Anthropic embeds invisible watermarks in all Claude-generated content, worldwide
From 2 August 2026, all Claude models watermark generated text and attach C2PA metadata to files: globally, with no opt-out.
From 2 August 2026, every Claude model launched on or after that date embeds an imperceptible watermark in generated text and attaches digitally signed provenance metadata to generated files. Anthropic is also working to add the same marking to models released before that date. There is no opt-out, and the policy applies everywhere Claude is offered, not just in Europe.
The legal trigger was the EU AI Act. Anthropic signed the Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content, alongside Black Forest Labs, Google, Meta, Microsoft, OpenAI, and Synthesia. Article 50 covers machine-readable marking of synthetic content, and the transparency obligations took effect on 2 August 2026. Non-compliance can attract fines of up to €15 million or 3% of global annual turnover, whichever is higher.
What Anthropic chose to do beyond the minimum requirement is the more interesting part. Nothing in an EU code of practice requires marking text generated for a developer in, say, Chicago or Singapore. Anthropic applied it globally anyway, covering claude.ai, Claude Code, Claude Cowork, Claude Tag, and the API, including access through AWS, Google Cloud, and Microsoft Foundry.
Two different techniques for two different content types
Text watermarking works at the point of generation. As a supported Claude model produces a response, it subtly biases which words it selects among statistically near-equivalent options, guided by a secret key. The result reads identically to any human reader. You will not spot it, it does not change meaning or quality, and it travels with the text when you copy and paste it elsewhere. Some editing will degrade it, and asking a different AI model to rewrite the text will likely defeat it entirely, but simple copying preserves it.
One thing worth clarifying immediately: the watermark is not hidden Unicode characters or invisible spacing. Tools that strip zero-width characters will find nothing, because there is nothing of that kind present. The mark is statistical, woven into word choice itself. The underlying technique comes from research by John Kirchenbauer and colleagues at the University of Maryland in 2023.
Slices of text under 200 tokens are exempt under the Code of Practice, as shorter outputs do not carry sufficient data for a reliable signal.
File provenance uses a different approach entirely. When Claude generates a supported file type, such as an SVG, PNG, or JPG, it attaches signed metadata following the C2PA standard (Coalition for Content Provenance and Authenticity). That metadata records what model created the file, when, and whether any copyright restrictions apply. C2PA includes tamper-detection mechanisms: it hashes the metadata so edits are detectable, and can flag attempts to substitute the metadata file wholesale.
The practical limitation here is significant. C2PA metadata is relatively easy to strip. A screenshot, a format conversion, or a social media re-upload will typically remove it. Open-source removal tools already exist. Anthropic’s own documentation notes that signed provenance metadata may not be supported on every platform.
What a detected mark actually tells you
This is where a lot of the public reaction missed the point. Anthropic’s support page states clearly that a detected watermark means the text was processed by a supported Claude model. Processed, not written. That category includes proofreading, translation, summarising, and editing, not only wholesale AI authorship.
Schools and employers treating a Claude watermark as confirmation that “an AI wrote this” are making an inference the system is not designed to support. The inverse is equally important: the absence of a detected mark does not mean the content was human-written. It may simply mean the text was generated by an older Claude model not yet retrofitted with marking support, or that it was edited heavily enough to degrade the signal.
What you cannot do yet
Anthropic has said it plans to publish technical documentation so that third parties can detect Claude’s embedded text watermarks. Until that documentation arrives, no developer can build watermark detection into their own compliance pipeline. The text watermark is currently unverifiable by anyone outside Anthropic, because confirming the signal requires the secret key used during generation.
That is a meaningful gap. It means the system currently functions on trust in Anthropic’s claims about quality preservation and signal robustness, without the published specifications that would allow independent verification. The Register noted this directly in its coverage, and it is a fair observation.
C2PA detection, by contrast, is already possible through existing tools, including the Content Credentials Verify site maintained by the Content Authenticity Initiative.
It is also worth noting that steganographic watermarking of images (marks embedded within the image pixel data itself, rather than in attached metadata) has not been announced. The Code of Practice requires it for images, and Anthropic is expected to implement it, but it was not part of this announcement.
What this means if you build with Claude
If you deploy Claude through the API in your own product, the watermarking happens whether you configure it or not. Anthropic’s guidance is that developers must independently assess what Article 50 requires under EU law for their specific use case. The watermark is not a substitute for your own compliance decisions; it is one signal among several.
There is also a commercial consideration. Some businesses using Claude to generate content do not want consumers of that content to know its provenance. The watermark makes that harder, and Anthropic’s decision to apply it globally rather than only where legally required will not sit well with every customer. The backlash on social media in August 2026 came largely from people who said they use Claude only for proofreading or light editing of their own writing, and who object to that work being marked as AI-processed.
That reaction is understandable, even if the technical nuance around what “processed” means is frequently lost in the conversation. If you use Claude to clean up your own prose, the resulting text may carry a watermark. Whether that matters in practice depends entirely on who is reading it and what tools they have access to, which right now is a very small group.
The broader direction of travel
Anthropic is not alone here. OpenAI and Google had already published their own content marking approaches before this announcement. What distinguishes Anthropic’s move is the global scope applied from day one of compliance, and the explicit commitment to retrofit older models rather than treating the cut-off date as a clean break.
The combination of text watermarking and C2PA file metadata gives Claude-generated content a machine-readable identity that can survive some downstream workflows. For content platforms, media organisations, and academic institutions thinking about how to handle AI-generated material, that signal has value, even with its current limitations.
The detection tooling and technical documentation, when they arrive, will determine how useful this actually becomes in practice. Until then, the watermark exists, but only Anthropic can read it.