Claude's text now carries a watermark: what the EU requires, and what a watermark can prove

Since August, new Claude models watermark their text

On August 14 Anthropic announced that future Claude models would generate text containing a watermark, citing the EU AI Act.¹ O’Reilly’s October 22 list of models that already do includes Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1, across Claude Desktop, Claude Code and the API.² Anthropic applies it worldwide because it has no durable way to scope it by region, and files Claude produces, such as images, get a C2PA content credential in their metadata.¹

The watermark adds no hidden characters, costs no extra tokens and carries no user information, so it cannot point to an account.¹ It lives in word choice, using SynthID-Text, which Google DeepMind published in Nature in 2024.¹³

It works in five steps:³²

1. Draw candidates. The model computes next-word probabilities as usual and samples a few candidates. Why: every candidate is a word the model might have written anyway, so meaning and fluency hold.
2. Score with the key. The key plus the preceding words gives each candidate a score. Why: only the key holder can compute it, and the same word scores differently in a new spot, so outsiders see no pattern.
3. Knock out in pairs. Candidates meet in pairs and the higher score stays until one is left. Why: it writes a lean toward high scorers into the text without dictating any word.
4. Let it add up. One word shows nothing; over hundreds, high scorers appear slightly more often. Why: that is the statistical basis for detection, and the reason short text gives a weak signal.
5. Detect. Re-score every word with the same key and check whether the average sits clearly above 0.5. Why: ordinary text hugs 0.5 while watermarked text stays above it, so the verdict can be checked.

Google ran a live experiment on nearly 20 million Gemini responses and found user ratings almost unchanged.³²

The EU wants machine-readable marks; labels are someone else’s job

Article 50 applies from August 2 and splits the duties (figure 2).⁴

• Providers of systems that generate synthetic text, images, audio or video must mark output in a machine-readable, detectable way, unless the system only assists standard editing.⁴
• Publishers of AI-generated text meant to inform the public on matters of public interest must disclose it, unless a human reviewed it and someone holds editorial responsibility.⁴
• How to mark is set by a voluntary Code of Practice finalized on June 10: at least two layers of marking where necessary, plus detection tools for others.⁵ Anthropic signed in July with about 190 others; its two layers are the text watermark and file credentials.¹

A watermark answers one question: was Claude involved?

What the watermark changes is the kind of evidence. “Does this read like AI?” is a guess about style; a watermark is a statistical signal you can check. But the question it answers is narrow:¹

• It shows likely Claude involvement. It cannot prove a human wrote something, and it cannot detect other AIs.
• It cannot tell “Claude wrote this” from “Claude heavily edited this”; proofreading a human draft usually leaves too little to detect.
• Short passages give weak signals, factual answers and code carry little or none, and a full rewrite removes it.

And detection is not public. The API is in private preview for regulators, law enforcement, media, researchers and companies that must verify for compliance.¹ That matches what I argued in the GDPR post: individuals can’t check, so verification sits with regulators and institutions.

For anyone drafting reports or email with Claude, the upshot is practical: disclose AI use in outside documents according to your own policy rather than relying on the watermark, and never treat a missing watermark as proof a human wrote the text.