On August 11, 2026 Anthropic announced that the text generated by its models will carry a watermark: an invisible filigree that cannot be seen by rereading and cannot be found by searching the file, but that, with the right key, makes it possible to estimate whether a text passed through Claude. The rule applies to models released from August 2, 2026 onward, which at the date of the announcement means models yet to come; those already in circulation will be brought in line over the following months. It applies worldwide, not only in Europe. The company states that the quality of the responses does not change, and promises an API through which anyone will be able to query the watermark.
The date was not Anthropic's choice. August 2, 2026 is the day Article 50 of the European regulation on artificial intelligence, the AI Act, became applicable. To understand what this watermark is, and what it can actually tell a reader, that is the place to start.
What the rule asks
Article 50, paragraph 2, puts the obligation on whoever provides the system: anyone offering systems that generate audio, images, video or text must ensure that the output is marked in a machine-readable format and detectable as artificially generated. The rule does not impose a technique: it asks for solutions that are "effective, interoperable, robust and reliable as far as this is technically feasible", and a recital lists the admissible routes, watermarks, metadata, cryptographic methods of provenance, fingerprints. Fines reach fifteen million euros or 3 percent of worldwide turnover, whichever is higher.
The technique was chosen by practice. The code of practice on the transparency of generated content, finalized in June 2026 and signed by about a hundred and ninety organizations, distinguishes by type of content: for images, audio and video it asks for two layers, signed metadata plus an imperceptible watermark; for free-form text, which has no container for metadata, it points to a single technique, watermarking, and only above two hundred tokens. By February 2027 detection will have to be interoperable. The code is voluntary, but for its signatories it becomes the road to compliance; Anthropic is among the signatories, and the August watermark is its implementation.
There is, however, a detail of the same Article 50 that is worth reading in full, because it already contains half of the discussion that follows. Paragraph 4, where the obligation no longer falls on whoever provides the system but on whoever publishes, treats text differently from everything else. For manipulated images, audio and video there is the deep fake, and it must be disclosed. For text, the duty to disclose applies only when it is published "with the purpose of informing the public on matters of public interest", and it lapses if there has been human review and a person, natural or legal, holds editorial responsibility. The very definition of deep fake in the regulation covers images, audio and video: text is not there. And the resulting perimeter is worth noting: almost all the text written every day, posts on social media, emails, homework and theses, work documents, is not touched by the duty to disclose; the watermark of paragraph 2, on the other hand, lands on all of it.
The point deserves to be fixed: when the rule reasons about what to tell the reader, it concedes that for text what counts is the responsibility of whoever publishes, not the instrument it was written with. When it reasons about what to mark, it marks the instrument. The two halves of the article seem to answer to two different philosophies, and the rest of this post is, at bottom, a comparison between the two.
How you watermark a sequence of words
A language model produces text one word at a time, or more precisely one token at a time. At each step the model does not pick a word: it computes a score for every entry in its vocabulary (the logits), and a function, the softmax, turns those scores into probabilities. Temperature controls how open the distribution stays: low, and almost all the weight goes to the most probable word; higher, and the model remains undecided among several good words. Then chance draws, with dice weighted by those probabilities.
The watermark lives exactly in that roll of the dice. The simplest scheme in the literature, proposed by Kirchenbauer and colleagues in 2023, works like this: at each step a secret key, combined with the last generated token, splits the vocabulary into two lists, a "green" one and a "red" one, different at every step; before the softmax, the scores of the green tokens receive a small push. The text that comes out is normal in every respect, but it contains more green tokens than chance would lead one to expect. Whoever holds the key can redo the count on any text, with no need for the model: count the greens, measure how far they exceed the expectation, and get a number (a z-score) that says how improbable it is that the text was born without knowledge of the key. The more recent schemes, such as DeepMind's SynthID-Text, the one adopted by Anthropic, do not even push the scores: they replace chance with a pseudorandomness derived from the key, so that the distribution of the responses, on average, does not change at all.
From this description follow two properties worth keeping in mind, because everything else depends on them.
The first: the signal lives where the model is undecided. If at some step the distribution sits almost entirely on a single word (a date, a name, a forced line of code), there is no roll of the dice to steer: forcing the choice would ruin the text, not forcing it leaves no trace. The watermark rests on the entropy of the text, and a low-entropy text cannot carry it. That is why the practical threshold sits around two hundred tokens: the signal accumulates slowly, and below a certain length there is not enough indecision to count.
The second: quality can genuinely remain intact, and on this point Anthropic deserves to be believed. DeepMind published in Nature an experiment that is hard to argue with: twenty million responses served to Gemini users, some with the watermark and some without, and differences in user judgments of 0.01 and 0.02 percent, statistically null. Whoever wants to criticize this watermark must look elsewhere, and elsewhere there is plenty.
One distinction before moving on, because it is the point where the public discussion gets confused most often. This watermark must not be mistaken for the "AI detectors" that have been circulating for years, the ones used in schools: those have no key and no inserted signal, they try to guess from the statistics of the text (how predictable it is, how uniform) whether it resembles what a machine would write. They are a different thing, and their track record is dismal: more on that shortly.
What the signal actually says
With the key in hand, what does the watermark read? Anthropic's phrasing is honest: an estimate of the likelihood that the text was "partly" written by Claude. Nothing more. It is worth turning that sentence in both directions, because in each of them something the common sense takes for granted breaks.
The absence of the signal does not say the text is human work. It is enough for it to have passed through a model from a provider that does not mark, through an open model run privately, or through any rewriting at all. Whoever treats the absence of a watermark as a certificate of human writing is trusting the same promise the old detectors used to make, and on that promise the numbers exist: a Stanford study of seven widely used detectors measured an average of 61 percent false positives on the exam essays of non-native students, with peaks near 98 percent for the worst one; OpenAI withdrew its own detector in 2023 "due to its low rate of accuracy"; Vanderbilt University, in order to disable the one built into Turnitin, did a simple calculation: with the 1 percent false-positive rate declared by the vendor, on seventy-five thousand papers a year that is seven hundred and fifty wrong flags.
The presence of the signal, on the other side, does not say a machine thought the content. It says that at some point in the making those words passed through Claude: even just for a translation, a revision of form, a rephrasing asked for by a person who already had all the ideas. The signal marks the pen, and the pen is not the author.
There is, finally, a property that strips the watermark even of its value as evidence. In 2024 a group at ETH Zurich showed that by querying the API of a watermarked model one can reconstruct enough of the key to fabricate the signal on any text: text written by a person, made to test positive, for a cost under fifty dollars. It is called spoofing. A signal that can be affixed to someone else's text cannot be evidence against anyone, in either direction.
How well it holds up
Then there is the simplest question: does the watermark survive someone who wants to remove it? The literature, here, is unusually unanimous: no.
The most direct way is paraphrase. Have another model rewrite the text, sentence by sentence, preserving the meaning: the studies that measured the attack report detection collapsing from 99.3 to 9.7 percent under repeated paraphrasing, even on passages of three hundred tokens, and a single pass of a specialized paraphraser, runnable locally, takes one of the reference detectors from about 70 to about 5 percent. Translation works too: a round trip through another language, and the signal is gone. And in 2024 the theoretical result arrived as well, from a group spanning Harvard and other universities: under general assumptions, anyone who can check the quality of a text and perturb it a little at a time can always remove a strong watermark without degrading the text. It is not an engineering problem to be fixed in the next version: it is the very nature of a statistical signal, which cannot withstand whoever reshuffles the statistics.
The phenomenon can be reproduced in the small, on an ordinary computer, without a GPU. The test is a Python script of about fifty lines that uses Hugging Face's transformers library, where the watermarking schemes come built in, and an open-weight model with half a billion parameters (Qwen2.5-0.5B). The three texts of the test are all generated by the model, there is no pre-existing prose: the watermark can only exist in a text produced with the marked sampling, and the control is generated the same way so that the comparison holds everything else equal. Four steps: have the model generate a test paragraph from an ordinary request (here, an informative paragraph about coastal lighthouses before electricity); regenerate from the same prompt with the watermark switched on among the generation options, green-list scheme with a quarter of the vocabulary "green" at each step; measure both texts with the same library's detector, which recounts the greens and returns the z-score; have the same model paraphrase the watermarked text, sentence by sentence and preserving the meaning, and measure that too. The paragraph without the watermark contains 18.5 percent green tokens, in line with chance: z-score −1.96, no signal. The one with the watermark contains 48.4 percent, z-score 6.07: the probability of such a value by chance is on the order of one in thirty billion, and this on a text of little more than a hundred tokens. The paraphrase: 24.6 percent greens, z-score −0.10, signal gone. Three observations from a test of a few minutes: the signal is there, and it can be measured at home; a paraphrase made at home, by the same small model, dissolves it; and above all the watermark appeared only because it was explicitly requested in the script. On a model you run yourself, the sampling is decided by whoever runs it.
The figure shows the three texts of the test, with the green-list tokens highlighted: the density of the green is the signal, and one can see at a glance where it appears and where it vanishes. One clarification on the scope of the test: the paraphrase was deliberately done in the poorest way, same small model, basic tools, practically zero cost for anyone with a computer. Whoever wanted to preserve more of the original writing style has more refined removal techniques available, and they too are practicable. The purpose here is demonstrative: to replicate and understand, with almost no effort, how the signal is inserted and how it is removed.
And here the point stops being technical. All the schemes seen so far live in the sampling, that is, in the code that runs the model. Whoever uses Claude or Gemini through an API receives the provider's sampling, watermark included. Whoever downloads an open-weight model and runs it at home does the sampling themselves, and simply never applies the watermark: there is nothing to remove, because it was never put there. The attempts to sew the signal into the weights, for now, do not survive a fine-tuning. The AI Act does not exempt open source from Article 50, but the obligation falls on whoever provides the system: whoever runs it privately has no provider.
The predictable result is a selection effect that overturns the purpose of the rule. The watermark ends up on the text of those who use the big commercial providers in the open: students, professionals, offices. Whoever has an interest in not being marked (spam, influence operations, fraud) has paraphrase, translation, or directly an open model run locally. The signal thus risks marking, with growing reliability, precisely the text of those who had nothing to hide. And every turn of the screw on this front tends to make open models and local inference a little more attractive, for reasons that have nothing to do with fraud: how much already exists in that direction was covered in another post on this site.
In fairness, a sensible use of the watermark does exist, and it is the one that needs no adversaries. A provider that marks its own output can recognize it when it meets it again: for instance, to avoid retraining its own models on its own synthetic text, a documented and serious problem. And against low-effort spam, the kind nobody bothers to paraphrase, it does add some friction. These are internal, voluntary uses, in the interest of whoever marks. It is the public promise, "this is how you will know what is written by AI", that cannot be kept.
The wrong question
So far, the technical limits. But it is worth taking a step back, because for images the same tools, with the same limits, do make sense, and the difference teaches something.
A photograph claims to be the recording of a fact: this scene, in front of this lens, happened. A video, the same. For content like that, "generated or real?" is a sensible question, because the content itself makes a claim about the world, and the viewer needs to know whether to hold it. Text never made that claim. A text has always been someone's work of synthesis: dictated to a scribe, rewritten by an editor, translated, signed by someone who did not materially type it. Nobody ever believed a text was "a recording": the question has always been, if anything, who answers for it and what it rests on. The question "did a machine write this?" applies to text a category born for images, and on text it measures nothing of what the reader needs.
It can also be put this way. One thing is a text that reports data, the outcome of an experiment, a few lines and a sequence of numbers: there, a claim of recording does exist, and indeed it is checked with its own means, redoing the calculation, going back to the source. Another thing is a descriptive text, an editorial, an in-depth piece: that one is "generated" by nature, always, by whoever signs it, because it is a product of synthesis; and for a product of synthesis what will always count is the process, the soundness of the sources, the critical spirit, the ideas of whoever writes. It is no accident that this is the same line drawn above by entropy: the forced text, the text of data, cannot even carry the watermark; the text with room for choice is exactly the one where someone made the choices.
A limit case the rule itself had to handle shows it well: the spell checker. Article 50 explicitly exempts tools that perform an "assistive function for standard editing" and do not substantially alter the text. Rightly so: nobody would want a watermark on every text that passed through a spell checker. At the other end of the work the same holds: nobody would propose a watermark to distinguish research done with a search engine from research done in a physical library, and the debate of twenty years ago about "Google research" was settled by a norm of process, citing one's sources, not by marking the tool. Whoever objects that the model, unlike the search engine, also writes the form is right: but that is precisely what the watermark cannot distinguish. And between the two extremes, assistance is a continuous scale: the spell checker on the side of form, the search engine on the side of sources, and in between the grammar suggestion, the translation, the rephrasing of a paragraph, the putting into clean English of ideas the author already has in full and cannot line up. At exactly which step does the text stop being the author's? The rule draws the line on the tool, but the justification of the line reasons about the use: it looks like the sign of a category that does not carve reality at its joints.
On that scale, meanwhile, there are real people. Those who write in a language not their own, those who have ideas built with study and effort but not the linguistic means to give them a clean shape: for them the model is a better pen, and the watermark marks their voice as "partly machine" precisely when they manage to use it for the first time. It is not a hypothetical risk: OpenAI has had its own watermark ready since 2023, with a declared accuracy that is very high, and chose not to switch it on citing, among the reasons, the disproportionate impact on those who use the models to write in a language they do not master.
And on the other side of the watermark there is the wrongly reassured reader. A text with no signal, "written by human hand", may have been built on information gathered from a poor model and never verified: the watermark noticed nothing, because the pen was human. What makes a text reliable was never the instrument: it is the sources, the process of verification, the responsibility of whoever signs. The watermark measures the pen. The process is invisible to it.
The alternative that already exists
If the right question is "who answers for it, and what does it rest on", the technical answer has existed for decades and has nothing statistical about it: it is called a signature. Not detecting the machine, but allowing whoever claims a content to declare it and prove it: a cryptographic signature binds a text to a key, the key to an identity, and the proof survives copying and cannot be forged. It is the road already standing for media with signed metadata (the C2PA standard, cited by the same European code of practice as a compliant technique), and for text it is even more natural, because it retraces what publishing has always done: a masthead, a name at the bottom, someone who answers. Not by chance, it is precisely the criterion that Article 50, paragraph 4, recognizes as sufficient for text: human review and editorial responsibility.
Publishing, for that matter, is the sharpest example, not the perimeter. The text the watermark will mark sits mostly elsewhere: in posts on social media, in homework and theses, in emails between private persons, in work documents, where there is no newsroom and no editorial responsibility under paragraph 4 either. But the principle does not change with scale: there too, whoever wants to be believed has always answered with their own name, the student for their assignment, the sender for their email. And it is precisely there, where the guarantees of context are missing, that a watermark flag would be read with fewer precautions. The statistical watermark takes the side of the tool and is imposed; the signature takes the side of whoever writes and is chosen. The first is fragile by theorem, the second is robust by construction.
The last consideration goes beyond this story, and its register should be declared: what follows is a reading, not a chronicle of how the rule was born. The starting intention is right, giving the public a tool against synthetic content passed off as real. But everything in the text of the rule suggests it was written by generalization: a technique that makes sense in precise contexts, images and video, where the artifact claims to record the real, appears to have been extended with the same gesture to a content, text, where the word "generated" changes meaning. The clues are in the rule itself: the definition of deep fake that does not contemplate text, the editorial exception of paragraph 4, the exemption for editing tools, three adjustments that look like corrections made where a rule conceived for images met a content of a different nature. If this reading is right, the effects risk being distributed in a way nobody chose: weighing precisely on part of those the rule meant to protect (those who use the model as a pen to make themselves understood), raising costs for those who comply and not for those who evade, steering adoption, pushing toward open models and local inference for reasons that have nothing to do with their merits. There is no need to imagine bad faith, and nothing here suggests it: it can be enough for whoever writes a rule to look at the rule more than at the phenomenon it is supposed to govern, and the rule becomes its own yardstick. The remedy, if this reading captures something, is the same one that holds for texts: stopping at the process, not at the artifact.
There remains the question from the beginning: what will be known, from August 2, 2026, that was not known before? About synthetic media, something real. About text, a signal that dissolves with a paraphrase, can be fabricated for fifty dollars, does not cover open models, and in the best case answers a question that was not the one asked. Regulating the artifact is easier than regulating the process, and this story gives a glimpse of where the shortcut can lead: a guarantee the public will believe it has, and that nobody can keep. Transparency about text goes through another door, the one the same rule keeps open in paragraph 4: someone who puts their name on it.
This post
In closing, a declaration that at this point should not surprise: this post, too, was produced with the support of a language model, for the analysis of the sources, for the revision of content and form. The theses, the structure and the responsibility for what is written here belong to whoever signs. If this text turns out to be useful as a source or as support, it will not be because of the absence of a watermark; if it turns out to be weak, the cause will not be the pen. The judgment, as always, rests with the reader: critical capacity, the will to dig deeper, one's own way of granting and withdrawing trust. No watermark can spare the reader that, and none should promise otherwise.
Pairs that get confused
- Watermark ≠ detector. The watermark is a signal inserted at generation time and read with a key, with controllable error margins; the detector guesses from the statistics of any text, and on non-native speakers it fails in documented ways.
- Marking ≠ disclosing. The duty to mark (paragraph 2) falls on the provider and concerns the tool; the duty to disclose (paragraph 4) falls on whoever publishes, and for text it lapses before editorial responsibility.
- Generated ≠ false. The watermark says where a text passed through, not whether it tells the truth.
- No watermark ≠ written by a human. An open model, a provider that does not mark, a paraphrase are each enough.
- Unchanged quality ≠ robust signal. One can leave the text intact and still lose the signal at the first rewrite: the two properties do not hold together.
- Proving provenance ≠ detecting the machine. The signature is affixed by whoever makes the claim and is verified with cryptography; the watermark is affixed by the tool and is estimated with statistics.
References
- Anthropic, How Claude's text watermark works, August 2026: anthropic.com/news/claude-text-watermark
- Regulation (EU) 2024/1689 (AI Act), Article 50 and recital 133: eur-lex.europa.eu, with the browsable Article 50
- European Commission, Code of Practice on Transparency of AI-Generated Content, June 2026: digital-strategy.ec.europa.eu
- J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, T. Goldstein, A Watermark for Large Language Models, ICML 2023: arxiv.org/abs/2301.10226
- S. Dathathri et al., Scalable watermarking for identifying large language model outputs, Nature 634, 2024: doi.org/10.1038/s41586-024-08025-4
- V. S. Sadasivan, A. Kumar, S. Balasubramanian, W. Wang, S. Feizi, Can AI-Generated Text be Reliably Detected?, TMLR 2025: arxiv.org/abs/2303.11156
- K. Krishna, Y. Song, M. Karpinska, J. Wieting, M. Iyyer, Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense, NeurIPS 2023: arxiv.org/abs/2303.13408
- Z. He et al., Can Watermarks Survive Translation? On the Cross-lingual Consistency of Text Watermark for Large Language Models, ACL 2024: aclanthology.org/2024.acl-long.226
- H. Zhang, B. L. Edelman, D. Francati, D. Venturi, G. Ateniese, B. Barak, Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models, ICML 2024: arxiv.org/abs/2311.04378
- N. Jovanović, R. Staab, M. Vechev, Watermark Stealing in Large Language Models, ICML 2024: arxiv.org/abs/2402.19361
- W. Liang, M. Yuksekgonul, Y. Mao, E. Wu, J. Zou, GPT detectors are biased against non-native English writers, Patterns 4(7), 2023: doi.org/10.1016/j.patter.2023.100779
- I. Shumailov, Z. Shumaylov, Y. Zhao, N. Papernot, R. Anderson, Y. Gal, AI models collapse when trained on recursively generated data, Nature 631, 2024: doi.org/10.1038/s41586-024-07566-y
- OpenAI, New AI classifier for indicating AI-written text, with the withdrawal note of July 20, 2023: openai.com
- Vanderbilt University, Guidance on AI detection and why we're disabling Turnitin's AI detector, August 2023: vanderbilt.edu
- A. Ha, OpenAI says it's taking a "deliberate approach" to releasing tools that can detect writing from ChatGPT, TechCrunch, August 2024 (on the unreleased watermark, from the Wall Street Journal's reporting): techcrunch.com