BRUSSELS, 11 AUG 2026 — Anthropic has committed to watermarking the text Claude produces and signing the files it generates, in response to the EU AI Act. The file half is a solved engineering problem. The text half is not.
The commitment means generated text will carry embedded watermarks, and generated files will include digitally signed C2PA provenance metadata where the format supports it. It applies to output from supported models globally rather than only in the EU, and covers the Claude API, the Claude products including Claude Code, and the models offered through AWS, Google Cloud and Microsoft Foundry.
The trigger is Article 50 of the EU AI Act, the transparency provision. Models launched on or after 2 August 2026 support marking at launch; earlier models are covered by a transition period the law allows, and Anthropic describes that work as in progress.
Two different promises
These are not two versions of the same measure and they should not be reported as one.
Signing a file is cryptography. C2PA attaches a manifest, signs it with a key, and anyone with the public key can verify that the file came from where it claims and has not been altered since. It works and is already deployed in cameras and editing software. Its failure mode is honest — strip the manifest and the file simply has no provenance, rather than a false one.
Watermarking text is a different discipline with a worse track record. There is no manifest to attach — the mark has to live in the choice of words, which means it must survive being read, rewritten and passed through another model, while remaining invisible to a reader. Those requirements pull against each other.
Why text watermarks are hard
The mechanism works by biasing the model's word choices into a statistically recognizable pattern. This gives it two properties that undermine its use as a control.
It degrades with editing. Paraphrase a watermarked paragraph, translate it, or ask a second model to rewrite it, and the statistical signal thins out. There is no clear failure point, which is worse than having one. The detector's confidence just declines gradually, leaving the user with no way to know where they are on that curve.
And it is only present when the vendor puts it there. An open-weights model run locally has no such marking and no way to require it — which is exactly what shipped this week when Meta released a 30-billion-parameter agent model under Apache 2.0. Anyone wanting unmarked text has an unmarked generator, free, permanently.
The missing half is verification
A mark nobody can check is a promise, not a control. This is the part of the commitment that has yet to be delivered.
For C2PA, verification is a solved problem — it is public-key cryptography, and anyone can do it. For the text watermark, detection typically requires the vendor's own detector, because the pattern is a secret — publishing it would tell people how to remove it. That leaves the entity claiming provenance and the entity able to verify it as the same company.
Anthropic's documentation is direct about this gap. It says the company is working to enable users and third parties to detect the marks, that technical documentation is forthcoming, and that detection is not available to the public today. It also states, carefully, that a mark indicates content may have been processed by Claude and is a signal rather than conclusive proof of origin.
That last sentence is the most useful thing in the announcement, and it is the one least likely to survive into general coverage. A signal that is not conclusive is exactly what an employer, a teacher or a court should be told before anyone acts on a result.
Consider what a person would actually do with this. A teacher, an editor, a court, an employer: each wants to ask whether a piece of text came from Claude. If the answer requires submitting the text to Anthropic and trusting the reply, that is a service, not a standard, and its usefulness depends on terms nobody has published.
None of this makes the commitment worthless. It raises the cost of casual passing-off and it puts a marker in the default path, which is where most volume flows. It does not do what a reader hearing "watermark" will assume it does, which is let them check.
The regulation is having an effect
This happened because of the EU AI Act. The commitment is global rather than EU-only, which is the Brussels effect working as designed — the compliance cost of running two pipelines exceeds the cost of marking everything.
That is a concrete result for the regulation, arriving before the enforcement machinery even had to act. It is also the easy part. Transparency obligations are the least contested provisions in the Act, and a marking commitment is cheap for a vendor whose product is already centralised behind an API.
What to watch
Whether a detector becomes publicly available, and on what terms. This is the single question that decides whether the text watermark is a control or an assurance.
Whether other labs follow, and whether they converge on a shared scheme. Per-vendor watermarks with per-vendor detectors give a verifier the job of asking every lab in turn, which is not a workable design.
And what the transition period turns out to be. Existing released models are covered by an allowance with no published dates, which is where the practical answer to "is this text marked?" actually lives for the next year.
View author profile → · Editorial policy
