On August 11, Anthropic announced it would watermark all of Claude's text output. Four days later it published a post explaining how.
The FAQ lists six claims that read like a riddle when you line them up:
No practical impact on output quality. Readers can't tell the difference. Nothing is added to the text, and there are no hidden characters. No extra tokens, and no extra cost. And the watermark can't be traced to a specific person, organization, or chat.
So where is the watermark?
If nothing is added, no tokens are spent, quality doesn't change, and a watermarked passage looks identical to an unwatermarked one — what is left of the word "watermark"?
The answer is elegant. It doesn't put anything into the text. It changes the moment the model picks a word.
The watermark hides where the model hesitates
First, a premise: every time a language model writes a token (think of it as a word or half a word), it is drawing from a probability table. Every candidate sits on that table with a probability attached.
The starting point for this line of work is the 2023 paper by Kirchenbauer et al., and the method is direct:
Before generating each token, take the tokens already written, feed them into a hash function as a seed, and use the output to split the entire vocabulary in half at random — one half is the "green list," the other the "red list." Then give green-list words a small score bump so they are more likely to be drawn.
Detection runs it backwards: with the same hash function, recompute for every token whether it was green or red at the time. Human writing lands roughly 50/50. Model writing comes out noticeably green-heavy. Count them and you know.
The catch is the price. This forcibly changes the model's output distribution — the model wanted to say A, and the bias pushed it to B. Text quality drops. The literature calls this distortionary.
What Anthropic is using is the upgraded version: SynthID-Text, published by Google DeepMind in Nature in October 2024, open-sourced the same month, and now sitting inside Hugging Face Transformers where anyone can call it. The core idea is tournament sampling:
Again, the preceding tokens seed a pseudorandom function. But instead of splitting the vocabulary in two, the candidates get arranged into a multi-layer bracket — a small knockout tournament. At each layer the key assigns every candidate a score (the paper calls it a g-value), and the higher score advances. A word that keeps winning across layers gets its sampling probability raised exponentially.
The key point: this tournament only matters when the model was undecided to begin with.
If the model is 99% sure the next word is "the," it doesn't matter how the bracket plays out — you are getting "the." Only when the model is wavering between two words that are both fine — Anthropic's own example is "overcast" versus "grey" — does the key's preference actually decide the output.
Anthropic's phrasing: it influences inconsequential word choices.
Which makes all six claims line up:
| Claim | Why it holds |
|---|---|
| Nothing added, no hidden characters | Nothing is inserted into the text; it just picks differently among equivalent options |
| No extra tokens, no extra cost | Same number of words, a few of them swapped for synonyms |
| Readers can't tell | The words being swapped are the ones where either choice reads fine |
| No impact on quality | Tournament sampling can be configured to leave the output distribution completely unchanged (the paper calls this non-distortionary) — this is where it beats the 2023 approach |
| Can't be traced to a person | The key is global. Detection tells you "Claude wrote this," not "who asked Claude to write this" |
No entropy, nowhere to hide
Run that premise backwards and you get Anthropic's own three limitations — and you can see they are not engineering shortfalls. They are mathematically unavoidable.
The Claude Help Center lists the cases where the mark may not be detected:
"The text has been heavily edited, paraphrased, translated, or mixed into other writing"
"The passage is very short, leaving too little text for a reliable signal"
"A file's metadata was stripped through format conversion, re-saving, screenshots, or other means"
The third one is a different mechanism — more on that in a moment. The first two come down to a single word: entropy.
Entropy here can be read as "how much the model hesitated." The more places a passage had the model wavering, the more watermark signal fits inside it. The more certain the model, the less room there is.
So:
Text too short — too few moments of hesitation, and statistically you cannot separate the signal from a coincidence.
Paraphrasing — swapping out every word voids the results of the original tournament. Anthropic says light editing probably won't remove the mark and a full rewrite will. That is why.
Code carries almost no watermark. Anthropic volunteered this one: writing code leaves too little freedom in word choice. You can name a variable whatever you like, but for is for and return is return — there are no equivalent options to choose between. The watermark may only show up in comments.
Files — images and the like — use something else entirely: C2PA signed provenance metadata, a cross-industry standard for content origin. Its durability is a different story: take a screenshot and it's gone.
One more thing to be clear about: Anthropic's detection API isn't live yet, and the company says it's coming. So everything in this post about how strong or weak the watermark is comes from published papers and Anthropic's own statements, not from testing I ran.
"Only the EU regulates this"
Anthropic is explicit about the reason: the watermark exists to comply with the EU AI Act.
Article 50(2), specifically. Providers of AI systems generating synthetic audio, image, video, or text — general-purpose models included — must ensure outputs are marked in a machine-readable format. It applies from August 2, 2026 to systems newly placed on the market; systems already on the market have until December 2. There is a carve-out: it doesn't apply where the AI performs an assistive function for standard editing and doesn't substantially alter the input or its semantics. Under the Act's penalty provisions, violations can reach 3% of worldwide annual turnover or €15 million.
From here it's easy to conclude this is the EU on its own, making work for an entire industry.
That's what I assumed too. Two things turned out to be wrong.
China was almost a year earlier. The Measures for Labelling AI-Generated Synthetic Content — issued jointly by the Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the broadcasting regulator — plus its companion mandatory national standard GB 45438-2025, took effect on September 1, 2025. That is 11 months ahead of Article 50. And it's a mandatory national standard, not a voluntary industry code. It requires two layers: an explicit label (a visible "AI-generated" marker in the content or interface) and an implicit one (technical fields written into file metadata).
The technical route differs from what the EU set off here: China's implicit label lives at the file-metadata layer, closer to C2PA in spirit than to a SynthID-style statistical watermark baked into sampling. (That's my reading of the published explainers; I haven't read the standard in full.)
California lands on the exact same day. There genuinely is no unified federal law — the Biden-era executive order was a voluntary framework and most of it was later rescinded, so that part holds up. But California's SB 942 (the California AI Transparency Act) was signed in September 2024, amended by AB 853 in October 2025, and its operative date moved to August 2, 2026.
The same day as EU AI Act Article 50. That isn't a coincidence; AB 853 moved the date there specifically to align with the EU.
SB 942 covers large generative AI providers with more than a million monthly users, and requires a free detection tool, a visible disclosure, and a latent disclosure embedded in the content.
So the accurate version is: there really is no US federal law, but "no other country has a hard requirement" doesn't hold. China was 11 months ahead of the EU, and California lands on the same day.
The EU delayed a pile of obligations — but not the watermark
In November 2025 the Commission proposed the Digital Omnibus, a package to simplify digital regulation with the stated aim of reducing compliance burden and improving competitiveness. Parliament passed it on June 16, 2026, the Council gave final sign-off on June 29, and it entered into force on July 27.
It pushed back the AI Act's high-risk obligations: standalone Annex III systems (recruitment, credit scoring, law enforcement, education, border control) move to December 2, 2027; AI embedded in regulated products under Annex I — medical devices, machinery, vehicles — moves to August 2, 2028. The main reason is that the harmonized standards aren't finished. On the original timetable, companies would have had to prove compliance before the yardstick existed.
But note one detail: Article 50 was not among the delays. The transparency obligation took effect on August 2, 2026 as scheduled, untouched.
Read off the timeline, the EU's move this round was to push the genuinely expensive obligations — the ones that need a whole compliance apparatus built — further out, while keeping the cheap ones that bite immediately.
The watermark is in the second category.
There's a more interesting signal too: Anthropic is applying the watermark globally, not by region. Whether you're in Brussels or anywhere else, text from Claude carries the mark. The reason isn't hard to guess — implementing this per-region is far more trouble than implementing it once. One market's rule became the global default that way.
Seen from that angle, the EU's regulatory reach is still very much intact.
Europe falling behind: five factors
I wrote a piece a while back, Global Tiers in the AI Era, that put Europe in the fourth tier — not idle, just an order of magnitude slower. Researching the watermark was like looking at the same question again through a very narrow slot.
Europe is genuinely behind. But I'm not going to put a number on how much of that is regulation — that would take a counterfactual, namely what Europe looks like without the rule, and nobody has one. The five factors below are laid out, not ranked.
Capital scale. Mistral is Europe's largest AI company, valued at €11.7 billion in its September 2025 Series C; in June 2026 it was rumored to be in talks for a €3 billion round at roughly €20 billion — that one is a rumor with no official announcement, and I'm treating it as such. For comparison: Anthropic at $965 billion in June 2026, OpenAI at $852 billion in March 2026.
Capital market fragmentation. The Draghi report puts it well: many innovative European companies end up seeking financing from US VCs, because scaling in one large US market beats grinding through a fragmented EU one. That's structural, not a matter of will.
Energy costs. The Draghi report states plainly that European firms face higher energy costs than their US counterparts. In this industry's cost structure, electricity is a hard constraint.
Grid connection. This was the most painful number from that tiers piece: data centers in major European cities wait an average of 7 to 10 years from signed contract to power, with extreme cases at 13. In the same window, xAI brought 555,000 GPUs online in Tennessee in 18 months. That isn't a money gap. It's a gap in physical time.
Regulatory burden. 27 member states, overlapping regimes, and a compliance apparatus you have to build yourself. This one is real — the EU proposing the Digital Omnibus is an admission of it.
Back to the watermark. It belongs to that last factor, and it's the lightest item in it — no quality cost, no extra tokens, no extra money, and the method is an off-the-shelf open-source implementation from Google that you wire in and use. If you want to argue that regulation is what dragged Europe down, this is the weakest piece of evidence you could pick.
All six findings would carry a watermark. One of them was wrong
The regulatory research in this post started with me asking Claude. It came back with six findings, each with a link, and it read solidly. One of them was this:
California passed AB 3211/SB 942 (the "Digital Content Provenance Standards Act"), requiring generative AI providers to watermark synthetic content starting February 2025
When I went to verify AB 3211, I found nothing. Not because coverage was thin — because it never became law.
AB 3211 (Wicks, California Digital Content Provenance Standards) cleared third reading in the State Assembly on May 22, 2024, 62 ayes to 0 noes. Then on August 31 it was moved to the inactive file at Senator Gonzalez's request, and on October 2 it was formally marked dead on the Senate floor. The only one that passed is SB 942. The date is wrong too: not February 2025, but August 2, 2026.
Two errors in one finding. And it happened to be the single most direct piece of evidence for "the US regulates this as well" — I wanted that conclusion, which is exactly why I scrutinized it least.
Now put that back inside the watermarking frame. Those six findings came out of Claude. Under the regime that started on August 2, output like that is meant to carry a watermark — and the watermark tells you it came from a model. It tells you nothing at all about which of the six was wrong.
Anthropic writes the same thing in its own help center: a detected mark "provides a signal... but is not fully conclusive."
Wrapping up
One piece is still missing. Since August 2, several major model providers have started watermarking text — but detection requires the key, and the key isn't public. Until the detection API ships, nobody outside can verify whether the mark went on, or how well it holds.
Anthropic says it's coming. When it does, I plan to run three real Claude outputs through it: one untouched, one with a handful of words changed, one translated, to see how much signal survives each. That's when it becomes possible to say whether any of this works.
Sources: Anthropic: How Claude's text watermarking works, Claude Help Center: How Claude marks AI-generated content, TechCrunch on the watermarking details, Nature: Scalable watermarking for identifying large language model outputs, google-deepmind/synthid-text, EU AI Act Article 50, GB 45438-2025 full text, California SB 942, California AB 3211 legislative history, Digital Omnibus (Gibson Dunn analysis), Draghi competitiveness report. The judgments here are my own and don't represent any company's position.