human did not write this — is not a gap any watermark can close. It is a question about authorship, and authorship is not a property that lives in the text.

The EU asked for a label. What arrived is a label that is accurate, global, honest about its error modes, and going to get somebody expelled anyway.