Claude Watermarks Its Output. Nobody Can Check It.

On August 11, 2026, a support article appeared on Anthropic's help site: How Claude marks AI-generated content. Claude's output now carries a watermark. Text gets an invisible statistical mark. Files get signed provenance metadata. It applies everywhere: the API, claude.ai, Claude Code, Claude Cowork, and Claude running on AWS, Google Cloud, and Microsoft Foundry. Worldwide, not just in the EU. There is no opt-out.

I build software with Claude every day, so I read the primary sources before forming an opinion. The result is less dramatic than the headlines and more interesting than the shrug.

What Anthropic actually shipped

Two separate mechanisms, and the difference matters.

Text gets a statistical watermark. In Anthropic's words, Claude "weaves an imperceptible watermark directly into the text itself. You won't see it, and it doesn't change the meaning, quality, or readability of Claude's response." The important part is where it happens: at the model level, not in the app. That is why the raw API is covered and why no wrapper, proxy, or self-hosted frontend escapes it.

Files get C2PA metadata. SVG, PNG, and JPG files that Claude generates or processes get a digitally signed C2PA manifest. That is the open Content Credentials standard: assertions plus a signed claim, embedded in the file itself.

Anthropic has not published the text algorithm. The informed guess across Hacker News and independent analysts is a green-list scheme in the Kirchenbauer family, or something close to Google's SynthID-Text: a keyed generator splits the vocabulary at every token, sampling tilts toward one half, and a detector holding the key counts the bias. Plausible, consistent with the described behavior, and unconfirmed. Treat it as speculation until Anthropic publishes.

Almost nothing is marked yet

Here is the part every write-up buried. The marking applies to "Claude models launched in the EU on or after August 2, 2026." Sonnet 5 shipped June 30. Opus 5 shipped July 24. Anything released before the cutover sits in what Anthropic calls a transition period, where the company is "working to add marking support for those models as well." No date. No model-by-model matrix has been published.

So a large share of the models in production use today may not carry the mark at all. You cannot check which, and that is the real story.

There is no detector

Anthropic: "We'll share details on detection mechanisms in forthcoming technical documentation." That is the entire public position on verification.

Read what that means in practice. Anthropic can prove a passage came from Claude. You cannot prove one did not. You cannot audit your own pipeline. You cannot test whether your CMS, your CDN, or your export path preserves or destroys the mark. No researcher, no enterprise customer, and no regulator can independently confirm a single claim in the support article.

Compare the alternatives. Google open-sourced SynthID-Text in October 2024 and ships a public detector. OpenAI built a text watermark reported at 99.9% accuracy, then shelved it after an internal survey found 30% of users would leave. Anthropic has taken a third path: ship the mark, withhold the key.

There is also a false-positive problem baked into the design. Anthropic states that a detected mark means content "may have been processed by Claude," and lists proofreading, translation, summarizing, and file conversion as marking events. A document you wrote yourself and asked Claude to proofread carries the same signal as one Claude wrote from nothing. Anyone treating the mark as proof of authorship will be wrong on a regular basis, and universities and employers are exactly the institutions most likely to try.

The law does not require that part. Article 50(2) exempts systems that "perform an assistive function for standard editing" or that do not substantially alter the input. Marking text Claude merely proofread goes past the legal minimum, which makes it a product decision rather than a Brussels mandate. Someone on Reddit spotted this within hours of the announcement, and it is the sharpest thing said about the story anywhere.

The Unicode story is wrong

This is the one to correct, because a whole cottage industry is built on it.

Zero-width spaces. Zero-width joiners. U+202F narrow no-break space. Em-dashes. None of these are Claude's watermark. None of them ever were.

The panic started in April 2025, when OpenAI's o3 and o4-mini began emitting U+202F and people called it a watermark. OpenAI's explanation was training data: narrow no-break space is correct French typography, the models had read a lot of professionally typeset multilingual text, and the behavior was later reduced. It was a typography artifact, not a signature.

A statistical watermark lives in which words the model picked. It has no characters to grep for. You can verify this yourself in about ten seconds:

$ node -e "const s = require('fs').readFileSync(0, 'utf8');
  const invisible = /[\u200B-\u200D\u2060\u202F\uFEFF]/;
  console.log([...s].filter(c => invisible.test(c)).length)" < claude-output.txt
0
# zero invisible characters. the mark is not in the bytes.

This is not a fringe misreading. It is the single most common claim in every large thread about the announcement: strip the non-printing characters and you are clean. A top comment on r/technology corrected it for 1.7k upvotes, and the correction still did not catch up with the myth.

Removal tools appeared the same day. One predicted it in the morning ("I predict there will be software to remove the watermark by the end of the day," 284 upvotes) and someone posted a link by the afternoon. The revealing part is the disclaimer on the tool itself, which concedes that Anthropic has shipped no public detector and that the product works by paraphrasing through a non-Claude model. That is an honest description of a product that cannot verify its own effect.

Which is the real answer on removal: resample the tokens. Paraphrase through a different model, translate and back-translate, or rewrite substantially. Anthropic says so itself, listing paraphrasing, heavy editing, and translation as reasons a mark will not be detected. Headlines calling it "almost impossible to remove" contradict the vendor's own documentation. Two things that do not work, both widely recommended: stripping invisible characters, and retyping the text by hand. If the mark is in the word choices, your fingers reproduce it faithfully.

Nobody has tested any of this

I went through roughly 2,500 comments across the biggest threads looking for one thing: somebody who actually measured something. A before-and-after diff of the same prompt. A token-distribution analysis. A detector run.

There is not one. The closest anyone got was piping Claude's output through an ASCII converter and finding non-convertible characters, which detects curly quotes and en-dashes, not a watermark. Someone else posted a working zero-width-character steganography demo, which is a real demonstration of an unrelated technique.

That absence is not laziness. It is structural. There is no detector to run, and by the community's own reading no shipping model carries the mark yet. So the entire internet spent a day arguing about a mechanism nobody can observe, in models that do not have it, using a tool that does not exist.

The reaction also split cleanly by who was talking. Claude's own subreddits ran roughly two to one against, mostly on code quality and the proofreading false positive. r/de, the student subs and the general tech subs were supportive, sometimes openly amused at the outrage. The most upvoted comment anywhere was not an argument at all, it was an analogy: "The modern equivalent of cartographers putting in fake towns and roads on their maps to catch people that copy them."

One more thing stood out. Across all of it, the C2PA half of the announcement drew about two comments. The file provenance, the part with an actual open specification and an actual verifiable signature, went almost entirely undiscussed while everyone argued about the invisible half.

What survives and what kills it

For text, the rule is simple: preserve the tokens and you preserve the mark.

Copy and paste survives. Storing in a database survives. HTML to Markdown survives. RAG chunks stay marked, and if a downstream model paraphrases them, the mark dies there. Short passages carry no detectable signal at all, which Anthropic confirms by listing "the passage is very short" as a failure case. Commit subjects, alt text, meta descriptions, and button labels are all below threshold. A pull request body, an ADR, or a generated README is long enough.

For files, the rule is harsher: any re-encode destroys the C2PA manifest, and it leaves no trace that a manifest was ever there. Run a Claude-authored SVG or PNG through next/image, Sharp, imagemin, or a Cloudinary transform and the Content Credential is gone. Every consumer platform that re-encodes on upload does the same. C2PA's own answer is Durable Content Credentials, which pair the metadata with a soft-binding watermark that survives re-encoding, and there is no indication Anthropic implements those. So the file provenance you may be counting on does not survive a normal web image pipeline.

Your source code is fine

Three independent reasons, and you only need one.

It is legally exempt. The European Commission's final Article 50 guidelines, published July 20, 2026, carve source code out of the marking obligation, explicitly including SDKs, SQL, Infrastructure as Code, and YAML and JSON configuration.

Code is a bad host for a watermark. Watermarking works by choosing between roughly equivalent tokens. Code has almost no such freedom: an identifier must match its declaration, syntax is rigid, and the entropy the scheme needs lives only in docstrings, string literals, and naming. The research on this (SWEET, and the 2026 FORC paper on low-entropy outputs) is about how much signal you lose when you skip syntax-critical tokens. The answer is most of it.

Your toolchain would erase it anyway. Prettier, gofmt, black, rustfmt, eslint --fix, a rename refactor: each one resamples the token stream. Format on save is, functionally, a watermark attack you run a hundred times a day.

The loudest developer objection runs the other way: that watermarking must degrade output, and worst in code, because technical writing uses a fixed lexicon with no room for synonym substitution. The concern is reasonable and it is probably inverted. If the sampling is distortion-free, low-entropy text does not get a corrupted watermark, it gets no watermark. Constrained prose is the case where there is nothing to embed, not the case where embedding does damage. Nobody has measured either way, which is the recurring theme here.

One caveat worth not papering over: Anthropic's article says "all generated text," and does not say whether code is excluded. The EU exemption is a fact about the regulation, not a statement from Anthropic. Some coverage has collapsed the two. Do not.

What this actually means for a German SMB

Nobody is going to fine your company for Anthropic's watermark. The provider obligation is Anthropic's problem. Yours is the deployer obligation, and it is not technical.

Article 50 of the AI Act became applicable on August 2, 2026. Systems already on the market get until December 2, 2026. In Germany, the KI-MIG took effect on July 29, 2026, and the Bundesnetzagentur is now the market surveillance authority. Penalties reach 15 million euros or 3% of worldwide annual turnover.

The two clauses that reach you:

Article 50(4), deepfakes: AI-generated or manipulated image, audio, or video content that resembles real people, places, or events must be disclosed to the people seeing it.

Article 50(4), published text: AI-generated text published to inform the public on matters of public interest must be labelled. The exemption is human editorial review, and the guidelines set a real bar: the review must be a substantive check of the content itself. Formal or procedural sign-off does not count, and the exemption is void if AI is applied again after the review.

Note what an invisible watermark does for either of these: nothing. Machine-readable is not human-visible. The disclosure has to be clear, distinguishable, and delivered no later than the first time a person encounters the content. Anthropic's mark discharges Anthropic's duty, not yours.

Which makes this a process question. Who reviewed what, when, and did anything touch it afterwards. If you have that written down, you are compliant and you can prove it. If you do not, an invisible watermark will not save you.

What to check in your own setup

• Whether you can name the exact model behind any client-facing output. Model ID, endpoint, region. When the marking matrix is finally published, that question gets answered from a record or not at all.
• Whether your image pipeline preserves C2PA. Push a Claude-generated SVG through your real build and inspect the output. Assume it is stripped until you have seen otherwise.
• Whether your human review is documented rather than assumed. A named person, a date, and a note on what was actually checked. That is the Article 50(4) exemption, and it only exists if it is written down.
• Whether any disclosure you rely on is visible. If a label is required, it is text on the page. No invisible mechanism should be load-bearing for compliance.

None of this is new work. It is the paperwork side of a workflow you are probably already running. If you are shipping AI-assisted output without that record, the gap is worth closing before December.

The honest footer

I researched this post with Claude, then read every line of it before publishing. Both of those steps are the point.

Anthropic has not published which models carry the mark, and there is no detector. So whether these sentences are watermarked is, at this moment, unknowable to me and to you. That is a fairly precise illustration of the gap: the mark exists, the obligation is real, and verification is somebody else's roadmap.

Primary sources: Anthropic support article · EU Commission Article 50 Q&A · Code of Practice on Transparency of AI-generated Content · C2PA Specification 2.2 · TechCrunch · The Register · heise, opinion