AI content watermarking stopped being a research topic on August 2, 2026. That is the date the European Union’s transparency rules for synthetic content became applicable, and it is also the date from which Anthropic began marking Claude’s output by default.
Most explanations of AI content watermarking treat it as one thing. It is two, they work completely differently, and they fail differently. Getting that distinction straight is most of what you need.
AI content watermarking is two mechanisms, not one
Embedded marks live inside the content itself. For text, this means the words are chosen in a way that carries a statistical signature. There is no file, no header and no attachment. Copy the text into a plain notepad and the mark travels with it, because the mark is the text.
Provenance metadata is a separate record attached alongside a file, cryptographically signed so tampering is detectable. It is a label on the container rather than a pattern in the contents. Strip the metadata and the file is unchanged but the record is gone.
Everything confusing about this subject comes from treating those as interchangeable. They have opposite weaknesses. An embedded mark survives copy and paste but degrades when the text is rewritten. Provenance metadata survives rewriting of the surrounding context but vanishes the moment someone screenshots the file or converts its format.
How a text watermark actually works
The mechanism is more elegant than most coverage suggests, and understanding it tells you exactly when it will fail.
A language model picks each word from a ranked set of candidates. Very often several candidates are equally good, and the choice between them carries no meaning. Anthropic’s description of its approach is that "instead of using an arbitrary random number generator to pick the next word, watermarking uses the key and a few words that come before to settle what word the model should pick."
So the output still reads as natural prose, and to anyone without the key the choices look random. To someone holding the key, the pattern is verifiable. Nothing is hidden in whitespace, no invisible characters are inserted, and there is nothing to find by inspecting the raw bytes.
That design produces one consequence worth carrying: the mark lives in the choices, so it is only as strong as the number of free choices the text contained.
Why factual writing is the hardest to mark
Here is the part almost nobody covers, and it matters more than the headline.
Anthropic states that watermarking "is sparser on factual passages where there are fewer choices that can be made without decreasing the accuracy of the text." When a model writes a specification, a date, a price or a technical instruction, its word choices are constrained by correctness. There is no room to encode a signal without making the text wrong.
Read that against the kinds of writing people most want to detect. News copy, documentation, product descriptions, financial summaries and academic abstracts are exactly the constrained, factual registers where the mark is weakest. A florid personal essay carries the signal well. A press release carries it poorly.
What Claude marks, and where
Anthropic’s support documentation is specific. "Claude models launched on or after August 2, 2026 support marking at launch," and the company says it is "working to add marking support to Claude models released before that date."
Coverage is broad rather than product-specific. The documentation names the Claude Platform API, Claude, Claude Code, Claude Cowork and Claude Tag, plus access through AWS, Google Cloud and Microsoft Foundry. Text marking applies to "all generated text." Signed provenance metadata applies "where Claude supports processing files," naming .svg, .png and .jpg, with the caveat that it "may not be supported on every platform."
No opt-out is documented anywhere. That is a deliberate design choice and worth noting, because it means the marking is a property of the model rather than a setting.
The provenance half: C2PA and Content Credentials
The metadata side uses an open standard rather than a vendor format. The Coalition for Content Provenance and Authenticity is "a project of the Joint Development Foundation, a Washington-based 501c6 non-profit," formed by merging the Content Authenticity Initiative and Project Origin.
What C2PA produces is a signed manifest travelling with a file, recording assertions about how it was made and by whom, in a form where alteration breaks the signature. It is closer to a chain of custody than to a watermark.
Its weakness is structural and well known. Metadata is separable from content. Screenshot an image, re-encode it, or pass it through a platform that strips exif on upload, and the credential is gone while the pixels are identical. The standard cannot prevent that, and it does not claim to. It proves presence, never absence.
What the EU actually requires
The legal driver is Article 50 of the EU AI Act, and the obligation is narrower than "label AI content."
The text requires that providers of generative systems "shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated," qualified by the standard that marking be "effective, interoperable, robust and reliable as far as this is technically feasible." That qualification is doing real work, and it is the reason a technique with the failure modes above can still satisfy the rule.
The dates matter. The Commission states that "Article 50 of the AI Act applies as from 2 August 2026," having published its implementing guidelines on July 20, 2026. Systems already on the market before that date have until December 2, 2026 to meet the marking and detection duty specifically. Fines reach "up to 15 million euros or 3% of total worldwide turnover for the preceding financial year."
There are carve-outs. The obligation does not bite where an AI system performs "assistive editing functions" without substantially altering the input, nor for certain law enforcement uses.
What watermarking cannot tell you
Four limits on AI content watermarking, all stated by the vendor rather than inferred by critics.
A detected mark "provides a signal that content was processed by Claude, but is not fully conclusive." It is evidence, not proof.
Absence proves nothing at all: "lack of a detected mark doesn’t mean the content wasn’t AI-generated or processed." Another model, an older Claude, an unsupported file type or ordinary editing all produce an unmarked result.
The mark degrades under exactly the operations people perform on drafts. Anthropic’s own summary is that "light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will."
And there is no public detector. Anthropic says it "will soon be offering a watermark detection API" and is "in the process of working out the details of its implementation." So the duty to mark arrived before anyone outside the vendor could check a mark, which is the gap worth watching between now and December.
That pattern, a capability shipping months ahead of the tooling that would let anyone verify it, is not unique to AI content watermarking. It ran through vendor benchmark claims earlier this month, and through the gated release of an offensive security model whose numbers only approved partners can reproduce. The useful habit is the same one that applies to agentic browser defenses: read the vendor’s stated limits before the headline, because in every one of these cases the vendor documented the gap accurately and the coverage skipped it.
Frequently Asked Questions
What is AI content watermarking?
It is a set of techniques for making AI-generated output identifiable as machine-produced. Two distinct mechanisms sit under the name. Embedded marks are statistical signatures carried inside the content itself, most commonly in the pattern of word choices in text. Provenance metadata is a signed record attached alongside a file describing how it was created. They have opposite failure modes, which is why treating them as one thing causes confusion.
Does watermarking insert hidden characters into text?
No, and this is a common misconception. There are no invisible Unicode characters, no zero-width spaces and no manipulated whitespace to find by inspecting raw bytes. The mark lives in which word the model selects when several are equally valid, seeded by a cryptographic key and the preceding words. To a reader the prose looks entirely ordinary.
Does copying and pasting remove the watermark?
No. Because the mark is the text rather than something attached to it, copying into any editor preserves it. This is the opposite of provenance metadata on a file, which is removed by screenshots, format conversion, re-saving or platforms that strip metadata on upload. Copy and paste is the case where embedded marking is strongest.
Does editing remove it?
It depends on how much. Anthropic’s own summary is that light editing probably will not remove the watermark completely, while a complete rewrite replacing every word will. Paraphrasing, translation and mixing the passage into other writing are all named as things that can break the signal. So the mark tends to survive the light touch and disappear under the heavy one.
Why is factual writing harder to watermark?
Because the technique needs free choices to encode a signal, and factual writing has fewer of them. Anthropic states that watermarking is sparser on factual passages where fewer choices can be made without reducing accuracy. Dates, figures, specifications and technical instructions constrain the wording, so there is little room to carry a mark. Long discursive prose marks well; a tightly factual paragraph marks poorly.
Is there a tool I can use to check content?
Not publicly, as of writing. Anthropic says it will soon offer a watermark detection API and is working out the implementation details. That means the legal duty to mark content took effect before any public ability to verify a mark existed. Anyone claiming to detect Claude watermarking today is not using the vendor’s key.
What does the EU AI Act actually require?
Article 50 requires providers of generative systems to ensure outputs are marked in a machine-readable format and detectable as artificially generated, to the extent technically feasible. It became applicable on August 2, 2026, with a transitional window to December 2, 2026 for the marking and detection duty on systems already on the market. Penalties reach 15 million euros or 3 percent of worldwide annual turnover, whichever is higher.
Can I turn watermarking off?
No opt-out is documented. Anthropic’s support material describes marking as applying across the API, Claude, Claude Code, Claude Cowork and Claude Tag, and through AWS, Google Cloud and Microsoft Foundry, without describing a setting to disable it. Treat it as a property of the model rather than a configurable feature, and assume text you generate carries a mark by default.
