Anthropic deploys invisible text watermarking on Claude to comply with the EU AI Act

By Tech Desk

Published August 20, 2026 — Anthropic has become the first major AI provider to embed machine-readable watermarks into Claude-generated text, marking a notable shift in how large language models will address transparency requirements worldwide.

The European Union's AI Act entered force on August 2, 2026, mandating that all AI system providers serving its market use methods of "marking" AI-generated content. Anthropic, along with approximately 190 other signatories of the EU Code of Practice on Transparency of AI-Generated Content, is implementing text watermarking globally rather than scoping it by region — a pragmatic choice given the law's broad territorial reach and the precedent it sets for other jurisdictions considering similar rules.

"We use a method of watermarking that does not have any practical impact on the quality or content of Claude's outputs," Anthropic stated in its announcement. "The difference between watermarked and un-watermarked text will not be distinguishable to readers. Nothing is added to the text and there are no hidden characters. Watermarking doesn't require extra tokens, and will not be more expensive."

The technical implementation relies on a family of approaches first proposed by Scott Aaronson in 2022 and later adopted by Google DeepMind's SynthID-Text, published in Nature (2024). Under most LLM sampling, each word is chosen randomly from a list of probable candidates. Watermarking changes the source of that randomness: instead of an arbitrary random number generator, the model's key and the preceding words determine which word Claude picks. The result is a statistical pattern undetectable to human readers but detectable to anyone with the secret key.

How watermarking actually works

Large language models generate text one word at a time. At each step, the model evaluates a shortlist of likely next words. In cases where multiple candidates are statistically near-equivalent — such as choosing between "overcast" and "grey" to describe cold weather — the decision has traditionally been settled by a random die roll. Under watermarking, that randomness is seeded with the cryptographic key and a few words of context. The words remain random, but their sequence becomes consistent with the key. After the fact, anyone with the key can check whether the text's word choices align with Claude's watermarked sampling pattern.

The Monopoly analogy illustrates the principle: on each turn, players move a random number of spaces. Suppose instead of dice, the group uses the digits of pi, starting from a random position. To the players, the moves seem entirely random. But if an observer knows the sequence of all moves and the value of pi, they can determine whether the game likely used pi — i.e., whether it was "watermarked." For all practical purposes during the game, however, the moves are random and carry no information about the player or chat.

Related category: more AI coverage on news.jualin.id This analogy also explains why watermarking cannot be easily removed by light editing: a partial rewrite still preserves enough of the pi-digit sequence for detection, whereas a complete restart severs the connection entirely.

Beyond simple word selection, the method exploits the fact that LLMs face numerous low-stakes choices throughout generation. In many sentences, multiple near-equivalent words could convey the same meaning, and the model's choice is effectively random. By biasing these choices according to the key, watermarking accumulates a detectable pattern across hundreds or thousands of words — the more words in the sample, the higher the confidence of detection.

What watermarking does not do

Anthropic emphasizes that watermarking carries no identifying information and cannot be traced to a specific person, organization, or chat. It does not confirm whether text was human-written, nor can it detect involvement from a different AI model (even one using watermarking with a different key). Detectability improves with text length: short samples provide little information, but confidence increases as more words accumulate.

Watermarking is also sparser on factual passages where there is little arbitrariness. A sentence like "Isaac Newton's most famous work was called Principia" — where the only correct next word is "Mathematica" — offers no opportunity for the watermark to take effect. The same applies to proofreading or light editing tasks, where nearly all words originate from the source text and very few are Claude's own choices. Code presents a similar constraint: where an exact output is required — where there isn't a choice, and something would be factually wrong or a piece of code would break if a different term was chosen — the watermark isn't applied. For example, once the model has written "2 + 2 =", there is a very clear best choice for the next token (if the model is completing the sum, there isn't an answer that's equally as good as "4"; if it's talking about George Orwell's Nineteen Eighty-Four, there isn't an answer that's equally as good as "5"). The watermark only applies to decisions where either choice of a word would be equally good from a factual standpoint.

User questions and Anthropic's answers

Anthropic answered a series of anticipated questions from users and regulators alike.

Can someone edit the text to remove the watermark? To some extent, yes. Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will. In the latter case, of course, it's arguable whether the text can any longer be described as AI-generated. The watermark only applies to words Claude chooses, so if Claude proofreads text written by a person, the lightly edited output has generally only been lightly edited; because nearly all the words are the person's, there's very little (if anything) for the watermark to attach to. Depending on the length of the text and how heavily Claude has edited it, those changes might not be enough to make Claude's involvement detectable. The more Claude writes, the more decisions it has to make, and the more space there is for a watermark.

What does a watermark actually prove? A watermark can only determine that Claude was likely involved with the content at some point. It cannot distinguish "Claude wrote this" from "Claude heavily edited this."

Do watermarks apply to translations? Yes. A translation produced by Claude carries a watermark, because in this case every word is chosen by Claude.

How does this differ from AI detection software, like Pangram? AI detection software uses a different method, because the companies that provide it don't have our key. Among other things, those services look at aspects of the text like the subtle (and not-so-subtle) "tells" that often appear in AI's phrasing. For example, AI models appear to be fond of the construction "this isn't [X], it's [Y]", and use the word "quietly" a lot more than you might expect. Picking up on these patterns is fundamentally different from checking for a watermark.

Does this change who owns a given output, or who is legally responsible for it? No. A watermark only helps test whether Claude might have produced or processed the content. It doesn't say anything about ownership or authorship, and doesn't change a user's rights under our terms. We only apply the watermark when Claude was involved in processing the content or file.

What about older Claude models? The EU law includes a transition period for Anthropic models launched before August 2, 2026, and we're working to add watermarking for those models as well. This will be rolled out over the coming months.

Can't someone just edit the text to get around the watermarking? To some extent, yes. Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will. In the latter case, of course, it's arguable whether the text can any longer be described as AI-generated.

Do watermarks apply to translations? Yes. A translation produced by Claude carries a watermark, because in this case every word is chosen by Claude.

Conclusion

Anthropic's move signals that the industry is preparing for a future where AI-generated content carries machine-readable provenance — not unlike the metadata standards that have long governed photography and recorded music. Whether watermarking becomes an industry-wide default or a compliance footnote remains to be seen, but the EU AI Act has given the question urgent momentum. As with any new transparency mechanism, the true test will be in how effectively the detection APIs that Anthropic says it will soon offer work in practice, and whether other providers can match the balance between marking content and preserving output quality.

[
[
[REMOVE
Anthropic's full announcement Keywords: ai, anthropic, claude, watermark, text-marking, EU-AI-Act, synthid

Anthropic deploys invisible text watermarking on Claude to comply with the EU AI Act

How watermarking actually works

What watermarking does not do

User questions and Anthropic's answers

Related content

Conclusion