Anthropic said on 14 August that future Claude models will generate watermarked text, a change it is making along with several other major providers to comply with the EU AI Act. Anthropic’s example is a half-finished sentence: “The weather today was cold and…”. Two words finish it about equally well, overcast and grey, the sentence means much the same either way, and since nothing in it settles which one arrives, the choice falls to a random number drawn at the end of the same sampling step that temperature and top-p act on.
That random number is the part watermarking replaces. The model instead derives it from a key and the few words immediately preceding, so the key and that run-up together settle which candidate arrives. Someone with the key can then check the finished sequence against what it would have produced. But to a reader the choice is still random. The model is not left generally biased toward overcast or toward grey either, since which one turns up still depends on the words that came before.
The other example is a sentence with nothing spare in it: “Isaac Newton’s most famous work was called Principia…”. Mathematica is the only right answer. Nothing there is free for the watermark to act on. How much watermark a passage carries comes down to two things: how many of the words Claude picked, and how free each of those picks was. The more of both, the more there is to find.
Text with only one right answer
The watermark runs sparser through factual passages, where accuracy leaves fewer choices free. What makes a given choice constrained is the surrounding context. Once the model has written “2 + 2 =”, there is no answer equally as good as 4 if it is completing the sum, and none equally as good as 5 if the subject is George Orwell’s Nineteen Eighty-Four. The nudge of the watermark is not applied in either case.
Code has to be exact most of the time, so it sits at that end of the range: where a different term would make the output factually wrong or break the code, the watermark is not applied, and code carries generally less of it than other kinds of text. But what stays open is the prose inside a file: “in areas where there is an arbitrary choice between particular words or terms within the code, the watermark can be used, such as comments within code.” Whatever lands there barely changes the code.
Words Claude chose
The other condition is a count. “The watermark only applies to words Claude chooses.” Detection also works poorly on small samples, because there are fewer word choices in them to read, and a paragraph offers more places for the pattern to show up than a sentence does.
Hand Claude a finished piece of writing and ask it to fix grammar and punctuation and nothing else, and the corrections are all it has to work with, which may be too few to register. How much registers, though, depends on how heavy the edit was and on how long the text is, because the more Claude writes, the more decisions it makes, and the more room there is for a mark.
Translation runs the other way, and it separates the two conditions. The source text fixes what the output has to mean while leaving open which words carry that meaning, and there are usually several that would, so every word in the output ends up being one Claude picked. That is why a translation carries a watermark.
Someone wanting the mark gone has to take the words back. “Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will.” But by then it is arguable whether the text can be described as AI-generated at all.
What it does not change
Nothing is added to the text and there are no hidden characters. No extra tokens are produced, so the model costs the same to serve and to use. The impact on model speed is negligible. Nothing in the mark or its key identifies a person, an organization, or a chat.
On output quality Anthropic says it saw “no impact of watermarking on the content, level of creativity, or readability of Claude’s text” in internal testing. The method is older than this announcement: it is a version of SynthID-Text, published by Google DeepMind in Nature in 2024, and part of a family going back to a proposal by Scott Aaronson in 2022. That paper puts the change in the same place: a method that “does not affect LLM training and modifies only the sampling procedure”. On standard benchmarks and in human side-by-side ratings the paper reports no change in the models’ capabilities. The authors also ran the watermark live on Gemini and gathered feedback on nearly 20 million responses. They read that as confirming text quality held up.
What a result would say
A long piece of prose Claude wrote from a short instruction runs high on both counts. A source file runs low on freedom, a light proofread runs low on the count, and both come out thin. But between them sits the wide middle where most real documents land. A draft you sketched and Claude filled out, or a Claude draft you rewrote half of, is the ordinary case, and it is the case a check says least about: a watermark “can only determine that Claude was likely involved with the content at some point”, and it cannot tell “Claude wrote this” from “Claude heavily edited this.”
Nobody outside Anthropic can run that check today. Anthropic says it will offer a detection API soon and is still working out how to implement it. Models launched before 2 August 2026 fall under a transition period in the EU law. Anthropic says watermarking will be added to them over the coming months. Until the API ships nobody can answer that question about a specific document, whether it is one you received or one Claude wrote for you.
The above is Anthropic’s own account of a method I have no way to test from outside, read alongside the SynthID-Text paper it points to. Both pages were read on 25 August 2026. The part I would want from the detection API, when it arrives, is what it says about a document a person and a model wrote together, because that is where most working documents sit and where this method is thinnest by its own account.
