Anthropic’s decision to embed machine-readable marks in Claude’s output, announced this week to comply with the EU AI Act’s Article 50(2) Code of Practice, is being covered as a broad AI-transparency milestone. It’s narrower than that framing suggests, and the narrowness is itself the more interesting story.
Here’s what the policy actually says, how it holds up against the law’s own technical standard, and where the real gaps are.
What’s Actually Covered (And What Isn’t)
Anthropic’s Help Center article describes two mechanisms: an imperceptible watermark woven into generated text, and signed C2PA provenance metadata attached to generated files, specifically formats like .svg, .png, and .jpg.
That’s it. There is no audio marking and no video marking in this announcement, because Claude does not natively generate audio or video output. This matters because Article 50(2) of the AI Act is written to cover all four content types: providers of AI systems “generating synthetic audio, image, video or text content” must ensure outputs are marked and detectable (EU AI Act, Article 50). Anthropic’s obligation under that clause is simply narrower than a company like Google’s, since Google’s Gemini already produces audio and video and therefore has to mark all four modalities. Its SynthID system is used across “text, photos, audio and video,” according to industry coverage of watermarking adoption. If Claude adds native audio or video generation later, that would require separate compliance work not addressed by this announcement.
Coverage otherwise is broad by product surface: marking applies across the API, Claude’s chat interface, Claude Code, Claude Cowork, and Claude Tag, worldwide, not just for EU users, for models launched on or after August 2, 2026. Older models are explicitly not yet covered. Anthropic says it’s working to retrofit them during the law’s transition period.
Why Global, Not Just EU
This point deserves its own line rather than a passing clause, because it’s a choice, not a legal obligation. Article 50(2) only binds AI systems used within the EU. Nothing in the regulation compels Anthropic to mark a response generated for a user in Singapore or São Paulo. Anthropic did it anyway: marking applies to supported models everywhere Claude is offered, including through third-party access points like AWS, Google Cloud, and Microsoft Foundry, not just for EU traffic.
The likely reason is operational rather than principled. Maintaining two separate code paths, one that watermarks EU-bound output and one that doesn’t, would mean building and testing a regional detection system for a single jurisdiction. Shipping one global behavior is simpler and cheaper. The practical effect is that the EU’s transparency standard becomes the de facto global standard for Claude output, regardless of where the user sits or whether their own jurisdiction has any equivalent rule. That’s a familiar pattern in tech regulation, sometimes called the Brussels Effect: a rule written for one market ends up shaping a product everywhere, because it’s more efficient for a vendor to comply once than to fragment its own system.
The Mechanism: Bias in the Machine (Inferred, Not Confirmed)
The likely mechanism, based on published watermarking research rather than any technical disclosure from Anthropic, works like this. As Claude generates text, it calculates probabilities across many near-equivalent next-token choices. A watermarking scheme can use a cryptographic key to consistently nudge selection toward a specific subset of tokens (a “green list”). A detector holding the key can then measure whether a text’s token distribution deviates from chance in the expected direction.
It’s worth being explicit that Anthropic has not published its implementation, so this is informed speculation, not a confirmed description of Claude’s watermark. Anthropic states only that the mark “doesn’t change the meaning, quality, or readability” of output and that it can survive some copying and light editing. It does not explain how.
The Viability Question: Where the Math Gets Hard
The AI Act does not require perfection. The statute’s actual language requires technical solutions to be “effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art” (Article 50(2)). That feasibility clause is doing a lot of work. Legal commentary reads it as establishing “a principle of technological proportionality: the obligation is not one of absolute result, but of adopting the best reasonably available solutions” (NicFab, “The Code Before the Guidelines”). The Code of Practice itself carves out very short text, under 200 tokens, by its own glossary, from the watermarking requirement entirely, precisely because there isn’t enough signal to work with below that length.
So the framing of a “collision” between what the law demands and what math can deliver is a bit dramatic. The law was written with these limits in mind.
That doesn’t mean the underlying technical fragility isn’t real. It is, and it’s worse than casual coverage suggests.
Low-Entropy Content (Code, Structured Text)
Watermarking depends on having many interchangeable word choices available at each step. Source code offers little of that: syntax is rigid, identifiers must match declarations exactly, and a standard formatter pass (Prettier, Black) can scramble whatever token-level signal survived. This reasoning tracks published watermarking literature, though again, it isn’t confirmed as how Claude’s scheme specifically behaves.
Evasion Is Not Theoretical
This is where your draft understated the case. Independent research is considerably more damning than a generic “paraphrasing destroys it” claim:
| Attack Vector | What’s Actually Documented |
|---|---|
| API-based reverse engineering | Researchers from ETH Zurich’s SRI Lab, presented at ICML 2024, showed an attacker who queries a watermarked model’s public API can reconstruct the scheme well enough to both strip the watermark from AI text and forge it onto human-written text: over 80% success, for under $50 in query costs, against schemes previously considered secure (Cloud Security Alliance research note). |
| Targeted rewriting of high-entropy tokens | A follow-up technique presented at ICML 2025, the Self-Information Rewrite Attack, defeats schemes that deliberately embed their signal in high-entropy tokens (a design choice meant to preserve quality) by identifying and selectively rewriting exactly those tokens, removing most of the watermark while keeping the meaning intact (same source). |
| Paraphrasing, translation, or heavy editing | Anthropic’s own documentation acknowledges the mark may not survive text that has been “heavily edited, paraphrased, translated, or mixed into other writing.” |
| Very short passages | Explicitly excluded from the marking regime under the Code’s own glossary (sub-200-token text), and separately acknowledged by Anthropic as providing “too little text for a reliable signal.” |
Also worth noting, as a partial counter to the “watermarks are trivially useless” narrative: false positives on unmarked human writing are less likely than intuition suggests. The space of everything a model like Claude could plausibly output is far larger than the narrower space of specifically watermarked outputs, so a human would have to accidentally reproduce a fairly specific statistical pattern, not just “write like an AI” (Sean Goedecke).
The “Processed By” vs. “Authored By” Problem
This is the strongest point in the original draft, and it’s stronger still once you notice it isn’t an outside critique. It’s Anthropic’s own stated limitation, printed in its own compliance documentation:
- A detected mark does not confirm authorship. People routinely use Claude to proofread, translate, summarize, or convert existing material; the output can carry a Claude mark “even if the underlying ideas, text, or data originated from another source.”
- Marked content can be “modified, excerpted, or combined with other material” after Claude touches it.
- Conversely, the absence of a mark proves nothing either. It can result from an older model, heavy editing, very short passages, or a platform or file type that doesn’t support marking.
Formatting is a useful edge case here. If a human writes a document and asks Claude to restructure or clean up the prose, Claude regenerates the text token by token, so the output can carry the mark even though every idea is the human’s. But if Claude (or a tool it calls) only applies styling, headers, or a file conversion without regenerating the sentences, there may be no newly generated text for a watermark to attach to at all. Anthropic doesn’t spell out this distinction, so it’s inference from the mechanism, not a confirmed claim, but it sharpens the same point: a mark tracks how text was produced, not who wrote it.
In other words, Anthropic is explicitly telling downstream users not to treat a detected watermark as a chain-of-custody claim. For academic, journalistic, and legal use cases where “was this AI-written” carries real stakes, that’s the load-bearing caveat: not a hypothetical raised by critics, but a limitation printed in the company’s own help documentation.
What Presence and Absence Actually Signal
Pull the previous point one level tighter, and the asymmetry becomes the real story. Neither a detected mark nor a missing one carries the meaning most readers assume.
A detected watermark means only this: the text passed through a Claude model that supports marking, at some point, for a long enough stretch to leave a measurable signal. It does not mean Claude authored the substance (someone may have used it only to fix grammar on an otherwise human-written essay), that the content is unedited or final (marked text can be excerpted or spliced into other material afterward), or that the content is accurate. A watermark is a provenance signal, not a truth signal.
No detected watermark means only this: the detector found nothing. That is consistent with a human having written the whole thing, but it is equally consistent with an older or unsupported model, a passage too short to carry a signal (under the roughly 200-token floor), or AI-written text that was subsequently paraphrased, translated, or rewritten enough to erase the mark. Absence rules almost nothing out.
The gap between those two readings is exactly where deliberate evasion lives, and it runs in both directions:
- Scrubbing (erasing a real mark). Paraphrasing, translation, or the targeted high-entropy-token rewriting demonstrated in the ICML 2025 research can strip a genuine watermark from AI text while leaving its meaning intact.
- Spoofing (forging a mark that isn’t there, or isn’t there when it should be). The ETH Zurich SRI Lab work is the sharper half of this problem: by querying a watermarked model’s public API enough times, researchers reverse-engineered the scheme well enough to impose a fake watermark signature onto human-written text, not merely remove a real one. That means, in principle, genuine human writing could be made to test positive as AI-generated, or AI writing could be made to test negative, cheaply and on demand.
So the signal is weak and leaky on both sides: presence is soft evidence that AI touched the text somewhere in its history, not proof of authorship; absence is soft evidence of almost nothing, since there are far more ways to produce a negative result than “a human wrote every word.” Neither direction holds up against someone who specifically wants to defeat it, and Anthropic’s own documentation concedes exactly this rather than overselling it.
Image Metadata: A Different Failure Mode
C2PA provenance metadata fails differently than the text watermark. It’s not adversarially defeated so much as incidentally destroyed: it can “disappear during format conversions, screenshots, or re-saving,” which is ordinary, non-adversarial handling of a file, not a deliberate evasion attempt. Open-source tools for stripping C2PA metadata already exist, lowering the bar further for anyone who does want to remove it deliberately.
Audio and Video: The Actual Gap
To be direct about what the brief for this piece was asking: this policy does not touch audio or video at all, and neither the coverage nor Anthropic’s own materials pretend otherwise. That’s not a flaw in Anthropic’s compliance (a company isn’t obligated to mark content types it doesn’t generate), but it is a gap worth naming plainly if you’re evaluating “the EU watermarking regime” as a whole rather than just Anthropic’s slice of it. A reader who assumes Claude’s rollout means “all AI content is now traceable” would be wrong on two counts: modality (audio and video are untouched) and certainty (even covered text and image marks are explicitly non-conclusive, per Anthropic itself).
The Bottom Line
Anthropic’s system is a good-faith implementation of a law that already concedes its own limits. The “as far as technically feasible” clause and the sub-200-token carve-out show the statute anticipating exactly the fragility described above, not assuming an unbreakable tag. But legal proportionality isn’t the same as real-world proportionality, and public concern here isn’t overblown.
The real mismatch is between what Anthropic discloses and what the people relying on a detection result ever see. A professor, a hiring manager, a court, none of them read Anthropic’s help center before acting on a mark’s presence or absence. And the risk isn’t hypothetical: the ETH Zurich attack spoofed watermarks onto human-written text at over 80% success for under $50. That’s a demonstrated capability, not a media-framing problem. Anthropic’s compliance and its candor are both real. Neither reaches the moment someone actually relies on the signal, and nothing in Article 50(2) requires that gap to close.