Future versions of Claude will produce text containing a watermark - a mechanism for estimating the likelihood that Claude played a role in generating the text. Anthropic, together with several other major AI providers, is introducing this change in order to comply with the EU AI Act.
Key points:
- Anthropic uses a watermarking technique that has no practical effect on the quality or content of Claude's responses.
- Readers cannot distinguish watermarked text from unwatermarked text.
- Nothing is appended to the text, and there are no hidden characters.
- Watermarking does not require additional tokens and does not increase cost.
- The watermark carries no identifying information and cannot be linked to a specific person, organization, or conversation.
- Watermarking is not unique to Claude. As of August 2, the EU mandates that AI providers serving its market must mark AI-generated content. Other major model developers have signed the same Code of Practice and will deploy their own watermarks.
What is watermarking?
Large language models such as Claude generate text one word at a time. At each step, the model selects from a set of candidate words, choosing the most appropriate one given the preceding context. Consider the sentence "The weather today was cold and…". The next word is very unlikely to be "sugary," but it could plausibly be "overcast" or "grey." In most situations, it makes little difference to the reader which of these two words appears - the sentence conveys essentially the same meaning either way. Normally, that kind of tie is broken by a random number.
Watermarking exploits these low-stakes decisions - which arise repeatedly throughout a generated passage - to embed a pattern in Claude's output. The pattern is invisible to a human reader but can be detected by anyone who possesses the corresponding key. When watermarking is active, the choices remain random, but the source of randomness changes. Rather than relying on an arbitrary random number generator, watermarking uses the key together with a few preceding words to determine which word the model selects. The words Claude picks are still random, but it becomes possible to examine the sequence and check whether it is consistent with the choices Claude would make using that key. If the sequence matches, a probability can be assigned that the text was produced by Claude.
Importantly, the model is not permanently biased toward any particular word. Just as with unwatermarked text, "overcast" might appear in one sentence and "grey" in another, depending on context. Nor does the watermark push Claude toward words it would not normally consider - for instance, it would not cause Claude to select an obscure synonym like "nubilous" that it would almost never use under ordinary circumstances.
How does watermarking affect Claude's outputs?
Watermarking does not degrade the quality of Claude's output. A watermarked response looks and reads the same as an unwatermarked one. Unlike physical watermarks on banknotes or visible marks on digital documents, AI text watermarks are not perceptible to the reader.
In Anthropic's internal testing, watermarking had no observable effect on the content, creativity, or readability of Claude's text. In the SynthID-Text paper that describes the underlying technique, Google DeepMind evaluated the approach by serving a watermarked model to a subset of Gemini traffic and comparing user ratings. They found no statistically significant difference from the unwatermarked model. In a controlled study, human raters who compared watermarked and unwatermarked answers side by side likewise reported no quality difference.
A helpful analogy: imagine playing a board game like Monopoly, where each turn depends on a random die roll. Suppose that, instead of rolling dice, players used successive digits of pi starting from a randomly chosen position. For all practical purposes the moves would still be random - the game would play out the same way regardless of whether randomness came from dice or from pi. But if someone later reviewed the full sequence of moves and knew the value of pi, they could determine whether the game likely used pi as its source. A game that used pi is, in a sense, "watermarked."
Claude's text watermark works the same way. It does not alter the meaning or experience for the reader, but it makes it possible to check after the fact whether the text was likely generated by Claude.
Which specific method of watermarking is used?
Claude's watermark is based on the SynthID-Text approach published by Google DeepMind in a Nature paper in 2024. It belongs to a family of techniques originating from a 2022 proposal by Scott Aaronson, all sharing the same core principle: the watermark only changes the source of randomness used when choosing among words.
There are limitations. Using Anthropic's key, one can only answer the question "What is the likelihood this was partly written by Claude?" It does not confirm whether text was human-written, and it cannot determine whether text was produced by a different AI system (even one that uses watermarking, since each provider has a different key and may use a different method). Detection also performs poorly on short passages, where there are fewer word choices and less information to analyze. As a passage grows longer, confidence about Claude's involvement increases.
Watermarking is sparser in factual passages where there are few interchangeable word choices. For example, in the sentence "Isaac Newton's most famous work was called *Principia*…", the next word must be "Mathematica" - there is only one correct answer, so the watermark has nothing to act on. The same applies to proofreading: if a user asks Claude to fix only grammar and punctuation, the watermark can only reside in the handful of corrections, which may be too few to register.
What about cases where Claude has proofread or edited human text?
The watermark applies only to words Claude selects. When Claude proofreads text written by a person, the returned text has typically been only lightly modified. Because nearly all the words are the author's, there is very little for the watermark to attach to. Depending on the length and extent of editing, those changes may not be sufficient to make Claude's involvement detectable. The more Claude writes, the more decisions it makes, and the more room there is for a watermark.
What about code?
AI watermarking exploits decisions where either word choice would be equally valid. Where an exact output is required - where choosing a different term would introduce a factual error or break code - the watermark is not applied.
For example, after the model writes "2 + 2 =", there is a clear best answer (if completing the sum, nothing is as good as "4"; if referencing George Orwell's Nineteen Eighty-Four, nothing is as good as "5"). The watermark's nudge would not apply here. For the same reason, code - which frequently demands exactness - generally carries less watermarking than other types of text.
That said, where there is an arbitrary choice between terms within code (such as comments), the watermark can be applied. By definition, its effect on the actual code produced is negligible.
What does this mean for users?
Does this slow the model down or increase cost?
No. Watermarking has a negligible impact on model speed, and because it produces no extra tokens, the model costs the same to serve and to use.
Can a watermark be traced back to a user or organization?
No. The watermark pertains to Claude and its outputs. It does not identify anything about individual users. Nothing in the watermark or its key allows anyone to recover information about the user, their organization, or their conversations with Claude.
Why is Anthropic watermarking Claude's outputs?
Anthropic is implementing watermarking to comply with the EU AI Act. Anthropic, along with several other major AI model providers and roughly 190 total signatories, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. This requires AI system providers to use methods of marking AI-generated text. Anthropic is applying watermarking globally at launch because it does not yet have a durable way to scope the feature by region. The company will continue evaluating different approaches and will share updates as they become available.
Other questions
How can someone check if a piece of text was written by Claude?
Anthropic will soon offer a watermark detection API. The details of its implementation are still being worked out.
What about images and other files?
When Claude produces a file of a supported type (such as .png, .jpg, or .svg), it attaches a content credential - a small, cryptographically signed note in the file's metadata - indicating that the file was made or processed with Claude. This uses an open industry standard called C2PA, the same standard used by camera manufacturers and photo-editing software to record an image's provenance. Any C2PA-aware tool can read it, and Anthropic will provide its own tool where users can drop a file and check.
This metadata label is distinct from a watermark. Nothing in the file itself changes - no mark is embedded or hidden. As with text, the credential only indicates Claude's involvement in producing the file; it contains no identifying information.
Can someone edit the text to remove the watermark?
To some degree, yes. Light editing is unlikely to fully remove the watermark, but a complete rewrite in which every word is replaced would. In that case, however, it is debatable whether the text can still be called AI-generated.
What does a watermark actually prove?
A watermark can only establish that Claude was likely involved with the content at some point. It cannot distinguish between "Claude wrote this" and "Claude heavily edited this."
Do watermarks apply to translations?
Yes. A translation produced by Claude carries a watermark because every word in the translation is chosen by Claude.
What about older Claude models?
The EU law includes a transition period for Anthropic models launched before August 2, 2026. Anthropic is working to add watermarking to those models as well, and this will be rolled out over the coming months.
How does this differ from AI detection software like Pangram?
AI detection software uses a different method because those companies do not possess Anthropic's key. Among other things, such services look for subtle (and sometimes obvious) "tells" in AI-generated phrasing - for instance, AI models tend to favor constructions like "this isn't [X], it's [Y]" and use the word "quietly" more frequently than one might expect. Identifying these patterns is fundamentally different from checking for a cryptographic watermark.
Does this change who owns a given output, or who is legally responsible for it?
No. A watermark only helps assess whether Claude may have produced or processed the content. It makes no statement about ownership or authorship and does not alter a user's rights under Anthropic's terms. The watermark is only applied when Claude was involved in processing the content or file.