Anthropic Watermark: The Company, the Law, the Timeline

Anthropic's Claude support article states it directly: "When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself." That is the company's own sentence, not an inference drawn from marketing copy.

It covers, in Anthropic's own words, "wherever Claude is offered, worldwide." The surfaces named explicitly are:

• Claude Platform, the API
• The Claude apps
• Claude Code
• Claude Cowork
• Claude Tag
• Claude models accessed through AWS, Google Cloud, or Microsoft Foundry

That list is exhaustive for a structural reason. Anthropic's email to administrators, seen September 4, 2026, says the watermark is "applied at the model layer," so it is present everywhere an organization uses Claude rather than integrated product by product. The help page says the same in public: "Watermarking will be applied at the model level, which means it will be present no matter which Claude product or surface the text comes from."

A Claude model hosted on Microsoft Foundry or Amazon Bedrock carries Anthropic's own text watermark passing straight through. Microsoft and Amazon did not build a separate mark for it.

Supported generated files can also carry signed C2PA metadata, and this is the half that is conditional. Anthropic adds the metadata when Claude creates a file, so on a third-party cloud it applies only where that platform offers Claude's file-generation features.

Inside Anthropic's own apps the file side now has a start date, from the same administrator notice. It says files Claude creates in the apps (.png, .jpg, .svg) have carried a C2PA Content Credential since September 1, 2026, while the public help page described file-level provenance with no date as of September 25, 2026.

Models launched on or after August 2, 2026 support machine-readable marking at launch. Models released before that date sit in a transition period, and until September 4, 2026 Anthropic's public record of that transition was one phrase from its August 14, 2026 explainer: marking would reach them "over the coming months."

The administrator notice seen September 4, 2026 put a model and a date into that gap: Claude Opus 5 from September 9, 2026, with other current Claude models "over the coming weeks." Anthropic's documents of September 25, 2026 revise both. The help page table marks Opus 5, and a customer email says its marking began on September 14. The email dates Claude Fable 5, Sonnet 5 and Opus 4.8 from September 30, 2026, and the help page says all models released before August 2, 2026 will be covered by December 2, 2026.

Anthropic has delivered the mechanism explainer and a private detection API, and has not delivered the promised technical documentation. The support article commits Anthropic to supporting detection by users and third parties, and promises technical documentation. On August 14, 2026 part of that arrived: "How Claude's text watermark works," a first-party explanation of the mechanism, published on Anthropic's news site. Rechecked September 3, 2026: the detection API shipped on September 1 in private preview, so researchers and journalists now have a route to apply for and the general public does not.

Be precise about which half landed. The detection API is no longer a promise: Anthropic shipped it on September 1, 2026 in private preview, scoped to regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, EU civil society groups, and enterprises obliged to verify marking. What is still missing is the technical documentation the support article promised, a route for anyone outside those categories, and a date of their own for Mythos 5 and the older 4.x models, which so far have only the December 2, 2026 horizon.

That last gap narrowed on September 4, 2026 and again on September 25, 2026. An email to Claude for Work administrators, seen September 4, named Claude Opus 5 for September 9, 2026 and dated the rest of the current lineup to "over the coming weeks." On September 25 Anthropic's help page table marked Opus 5, a customer email gave September 14 as its start and dated Claude Fable 5, Sonnet 5 and Opus 4.8 to September 30, 2026, and the help page set December 2, 2026 as the date by which every model released before August 2, 2026 is covered. What is still absent is a date for Mythos 5 and each older 4.x model.

The dated record on this page therefore runs: August 2, 2026 for the marking threshold and Article 50 taking effect, August 14 for the mechanism explainer, September 1 for Fable 5.1, Mythos 5.1, the detection preview and the Content Credentials on app-created files, September 4 for the administrator notice, September 14 for Opus 5 marking by Anthropic's later account, September 22 for Opus 5.5, September 25 for the customer email and the help page table, September 30 for Fable 5, Sonnet 5 and Opus 4.8, and December 2, 2026 for everything else released before August 2. The two emails have no public URL beyond this site's screenshots, which is why every claim drawn from them on this site carries the date it was seen and the state of the help page alongside it.

A live detector would not hand out certainty either. Anthropic frames the only question detection can answer as "What is the likelihood this was partly written by Claude?" It "cannot distinguish 'Claude wrote this' from 'Claude heavily edited this'" and "doesn't confirm whether the text was human-written."

The same post says a detection result carries no identifying information about users, organizations, or chats, and that the detector cannot recognize other providers' watermarks, because each provider uses different keys.

The company lists real conditions that defeat the mark:

• Output from a model that predates marking
• Heavy editing or paraphrasing
• Translation into another language
• Watermarked text mixed into a longer document
• Very short passages
• Files whose metadata was stripped by format conversion, re-saving, or a screenshot

The August 14 explainer adds precision on two of those. On editing: "Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will." On translation: a translation Claude itself produces carries the watermark, "because in this case every word is chosen by Claude," so what defeats the mark is someone else translating Claude's output.

Article 50 requires providers of systems generating synthetic audio, image, video, or text to mark outputs in a machine-readable format, detectable as artificially generated or manipulated, as far as technically feasible. It names no specific technology.

The rest of the framework names no vendor product either: not C2PA, not SynthID, not Content Credentials. But the Code of Practice on AI-generated content, published June 10, 2026, is more prescriptive than "technology-neutral" makes it sound. It commits signatories to marking content with an imperceptible watermark, carves out only "very short text" (defined as under 200 tokens), and states that for free-form text longer than 200 tokens "watermarking still needs to be applied, even though it may have lower reliability."

Anthropic is a confirmed signatory of the separate, voluntary Code, one of roughly 190 organizations by the end of July 2026, alongside Google, Meta, Microsoft, Mistral, and OpenAI.

The stakes on paper are substantial: fines up to 15 million euros or 3% of global annual turnover for companies, and up to 750,000 euros for EU institutions. Enforcement sits with national market-surveillance authorities, the AI Office, and the European Data Protection Supervisor.

What is equally real is that no enforcement action, fine, or corrective order under Article 50 had been publicly reported anywhere, against any provider, as of 11 August 2026.

A separate transitional deadline, 2 December 2026, is no longer a matter of interpretation. Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, inserts a new Article 111(4) into the AI Act giving providers of generative systems placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2), the machine-readable marking and detectability obligation. Recital 38 calls it "a transitional period of four months."

Two limits on that grace period are worth stating, because both get lost in summaries. It reaches only providers of systems generating synthetic content, not every provider under the Act. And it covers Article 50(2) alone. The chatbot-disclosure duty in Article 50(1) had no grace period and applied from 2 August 2026. Separately, the same regulation makes certain new Article 5 prohibitions apply from 2 December too, which is why that date gets described as broader than it is for marking purposes.

None of this proves what Anthropic built. Regulatory deadlines explain why a company might ship a marking feature on a particular date, and they are no substitute for technical documentation, which is now half-delivered: the mechanism explanation was published on August 14, 2026, and the detection API has been in private preview since September 1, 2026, while the promised technical documentation has not appeared.

The SynthID-like guess was right and the hidden-Unicode guess was wrong, both settled by Anthropic's August 14, 2026 explainer. For the rollout's first twelve days Anthropic named no mechanism, so guessing filled the space. On r/singularity, a thread that accurately summarized the rollout produced a long menu of theories:

• Hidden Unicode characters
• Statistical word-choice patterns and overrepresented n-grams
• First-letter or sentence-position patterns
• Token-probability nudges
• Something SynthID-like, borrowed from Google
• A hybrid combining several signals

Trade press, cryptobriefing.com among them, had described the mechanism as biasing the model's word choices during generation, comparable to Google's SynthID, without a primary source. On August 14, 2026 that comparison became disclosure: Anthropic's own explainer calls the watermark "a version of the SynthID-Text approach published by Google DeepMind," in "a family of approaches that go back to a proposal by Scott Aaronson in 2022," with a secret key plus "a few words that come before" determining which eligible next word gets picked among meaning-preserving candidates.

The same post states: "Nothing is added to the text and there are no hidden characters." That retires the hidden-Unicode theory from the primary source itself, while the exact algorithm, key handling, and detector math remain unpublished.

One independent blogger, Sean Goedecke, went further on July 2, 2026, before the rollout. He argued published text watermarks are trivially removable and claimed Claude Code once used Unicode homoglyphs in date strings as a since-discontinued internal flag.

That is a single uncorroborated source describing a different technique from anything Anthropic has confirmed, and the article that might have backed it up returned an access error when checked. Do not upgrade it past community speculation.

A separate r/ClaudeAI thread asking bluntly how to remove the watermark split into two camps. One treated the question as suspicious, tied to academic-honesty norms; the other framed the mark as unwanted vendor tracking bundled into paid output, a consumer-rights argument about who owns clean text after delivery.

The two removal methods that came up there, rewriting by hand or running text through a second model to add noise, got a partial first-party answer on August 14: Anthropic says "Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will." That is Anthropic describing its own scheme's limits, not a verified third-party bypass, and with the detector in a private preview almost nobody qualifies for, no tool you can run measures the result either way.

The code worry got a direct answer too. Anthropic says the watermark isn't applied where a task requires an exact output, that code "has generally less watermarking than some other forms of text," and that comments are watermarked with "a negligible effect on the actual code produced."