AI text watermarking is here. What it is, who uses it, and what it means for your work

I want to admit something. When I first read that Claude would put an invisible watermark into every text it writes, my first reaction was: “How? Text is just words. You cannot stamp a word.”

It turns out you can. Sort of. And the way it works is clever, a little strange, and very important for anyone who uses AI at work.

So let me explain it the way I would explain it to my kids. Then we will look at what it means for your emails, your contracts, and your business.

What happened, in one paragraph

On 11 August 2026, Anthropic announced that Claude now marks the text it writes with a hidden watermark (Anthropic help centre, Anthropic technical explainer). It uses a method called SynthID-Text, invented by Google DeepMind and published in the science journal Nature in October 2024 (Dathathri et al., Nature 2024). Google has used it in the Gemini app since 2024. As far as public announcements go, Anthropic is the first major provider after Google to switch it on for text. It applies to Claude everywhere: the app, the API, Claude Code, and Claude sold through Amazon, Google and Microsoft clouds. There is no off switch. And the reason it is happening now has a name: Article 50 of the EU AI Act, which applies from 2 August 2026 (Article 50).

That is the news. Now the fun part: how on earth does it work?

How can you hide a watermark inside words?

Here is the trick. An AI model does not “know” what it wants to say. At every step, it looks at a list of possible next words. Each word gets a chance, a bit like a weighted lottery. (If you want to see this happen live, with animations, read How generative text AI works: how LLMs choose what to say.)

Take the sentence: “The meeting was …” and ask the AI to predict which word should fill in the blank.

The model might think: “useful” has a 40 % chance, “productive” 30 %, “helpful” 20 %, “great” 10 %, “burrito” 0.003 %. Then it rolls the dice and picks one.

A watermark changes how the dice are rolled. Nothing else.

Think of it like this. Imagine a coin that is very slightly bent. If you flip it once, you cannot tell. If you flip it 500 times, you notice that heads comes up a bit too often. The watermark is that slight bend. It nudges the model to prefer certain words at certain moments. The words still make sense. The meaning does not change. But over hundreds of words, the nudges form a pattern.

And here is the important part: only the person who knows the secret key can see the pattern. The key decides which words get the nudge. Without the key, the text just looks like normal text.

The slightly deeper version (still no maths)

If you want to sound clever at your next meeting, here is what SynthID-Text actually does, according to the Nature paper:

1. It looks at the last few words. The model takes the four words it just wrote and mixes them with a secret key. This creates a random-looking number, called a seed. (Nature paper)
2. It gives every candidate word a hidden score. Using that seed, every possible next word gets a hidden score. In the simplest version, the score is just 0 or 1. Google calls these “g-values”.
3. It runs a little tournament. The model draws several candidate words from its normal list. They compete in pairs. The word with the higher hidden score wins. The winner is written down. This is called tournament sampling.
4. Checking works in reverse. To check a text, you take the same key, recompute the hidden scores for every word, and add them up. Human text scores about average. Watermarked text scores too high to be luck.

The clever bit is that this only touches the very last step, when the model picks a word. The model itself is not changed. Anthropic says the watermark “only changes the source of the randomness used to pick among words” (Anthropic). Google tested it on nearly 20 million real Gemini answers. People rated watermarked and unwatermarked answers the same, with a difference of 0.01 % (Nature paper).

In November 2022, Scott Aaronson at OpenAI gave a talk about the idea (TechCrunch, Dec 2022). In January 2023, a team at the University of Maryland published the first well-known method, the “red list, green list” approach (Kirchenbauer et al., ICML 2023).

Who is using it? A provider by provider check

This is where it gets messy. Not everyone is doing the same thing.

So today, if you use Claude or Gemini, your AI text is (or soon will be) watermarked. If you use ChatGPT or Copilot, it is not. Yet.

When does the watermark apply, and when does it not?

This is the question I get asked most. And the answer is simple once you remember how it works: the watermark lives in word choices. Where there is no choice, there is no watermark.

Watermark works well:
– Emails, letters, blog posts, summaries, reports, research, product descriptions
– Chat answers, brainstorming, first drafts
– Translations written by the AI (it picks every word, so it can nudge every word)

Watermark is weak or absent:
– Program code. Anthropic says watermarking on code is “minimal”. If one word is wrong, the code breaks. So the model does not get to “choose”. Only comments and variable names carry a mark (Anthropic, TechCrunch).
– Facts, numbers, formulas. Google notes the watermark is “less effective on factual responses”. There is only one right answer to “What is the capital of France?” (Google DeepMind).
– Exact quotes and citations.
– Very short answers. A one-line reply has too few “coin flips” to prove anything.
– Text you wrote and the AI only lightly edited. If Claude only fixed your commas, it chose almost no words. Little or no signal.
– Text that was later heavily rewritten or translated by a human or another tool. Google says the mark survives cropping, changing a few words, and mild paraphrasing. It breaks under thorough rewriting and translation (Google).

Here is what this means for accuracy. A lot of people worry: “Will the watermark make my AI text less accurate, because it swaps in a ‘random’ word?” The honest answer, based on the design: it is built to nudge only where several words are equally fine. Anthropic says it avoids marking where “something would be factually wrong or a piece of code would break if a different term was chosen”. Google’s 20-million-answer test found no quality drop people could see. But (and this is a real but) “equally fine” is judged by the model, not by your lawyer. Hold that thought. We come back to it below.

How does checking actually work? And who can check?

Now the part that matters for your business.

To check a text, you need the secret key. Without the key, you cannot recompute the hidden scores. The maths simply does not work. That is the whole point: it keeps fakers from copying the pattern.

But it also means: only Anthropic can check for Claude’s watermark. Only Google can check for Gemini’s.

So what happens if you are a school, a court, or a company that wants to know “was any AI used in this document”? Today, honestly, you would have to:

1. Ask Google’s detector (waitlist, mainly journalists and researchers).
2. Ask Anthropic’s detector (promised, not yet available as of mid-August 2026).
3. Accept that OpenAI, Microsoft, Meta and most others cannot be checked at all, because they do not watermark text.

Is there a central body that holds all the keys? No. Not today, and not planned. The EU AI Act does not create one. It says providers must mark their outputs in a “machine-readable format” and make detection possible (Article 50(2), Recital 133). The EU Code of Practice, finalised in June 2026, asks providers to offer detection tools and to work on “interoperable” methods. But each provider still keeps its own key (TechPolicy.press). For images, there is a shared standard called C2PA that stores origin data in the file. There is nothing like that for plain text, because text has no “file” to attach it to. Copy and paste, and it is gone.

My honest take: I expect that within two or three years there will be a broker service, or a public detector under EU supervision, where you paste a text and it queries all major providers. That is the logical next step, and Google’s detector portal is a first version of it. But right now, no such thing exists. Anyone selling you a “checks all AI watermarks” tool today is selling you a guess.

Could a normal human text be flagged as AI by accident?

This is a smart question, and the answer is reassuring, with one catch.

Remember the bent coin. If you flip a normal coin 10 times and get 7 heads, that is not proof of anything. Normal coins do that all the time. So a good detector does not “guess” on short texts. It says “not sure”. Google’s detector actually has three answers: watermarked, not watermarked, and uncertain (Google).

The threshold is set the other way round from what most people expect. The provider decides “I accept that 1 in 100 human texts (or 1 in 1,000, or 1 in 10,000) will be flagged by mistake”, and sets the bar so that this stays true no matter how long the text is. In the Nature paper, the tests use a 1 % false alarm rate on texts of about 400 tokens (roughly 300 words). Shorter text does not raise the false alarm rate. It just means more AI text slips through unnoticed (Nature paper).

So could your short human email be flagged? Very unlikely. On short text, the honest answer from a well-built detector is “not sure”, not “Written with AI”.

The catch: 1 in 100 is still 1 in 100. If a university runs 50,000 essays through a detector set at 1 % false alarms, 500 human-written essays get flagged. That is why the EU, Google and Anthropic all say the same thing: a watermark result is a signal, not proof. Anthropic writes that a mark means content “may have been processed by Claude”, not that Claude wrote it, and that marks “may appear on human-written text that Claude only edited or translated” (Anthropic help centre). Nobody should lose a job, a grade or a court case on a watermark score alone.

Why is the EU AI Act behind all of this?

Because the law now says so. Here is the timeline.

Article 50(2) of the EU AI Act says: providers of AI systems that generate text, images, audio or video must make sure the output is “marked in a machine-readable format and detectable as artificially generated”. This applies from 2 August 2026 (Article 50). Anthropic announced its watermark nine days later. That is not a coincidence.

There are exemptions. The marking duty does not apply where the AI only helps with “standard editing” or does not “substantially alter” your input. The Commission’s guidelines say spellchecking, grammar fixes, quality touch-ups and format changes fall outside Article 50 (Reed Smith summary).

Article 50(4) is the one for you as a company (a “deployer”). If you publish AI-generated text “to inform the public on matters of public interest”, you must say so. Unless a human has reviewed it and someone takes editorial responsibility. That is a much narrower duty than most people fear. Your AI-drafted internal memo is not covered. Your AI-written news piece on the town council might be.

Fines: breaking Article 50 can cost up to 15 million euros or 3 % of worldwide turnover, whichever is higher (for SMEs, whichever is lower) (Article 99).

To make it workable, the Commission published a Code of Practice on transparency of AI-generated content on 10 June 2026. Around 190 companies signed, including Google, Anthropic, OpenAI, Meta, Microsoft and Mistral. xAI (the makers of Grok) did not (EU Commission). Signing means the Commission accepts the Code as a way to show compliance.

If you want the bigger picture, we have covered this on the site before:
– The EU AI Act: the complete guide for German businesses
– EU AI Act deadlines and timeline 2024–2027: what applies when
– EU AI Act penalties and fines
– EU AI Act for the Mittelstand: what actually affects you
– State of the EU AI Act, November 2025
– Article 4: the AI literacy obligation (already in force since February 2025)

The good news

Let me be fair to the idea, because there is real good in it.

• Fewer fakes in the wild. Watermarks make it harder to flood the internet with AI text that pretends to be human. Not impossible. Harder.
• Proof for you, not just against you. If a customer claims your team “just let AI write it”, a watermark check can show which parts were AI and which were not.
• A stop sign for AI feeding on AI. Model makers can filter their own watermarked text out of future training data. That helps keep future models honest.
• You do not pay for it. No extra tokens, no extra cost, no visible change. Google’s live test found no drop in answer quality people could notice.
• It is the “gentle” version of transparency. The alternative was a visible “written by AI” stamp on every text. Nobody wants that on their sales email.

The risks, and who should worry most

Now the other side. And here I want to be very clear, because a lot of the online debate has missed the real point.

Risk 1: A false sense of certainty. People will treat “no watermark found” as “human wrote this”. Wrong. ChatGPT text has no watermark. Copilot text has no watermark. Heavily edited Claude text has no watermark. Absence of a mark proves nothing.

Risk 2: The result is a probability, and people are bad with probabilities. See the 500 flagged essays above.

Risk 3: The mark can be stolen or removed. Researchers at ETH Zurich showed that a determined attacker can rewrite text to scrub SynthID’s mark, and in some cases even copy the pattern to frame someone else (ETH Zurich SRI Lab, Watermark Stealing, ICML 2024). Within days of Anthropic’s announcement, scam “watermark remover” apps appeared (Forbes).

Risk 4, and this is the one for legal, finance and procurement: the “equivalent word” problem.

Here is the subtle point. The watermark itself does not swap words. It only nudges between words the model already considers fine. But who decides what is “fine”? The model does. And a language model does not know that in your world:

• “shall” and “should” are different promises,
• “best efforts” and “reasonable efforts” are different standards,
• “terminate” and “cancel” trigger different clauses,
• “net 30” and “within 30 days” are not always the same,
• “Vertragsstrafe” and “Schadensersatz” are different things.

If you ask an AI to “tidy up” a contract, a tender, a financial statement or a compliance report, the model will make hundreds of small word choices. Most will be harmless. One might not be. And the watermark quietly rides on top of exactly those choices. So version 2 of your document is now a different document from version 1, in ways nobody asked for and nobody proofread.

Who should be careful:
– Legal: contracts, terms and conditions, court filings. Defined terms must stay identical. Every deviation is a new interpretation.
– Finance and audit: reports, covenants, notes to accounts. “Approximately” and “about” are not the same to an auditor.
– Procurement and tenders: specifications and bid documents. A “must” that becomes a “should” can knock you out of a tender or let a supplier off the hook.
– Regulated industries: medical, pharma, safety documentation. Words are defined by regulation, not by taste.
– Anyone doing version control on documents: if you compare version 1 with version 2 and see 40 tiny changes you did not make, that is the AI’s word choices. Now try to explain that to the other side’s lawyer. Any variation in text between versions of a contract or document may require full reviews, costing time and money.

To be precise: this risk exists whether or not there is a watermark. It is a rewriting risk. But watermarking makes it more visible, and it also means Anthropic explicitly designed the mark to live in “arbitrary word choices”. In legal text, there is no such thing as an arbitrary word choice.

My rule of thumb: let AI draft, summarise, and explain. Never let it silently “polish” a final legal, financial or tender text. If it must, run a word-by-word diff before anyone signs.

What should you actually do on Monday?

Six things.

1. Know which tools watermark and which do not. Claude and Gemini yes. ChatGPT, Copilot, Grok no (today). Write it into your AI guidelines. If you do not have guidelines yet, start here: Using generative AI safely: guidelines for employees.
2. Sort your texts into two piles. “Free text” (emails, drafts, summaries) where a watermark is harmless. And “precise text” (contracts, tenders, reports, code) where every word matters and AI should draft but never finalise.
3. Treat detector results as a signal, never as proof. Put that sentence in your HR policy and your teacher’s handbook.
4. Check your Article 50(4) exposure. Do you publish AI-generated text about matters of public interest? Then you need either a label or a human editor with named responsibility. Most SMEs do not, but check.
5. Build this into your AI governance. Watermarking is one small piece of the AI Act. If you have not mapped which AI systems your company actually uses, start with creating an AI inventory and building AI governance.
6. Use AI in your automations only where you truly need it. Every step that a language model handles is a step with word choices in it, and now also a step with a watermark in it. If a workflow can be done with fixed rules (look up, copy, calculate, route), let the rules do it and keep the AI for the parts that genuinely need judgement. Fewer AI steps means fewer surprises, lower cost and less to explain later. We compared the two approaches here: AI agents (Claude Code) vs workflow tools (n8n): which should automate your processes?

The watermark is not the scary part. The scary part is a company that does not know which of its texts were written by AI, by which tool, and with how much human review. That was true before 2 August 2026. Now there is simply a way to check.

Frequently asked questions

Can I turn the watermark off in Claude or Gemini?
No. Anthropic says there is no plan, setting or API parameter that disables it. It applies worldwide, not only in the EU.

Does the watermark cost me anything or slow the model down?
No extra tokens, no extra cost. Google measured a latency increase of about 0.57 % in its tests.

Is my code watermarked?
Barely. Only parts with free choice, like comments and variable names. The code itself is not changed.

Can a competitor tell I used Claude?
Only Anthropic can run the check today, and its detection API is not yet available. A competitor could later use it, but the result would only say “Claude may have been involved”, not who wrote it.

Can I remove the watermark by copying and pasting the text, or screenshotting it?
No. The watermark lives in the choice of words and their order. Changing the font, spacing or size does not change the text, so the watermark persists. The same goes for copying the text as an image: if that image is later read back into text, the word order still shows the mathematical watermark.

How can I remove the watermark?
The only reliable way is to rewrite the text yourself, by hand. Be wary of tools that promise to do this for you automatically: at the end of the day, these tools also use an AI under the hood to generate the new text. You may simply be replacing a watermark from one system with a new watermark from another.

Does the watermark survive translation?
Human translation, or translation by another tool: usually no. Translation done by Claude itself: yes, because Claude picks every word.

Do I need to label AI text under the EU AI Act?
As a company, only if you publish AI-generated text to inform the public on matters of public interest, and no human has editorial responsibility for it. Internal texts, drafts and edited texts are not covered.

Who can help us set this up properly?
That is what we do at AI Hub Landau. Nick Skillicorn has 20+ years of consulting experience (Deloitte, and Fortune 500 clients such as Shell, Roche and Klarna), wrote the book “The AI Project Advantage”, and works from Landau in der Pfalz with Mittelstand companies across the region. Our EU AI Act compliance audit maps your AI systems, your Article 50 exposure and your training duty in a fixed-price package. Book a free 30-minute call: calendly.com/nickskillicorn/30min.

Sources

1. Dathathri, S. et al. “Scalable watermarking for identifying large language model outputs.” Nature 634, 818–823 (October 2024). https://www.nature.com/articles/s41586-024-08025-4
2. Anthropic. “How Claude marks AI-generated content.” Help centre, 11 August 2026. https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content
3. Anthropic. “How Claude’s text watermarking works.” August 2026. https://www.anthropic.com/news/claude-text-watermark
4. TechCrunch. “Anthropic shares more details about how Claude’s new watermarks will work.” 15 August 2026. https://techcrunch.com/2026/08/15/anthropic-shares-more-details-about-how-claudes-new-watermarks-will-work/
5. Google DeepMind. “Watermarking AI-generated text and video with SynthID.” https://deepmind.google/discover/blog/watermarking-ai-generated-text-and-video-with-synthid/
6. Google. Responsible Generative AI Toolkit, SynthID text. https://ai.google.dev/responsible/docs/safeguards/synthid
7. Google. “SynthID Detector.” 20 May 2025. https://blog.google/innovation-and-ai/products/google-synthid-ai-content-detector/
8. Hugging Face. “SynthID Text in Transformers.” October 2024. https://huggingface.co/blog/synthid-text
9. Kirchenbauer, J. et al. “A Watermark for Large Language Models.” ICML 2023. https://proceedings.mlr.press/v202/kirchenbauer23a.html
10. TechCrunch. “OpenAI’s attempts to watermark AI text hit limits.” 10 December 2022. https://techcrunch.com/2022/12/10/openais-attempts-to-watermark-ai-text-hit-limits/
11. City AM. “ChatGPT might follow Claude’s watermark pledge, but Grok to swerve it.” August 2026. https://www.cityam.com/chatgpt-might-follow-claudes-watermark-pledge-but-grok-to-swerve-it/
12. OpenAI. “Advancing content provenance.” 2026. https://openai.com/index/advancing-content-provenance/
13. Okto Solutions. “AI watermarks in Microsoft 365 Copilot.” 2026. https://www.oktosolutions.ca/en/ai-watermarks-microsoft-365-copilot/
14. Meta. “Meta is signing the EU AI Act Code of Practice on transparency of AI-generated content.” July 2026. https://about.fb.com/news/2026/07/meta-is-signing-the-eu-ai-act-code-of-practice-on-transparency-of-ai-generated-content/
15. Bird & Bird. “New AI content labelling rules in China.” 2025. https://www.twobirds.com/en/insights/2025/new-ai-content-labelling-rules-in-china-what-are-they-and-how-do-they-compare-to-the-eu-ai-act
16. China Law Translate. “Measures for Labeling AI-Generated Synthetic Content.” 2025. https://www.chinalawtranslate.com/en/ai-labeling/
17. EU AI Act, Article 50. https://artificialintelligenceact.eu/article/50/
18. EU AI Act, Recital 133. https://artificialintelligenceact.eu/recital/133/
19. EU AI Act, Article 99. https://artificialintelligenceact.eu/article/99/
20. European Commission. “Strong backing for Code of Practice on transparency of AI-generated content.” July 2026. https://digital-strategy.ec.europa.eu/en/news/strong-backing-code-practice-transparency-ai-generated-content
21. TechPolicy.press. “The EU’s AI transparency Code of Practice explained.” 2026. https://www.techpolicy.press/the-eus-ai-transparency-code-of-practice-explained/
22. Reed Smith. “Transparency obligations for AI-generated content: the Code of Practice adequacy.” 2026. https://www.reedsmith.com/our-insights/blogs/viewpoints/102nbz0/transparency-obligations-for-ai-generated-content-the-code-of-practice-adequacy/
23. ETH Zurich SRI Lab. “Probing SynthID.” https://www.sri.inf.ethz.ch/blog/probingsynthid
24. Jovanović, N. et al. “Watermark Stealing in Large Language Models.” ICML 2024. https://arxiv.org/abs/2402.19361
25. Forbes. “Lies and scams taint watermark removal apps.” 16 August 2026. https://www.forbes.com/sites/lanceeliot/2026/08/16/lies-and-scams-taint-watermark-removal-apps-now-that-anthropic-started-watermarking-claude-ai-outputs/
26. Official EU AI Act website. https://artificialintelligenceact.eu/