Anthropic starts watermarking Claude's text under the EU AI Act. The detector is still to come.

Anthropic has begun embedding an invisible watermark in text generated by Claude, and attaching a signed provenance record to the image files Claude produces. The company describes the change in its own documentation, which states that Claude models launched on or after 2 August 2026 support machine-readable marking at launch, and that the marking applies wherever Claude is offered, not only inside the European Union.

The trigger is regulatory. Anthropic has signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content. Nature reported on 13 August that providers of frontier models have had to make AI-generated output detectable since 2 August or face fines of up to 15 million euros, about 17 million US dollars, or 3 percent of global annual turnover. Models released after that date must comply immediately. Models already on the market have until 2 December.

What the mark is, and what it is not

Two different techniques are in play, and treating them as one is the easiest way to misread the announcement.

• Text. A watermarking algorithm nudges the model's word choices so that the output carries a statistically observable trace. Anthropic says the process does not change the "meaning, quality, or readability of Claude's response" and that the mark "may persist through some editing".
• Files. Generated images such as .svg, .png and .jpg receive metadata following the C2PA open standard. That is a signature attached to the file, not a property of its contents, and it can be stripped by a format conversion or a screenshot.

Anthropic's own limitations section is unusually direct about how weak the signal is in both directions. A detected mark means the content may have been processed by Claude, not that Claude wrote it. Text a person wrote and then pasted in for proofreading, translation or summarising comes back marked. An absent mark means very little either, because short passages, heavy editing, paraphrase and translation can all remove it.

There is also a gap between the commitment and the capability. Anthropic says it will support users and third parties in detecting its marks and will publish technical documentation on how. That documentation has not appeared. For now the watermark exists and nobody outside the company can read it.

What researchers are saying

Reese Richardson, a metascientist at Northwestern University, told Nature that because watermarks can be stripped easily, for instance by passing text through a different model, they are unlikely to stop people determined to produce fake or low-quality papers.

Nihar Shah, a computer scientist at Carnegie Mellon University who studies how science is evaluated, made the case for the other side: if checking tools arrive with an acceptably low false-positive rate, some illegitimate uses become detectable.

Shah has evidence for that. At the International Conference on Machine Learning in July 2026, one of two review streams distributed watermarked papers to reviewers, built so that telltale text would appear in any review report written with AI help. It caught 506 reviewers who had broken the conference's no-AI policy.

"This experience suggests that while some illegitimate AI uses may be done carefully to evade detection, many others may simply copy-paste AI outputs," Shah told Nature.

Analysis

The ICML result and the Anthropic announcement get mentioned in the same breath, and they are not the same kind of thing.

ICML marked the input, the papers it handed to reviewers, so that a reviewer who fed one to a model produced output that gave itself away. That works whichever model the reviewer reached for, and no vendor had to agree to anything. Anthropic is marking the output of one vendor's models. Run a Claude draft through a second model, or use a competitor, and the trace is gone.

So the practical reach of model-level watermarking depends less on the algorithm than on how many providers adopt it and how much effort it takes to launder the text. Neither number is known. The honest reading today is that this raises the cost of casual undisclosed use and does close to nothing about deliberate concealment. That is worth something. It is not what "AI detection" is usually taken to mean.

For anyone screening submissions, the operational point is the one that applies to every AI detector ever built: an absent mark is not evidence of human authorship, and a present one is not evidence of misconduct. Both readings are easy to make and hard to undo once acted on.

What to watch

• Whether Anthropic's detection documentation ships, and what false-positive rate it reports when it does.
• Whether other frontier providers mark their output under the same Code of Practice before the 2 December deadline for models already on the market.
• Whether any journal or conference writes model-level watermarks into an actual submission policy, rather than treating them as an informal signal.

Bizarus articles are drafted with AI assistance and reviewed by a person before publication.