Anthropic has started adding invisible watermarks to text generated by Claude. This move brings AI-generated writing into a new phase of content provenance. The company says the marks are machine-readable, embedded directly into the text and designed to survive copying, pasting and some light editing. Anthropic is introducing the system as part of its commitments under the European Union’s AI Act, but it plans to extend the technology globally.
At first, this looks like a simple solution to a growing problem of AI-generated content across the web. If AI can write something that looks human, why not add a hidden signal that can identify it later?
The answer seems useful, but not as simple as it sounds.
A watermark can potentially say that Claude generated or processed a piece of text. It cannot, by itself, establish who wrote the original material, how much AI contributed, where the information came from, or whether the material used to produce the response was properly licensed.
That will surely become important as AI-generated content becomes part of everyday publishing.
What Anthropic is actually marking
Anthropic says Claude models launched in the European Union on or after August 2, 2026, support machine-readable marking. The watermark is applied at the model level, so it does not depend on whether Claude is accessed through Anthropic’s own products, its API, Claude Code, Claude Cowork or supported third-party cloud platforms such as Amazon Web Services, Google Cloud and Microsoft Foundry.
The company says the watermark is invisible to people reading the text. It is intended to survive normal copy-and-paste operations and some light editing. Anthropic is also developing detection tools that will allow users and organizations to check whether the mark is present.
The company plans to extend the system to older models and apply it globally.
This is a meaningful change because most AI detection systems have traditionally tried to guess whether text was generated by looking at the text itself. Anthropic’s approach is different from existing options. Instead of asking a detector to decide whether writing “looks like AI,” the model itself adds a signal during generation. This signal can be later used to find whether the content was generated using AI.
That is a much more sensible approach to provenance. But it has, or we can say differently, a limitation.
The presence of a Claude watermark does not necessarily mean Claude wrote the work.
Imagine a journalist writes a 2,000-word article after spending two days interviewing sources and checking documents. The journalist then asks Claude to correct grammar and improve a few awkward sentences. Claude processes the text and the final version may carry a Claude watermark.
Now imagine another person gives Claude a two-line prompt and asks it to write the same 2,000-word article from scratch. That output can carry the same watermark.
From the perspective of the watermark, both pieces of content contain evidence of Claude’s involvement. From the perspective of authorship, they are completely different.
This is not a theoretical edge case. Anthropic says the marking applies even when Claude is used for translation, summarization, formatting or proofreading.
That means a watermark could eventually become evidence that an AI system touched a piece of writing without necessarily proving that the AI authored it.
This should matter if schools, employers, publishers or online platforms ever start using watermark detection to make decisions about human authorship.
A university that sees a Claude watermark in an essay cannot automatically conclude that the student asked Claude to write the essay. A publisher cannot conclude that a journalist did not write an article simply because Claude was used to edit it.
The watermark is a provenance signal. It is not an authorship certificate.
Anthropic’s decision comes as the transparency provisions of the EU AI Act take effect. Article 50 requires providers of certain generative AI systems to ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.
The European Commission’s rules also recognize that AI can be used as an assistive editing tool. The transparency framework includes an exception for standard editing where the AI does not substantially alter the input or its meaning.
Anthropic is taking a broader approach by marking Claude’s output even when the model is performing tasks such as proofreading or translation.
That is arguably easier to understand and implement. Anthropic does not have to decide whether a particular editing request crossed some invisible threshold between “assistance” and “generation.”
But it also reinforces the problem with treating the watermark as a simple AI-or-human label. A piece of writing can have substantial human authorship and still be watermarked.
There is another reason not to treat AI watermarks as forensic proof.
Text watermarking is technically difficult because language can be rewritten without changing its meaning. Unlike an image or video file, text can be transformed into a completely different sequence of words while communicating essentially the same information.
Anthropic says its watermark is designed to survive some light editing, but acknowledges that heavier editing can make detection more difficult. Very short text also presents limitations.
Independent research into other text watermarking systems shows why this matters. A 2026 study tested three representative watermarking methods, including KGW, Unigram and a SynthID-Text implementation, against meaning-preserving paraphrasing. In the tested configurations, every initially detected KGW and Unigram watermark disappeared after paraphrasing, while SynthID lost its watermark in 98.3% of the tested cases where a watermark had initially been detected. The researchers also found high false-negative rates even before paraphrasing.
That research does not prove that Anthropic’s watermark has the same weaknesses. Anthropic’s system is proprietary and was not tested in that study.
What it does show is that watermarking faces a fundamental challenge. If the signal is embedded through patterns in word choice or token selection, sufficiently changing those choices can potentially destroy the signal while preserving the meaning.
Google itself acknowledges similar limitations with SynthID-Text. Its documentation says the watermark is resistant to some transformations, but detector confidence can fall substantially when text is thoroughly rewritten or translated.
So there is a difference between saying a watermark is resistant to editing and saying it is permanent. Those should not be treated as the same thing.
Suppose a detector finds a Claude watermark in an article.
What can we confidently conclude?
We can potentially conclude that Claude generated or processed the text.
What can we not conclude from the watermark alone?
We cannot determine how much of the article was originally written by a human. We cannot determine whether the underlying research was conducted by the user. We cannot determine which sources supplied the information. We cannot determine whether the user had permission to use those sources. And we cannot determine whether the final article contains information that Claude learned from a particular publisher’s work.
This is the central weakness in the way AI provenance is often discussed.
There are actually two different provenance questions.
The first is:
Who or what produced this piece of content?
The second is:
Where did the information inside this content come from?
Anthropic’s watermark primarily addresses the first.
Answering the second question remains much harder.
The AI industry’s discussion around transparency often focuses on the output it generates. But publishers have another question.
What happened before the output existed?
A technology publication may spend money sending journalists to events, interviewing executives, testing products and researching technical details. A publication may produce an original report that is then read by millions of people and eventually encountered by AI systems.
If an AI model later produces a response containing information derived from that broader body of online material, the final answer can now carry an AI watermark.
But that watermark says nothing about the original reporting.
It does not tell the reader whether the information came from a journalist, a government document, an academic paper, a product specification or another AI-generated article. And it certainly does not provide a list of every webpage that influenced the model during training.
This is not necessarily because AI companies are hiding a source list. There is a technical reason for it.
A trained language model is not simply a giant database where every sentence is stored next to the URL from which it came. Training processes enormous amounts of material and changes the model’s internal parameters. When the model later generates a response, it generally cannot reconstruct a complete document-by-document history of everything that contributed to its learned knowledge.
That makes perfect training-data attribution extremely difficult.
But difficult does not mean unimportant.
A website can make an article publicly readable without giving everyone a commercial licence to copy, reproduce or reuse that article however they want. Public access and copyright ownership are different things.
At the same time, it would be inaccurate to say that every use of publicly accessible copyrighted material for AI training is automatically illegal. Copyright law does not work that simply. The answer depends on the jurisdiction, the nature and purpose of the use, applicable exceptions, licensing agreements and other factors.
The United States is still working through many of these questions. The US Copyright Office has examined the use of copyrighted works in AI training and the possible application of fair use. Commercial use is relevant to that analysis, but it does not automatically determine the outcome.
The European Union has taken a more explicit approach. Its AI Act requires providers of general-purpose AI models to have policies for complying with EU copyright law and to respect applicable rights reservations under the EU’s text-and-data-mining framework. Providers must also publish a sufficiently detailed summary of the content used to train their models.
So when an AI company says information was publicly available, that should not be interpreted as “the copyright no longer matters.” It simply means the information was accessible.
The legal question is what the company was permitted to do with it.
This creates an interesting imbalance.
Anthropic can potentially tell us:
Claude generated this text.
But that is different from being able to tell us:
These five publishers, three research papers and two public databases supplied the information behind this answer.
The first problem is becoming easier to solve. The second remains extremely difficult.
Anthropic’s move is still a positive development. The internet needs better ways to identify synthetic content. As AI-generated material becomes cheaper and easier to produce, users will need more information about how content was created.
The answer, however, should not be a simplistic label saying “AI” or “human.”
Content creation is already becoming a spectrum. A person can write everything themselves. They can use AI for proofreading. They can ask AI to rewrite a section. They can translate their work using AI. They can ask an AI system to search the web and summarize sources. Or they can give the system a short prompt and publish the resulting article with minimal changes.
All of those workflows are different.
A useful provenance system should be able to reflect that difference.
It could eventually combine model-level watermarks with signed metadata, source citations, and clearer disclosure about how much AI was involved. For files, Anthropic is already using C2PA-based provenance metadata for supported formats, which is designed to record information about the origin and history of digital content.
That layered approach makes more sense than asking one invisible mark to answer every question.
Anthropic is right that people need a way to identify AI-generated content. But identifying AI output is only one part of the problem.
The internet is also facing a growing crisis around information provenance. Publishers want to know how their original reporting is being used. Readers want to know where an AI-generated claim came from. Creators want attribution. AI companies want to establish trust in their systems. Regulators want transparency without requiring technically impossible forms of tracking.
Those interests do not always point in the same direction.
A watermark can help with one part of that problem.
It cannot tell us who deserves credit for an idea. It cannot establish whether copyrighted material was lawfully used to train a model. It cannot reconstruct the complete history of information inside a language model. And it cannot tell us whether a human or an AI should receive primary credit for a piece of work that was created collaboratively.
That is why the real story behind Anthropic’s announcement is not that AI writing is finally getting a hidden label. It is that the technology industry is starting to build an infrastructure for proving where digital content came from.
That infrastructure will be useful. But it will only work if we stop treating AI involvement, authorship, copyright and source attribution as the same thing.
A Claude watermark can tell us that the machine was there.
The harder question is what it did, what it learned from, and who should get credit for everything that came before it.
