A
On August 11, 2026, Anthropic confirmed that Claude would start embedding machine-readable watermarks into the text it generates. The change wasn't optional. Article 50 of the EU AI Act, which requires providers of systems that generate synthetic text, image, audio, or video content to make those outputs machine-detectable as AI-generated, had already taken effect nine days earlier, on August 2.
Most people hear "watermark" and think of something like a logo stamped in the corner of an image, or a hidden tag buried in a file's metadata. Text watermarking doesn't work that way. It operates at the token level, inside the model, during word selection itself. Nothing is added to the text. There are no hidden characters. It's invisible to readers and undetectable without a matching cryptographic key — but statistically present all the same.
By the end of this article, you'll understand how that works, which providers have actually shipped it, and what it means for anyone building on top of an LLM API today.
Article 50(2) of the EU AI Act requires providers of AI systems generating synthetic text, image, audio, or video content to mark those outputs in a machine-readable format, detectable as artificially generated. The obligation applies to providers serving the EU market, with penalties that can reach €15 million or 3% of global annual turnover.
In July 2026, roughly 190 organizations — including Anthropic, Google, OpenAI, Meta, Microsoft, Black Forest Labs, and Synthesia — signed the EU's Code of Practice on Transparency of AI-Generated Content, committing to implement marking. Systems already on the market before August 2 get a transition period; providers have until December 2, 2026 to bring existing models into compliance.
Where providers actually stand as of this writing:
This isn't a uniform rollout. Which provider, which model, and which launch date all matter.
A token isn't always a full word — it can be a word fragment, punctuation, or even a space. When an LLM generates text, it works through tokens one at a time.
At each step, the model produces a probability distribution: a ranked list of candidate next tokens, each with a likelihood score. Normally, the model samples from that distribution using an arbitrary random number generator. Run the same prompt twice and you'll often get slightly different output, because that randomness varies each time.
Watermarking changes where the randomness comes from — not whether the choice is random. Instead of an arbitrary random number generator, the model uses a secret cryptographic key combined with the preceding tokens to determine which candidate to pick. The choice still looks random to a reader. But anyone holding the same key can check whether a given sequence of word choices is statistically consistent with what the key would have produced, and assign a probability that the text came from that model.
Claude's watermark is a version of SynthID-Text, the technique Google DeepMind published in Nature in October 2024, part of a broader research lineage tracing back to a 2022 proposal by computer scientist Scott Aaronson.
SynthID-Text relies on tournament sampling: candidate tokens are scored by several pseudorandom functions derived from the key and the preceding text, and compete across rounds until a winner is selected. Detection works by re-running that scoring process on the output and checking whether the pattern of choices looks statistically consistent with the key.
It's worth distinguishing this from an earlier, simpler proposal known as the Kirchenbauer method (2023), which splits the entire vocabulary into a "green list" and a "red list" at each step and applies a flat bias toward green-listed tokens. That harder, binary split is a real approach in the watermarking literature, but it isn't what Claude or Gemini use in production today — and it's also the version most likely to produce a genuine quality tradeoff, since it can bias the model away from a token even when there's no equally good alternative.
The design principle Anthropic and Google actually apply is narrower: watermarking should only ever change which random source settles a tie, not force a worse answer over a better one.
This is the part most explainers get wrong, and it's worth correcting directly: not in the way usually assumed.
The amount of watermark signal available at a given token is proportional to how many roughly equally good options exist at that point. When there's a genuinely correct next token — "2 + 2 =" followed by "4," or a piece of code where only one token keeps the syntax valid — there's nothing for the watermark to act on, so it isn't applied there. Anthropic states this directly: code, which frequently requires an exact token, generally carries less watermark signal than prose — not corrupted output. Where code does have room for arbitrary choices, such as inline comments or naming style, the watermark can apply there instead, with a negligible effect on the code that actually runs.
The evidence backs this up. Google's live experiment across 20 million Gemini responses found no statistically significant difference in user satisfaction between watermarked and unwatermarked outputs. Anthropic reports the same from its own internal testing and from controlled human side-by-side comparisons.
None of this means watermarking is free of tradeoffs. Detection confidence is weaker on short passages and on highly factual text, where there simply aren't many word-choice decisions to draw a pattern from. And providers are candid that heavy rewriting, paraphrasing, or translation can degrade or eliminate the detectable signal — light edits generally don't, a full rewrite generally does.
If you're calling the Claude or Gemini API right now, some of your output is watermarked and some isn't, depending on the exact model and when it launched. If you're calling the OpenAI API, your text output currently has no confirmed watermark at all, though that's expected to change as OpenAI works toward the Code of Practice's December 2 deadline.
For most text-based applications, none of this will be visible to your users. If you're building something where a provider's disclosure status specifically matters — content moderation tooling, educational-integrity products, anything where you need to make a claim about whether content is AI-generated — check each provider's current documentation directly rather than assuming coverage. These policies are moving fast and differ by provider, model, and even launch date.
If your pipeline includes a step that paraphrases or rewrites model output, be aware that step can degrade or remove the watermark — which matters if your own compliance obligations depend on the mark surviving downstream.
Looking further out, some researchers are exploring "multi-bit" watermarks that could encode extra information, like model version or timestamp, directly in the pattern. That's a research direction, not something Anthropic or Google have said they're shipping: both currently state their watermarks carry no identifying information and can't be traced to a specific person, organization, or conversation. Still, it's worth watching if attribution requirements tighten further.
AI watermarking isn't a policy checkbox sitting in a future compliance document — for Google and Anthropic, it's already live, in production, today. The real question for developers isn't whether watermarking is good or bad. It's which of your dependencies already do it, which don't yet, and what that gap means for anything you're building that depends on knowing where text came from.
Most people hear "watermark" and think of something like a logo stamped in the corner of an image, or a hidden tag buried in a file's metadata. Text watermarking doesn't work that way. It operates at the token level, inside the model, during word selection itself. Nothing is added to the text. There are no hidden characters. It's invisible to readers and undetectable without a matching cryptographic key — but statistically present all the same.
By the end of this article, you'll understand how that works, which providers have actually shipped it, and what it means for anyone building on top of an LLM API today.
Why This Is Happening Now
Article 50(2) of the EU AI Act requires providers of AI systems generating synthetic text, image, audio, or video content to mark those outputs in a machine-readable format, detectable as artificially generated. The obligation applies to providers serving the EU market, with penalties that can reach €15 million or 3% of global annual turnover.
In July 2026, roughly 190 organizations — including Anthropic, Google, OpenAI, Meta, Microsoft, Black Forest Labs, and Synthesia — signed the EU's Code of Practice on Transparency of AI-Generated Content, committing to implement marking. Systems already on the market before August 2 get a transition period; providers have until December 2, 2026 to bring existing models into compliance.
Where providers actually stand as of this writing:
- Google has the longest track record. SynthID-Text has been running inside Gemini since 2024, and DeepMind validated it at scale in a live experiment across nearly 20 million Gemini responses, published in Nature in October 2024.
- Anthropic rolled out watermarking starting with Claude models launched on or after August 2, 2026. Older models are being transitioned "over the coming months," per the company's own announcement.
- OpenAI signed the Code of Practice and has applied provenance signals (C2PA metadata, SynthID-style marks) to generated images and audio, but as of this writing has moved more slowly than Google or Anthropic to deploy a text watermark — it reportedly built a prototype back in 2024 and shelved it over paraphrasing-evasion and false-positive concerns.
- Meta signed the Code in mid-2026 and marks images; no text watermark has been confirmed for Llama or its consumer products.
This isn't a uniform rollout. Which provider, which model, and which launch date all matter.
What "Token-Level" Actually Means
A token isn't always a full word — it can be a word fragment, punctuation, or even a space. When an LLM generates text, it works through tokens one at a time.
At each step, the model produces a probability distribution: a ranked list of candidate next tokens, each with a likelihood score. Normally, the model samples from that distribution using an arbitrary random number generator. Run the same prompt twice and you'll often get slightly different output, because that randomness varies each time.
Watermarking changes where the randomness comes from — not whether the choice is random. Instead of an arbitrary random number generator, the model uses a secret cryptographic key combined with the preceding tokens to determine which candidate to pick. The choice still looks random to a reader. But anyone holding the same key can check whether a given sequence of word choices is statistically consistent with what the key would have produced, and assign a probability that the text came from that model.
The Method Claude Actually Uses
Claude's watermark is a version of SynthID-Text, the technique Google DeepMind published in Nature in October 2024, part of a broader research lineage tracing back to a 2022 proposal by computer scientist Scott Aaronson.
SynthID-Text relies on tournament sampling: candidate tokens are scored by several pseudorandom functions derived from the key and the preceding text, and compete across rounds until a winner is selected. Detection works by re-running that scoring process on the output and checking whether the pattern of choices looks statistically consistent with the key.
It's worth distinguishing this from an earlier, simpler proposal known as the Kirchenbauer method (2023), which splits the entire vocabulary into a "green list" and a "red list" at each step and applies a flat bias toward green-listed tokens. That harder, binary split is a real approach in the watermarking literature, but it isn't what Claude or Gemini use in production today — and it's also the version most likely to produce a genuine quality tradeoff, since it can bias the model away from a token even when there's no equally good alternative.
The design principle Anthropic and Google actually apply is narrower: watermarking should only ever change which random source settles a tie, not force a worse answer over a better one.
Does It Actually Hurt Code and Technical Writing?
This is the part most explainers get wrong, and it's worth correcting directly: not in the way usually assumed.
The amount of watermark signal available at a given token is proportional to how many roughly equally good options exist at that point. When there's a genuinely correct next token — "2 + 2 =" followed by "4," or a piece of code where only one token keeps the syntax valid — there's nothing for the watermark to act on, so it isn't applied there. Anthropic states this directly: code, which frequently requires an exact token, generally carries less watermark signal than prose — not corrupted output. Where code does have room for arbitrary choices, such as inline comments or naming style, the watermark can apply there instead, with a negligible effect on the code that actually runs.
The evidence backs this up. Google's live experiment across 20 million Gemini responses found no statistically significant difference in user satisfaction between watermarked and unwatermarked outputs. Anthropic reports the same from its own internal testing and from controlled human side-by-side comparisons.
None of this means watermarking is free of tradeoffs. Detection confidence is weaker on short passages and on highly factual text, where there simply aren't many word-choice decisions to draw a pattern from. And providers are candid that heavy rewriting, paraphrasing, or translation can degrade or eliminate the detectable signal — light edits generally don't, a full rewrite generally does.
What This Means for Your LLM-Powered App
If you're calling the Claude or Gemini API right now, some of your output is watermarked and some isn't, depending on the exact model and when it launched. If you're calling the OpenAI API, your text output currently has no confirmed watermark at all, though that's expected to change as OpenAI works toward the Code of Practice's December 2 deadline.
For most text-based applications, none of this will be visible to your users. If you're building something where a provider's disclosure status specifically matters — content moderation tooling, educational-integrity products, anything where you need to make a claim about whether content is AI-generated — check each provider's current documentation directly rather than assuming coverage. These policies are moving fast and differ by provider, model, and even launch date.
If your pipeline includes a step that paraphrases or rewrites model output, be aware that step can degrade or remove the watermark — which matters if your own compliance obligations depend on the mark surviving downstream.
Looking further out, some researchers are exploring "multi-bit" watermarks that could encode extra information, like model version or timestamp, directly in the pattern. That's a research direction, not something Anthropic or Google have said they're shipping: both currently state their watermarks carry no identifying information and can't be traced to a specific person, organization, or conversation. Still, it's worth watching if attribution requirements tighten further.
What Developers Should Do Now
- Check your specific provider and model. Coverage isn't uniform. A Claude model launched after August 2026 is watermarked; an older model, or a different provider's API, may not be. (This isn't legal advice — if watermarking or disclosure obligations affect your business specifically, talk to counsel familiar with the EU AI Act.)
- Don't assume stripping a watermark is neutral. The EU AI Act's marking obligations are aimed at providers and deployers, not typically at someone editing their own text — but if you're building a product that repackages AI output and makes claims about its origin, the compliance picture is genuinely more complicated and worth checking against the Act's actual text rather than general assumptions.
- If you're in a compliance-sensitive vertical — legal tech, edtech, healthcare — track each provider's watermarking documentation directly, since it's changing month to month right now.
- Watch SynthID-Text specifically. It's no longer just a Google research project — it's the technique now underpinning both Gemini's and Claude's watermarks, which makes it the closest thing to an emerging industry standard.
Conclusion
AI watermarking isn't a policy checkbox sitting in a future compliance document — for Google and Anthropic, it's already live, in production, today. The real question for developers isn't whether watermarking is good or bad. It's which of your dependencies already do it, which don't yet, and what that gap means for anything you're building that depends on knowing where text came from.