Claude Now Marks Every Output. What the Mark Proves, and What It Doesn't

Jack Bear, Founder, Norg · 24 August 2026 · updated 15 September 2026 · 9 min read

Anthropic embeds a machine-readable mark in what Claude produces — an imperceptible watermark in text, and signed provenance metadata on generated files. It applies worldwide. The mark signals that Claude was involved. It does not identify who wrote the document, it cannot distinguish a full draft from a corrected comma, and its absence proves nothing either. This is what it detects, what it cannot prove, and why it changes less about AI visibility than it first appears.

Correction, 15 September 2026. An earlier version of this article stated that older Claude models sat in a grace period running to 2 December 2026, and that a detection API had been promised without a date. Neither is supported by Anthropic's documentation: the transition period for earlier models is described without an end date, and watermark detection is already in private preview. That version also omitted the file-provenance half of the system entirely. All three are corrected below, against Anthropic's published help-centre article.

What changed

Anthropic has signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content, as a provider of both generative models and generative systems, and is implementing machine-readable marking accordingly.

Claude models launched on or after 2 August 2026 support marking at launch. Anthropic currently names Fable 5.1 and Mythos 5.1 as supported. Models released before that date sit in a transition period the law provides for, and Anthropic states it is working to add marking support to them — without publishing an end date.

Coverage is broad: Claude Platform (the API), Claude, Claude Code, Claude Cowork and Claude Tag, plus supported models accessed through Amazon Web Services, Google Cloud and Microsoft Foundry. Marking applies wherever Claude is offered, worldwide — not only in Europe.

Two mechanisms, not one

This is the part most coverage of the announcement misses. Anthropic uses two complementary techniques, and they behave differently.

1. Embedded watermarks in text

When a supported model generates text, an imperceptible watermark is woven into the text itself. Anthropic states you will not see it and that it does not change the meaning, quality or readability of the response.

Because the mark is part of the text rather than attached to a file, it travels with the text when it is copied and pasted, and may survive some editing. It is applied at the model level, so it is present regardless of which Claude surface the text came from.

Anthropic does not publish the mechanism in detail. Watermarking schemes of this general type work by biasing the model's choice among equally plausible next tokens according to a secret key, so that no single sentence reveals anything but a statistical pattern becomes measurable across a long passage by whoever holds the key. That is the category of technique, not a description Anthropic has confirmed.

2. Signed provenance metadata on files

When Claude generates a supported file type — .svg, .png, .jpg — it attaches signed provenance metadata following the C2PA standard (Coalition for Content Provenance and Authenticity), the same open standard used across the industry.

A present, valid label signals the file was processed by Claude and allows tamper detection. Unlike the text watermark, this metadata is attached rather than embedded, which means it is strippable — a format conversion, a re-save or a screenshot removes it.

Anthropic offers a free Claude Content Checker for verifying file Content Credentials.

Who can actually detect a text watermark

Not you, in most cases, and this is the practically important constraint.

Watermark detection is in private preview, available to organisations that are obligated under EU law — regulators, law enforcement, media, fact-checkers, independent researchers, educational organisations and EU civil society groups — and to enterprises with their own compliance obligations under the Act. Anthropic states it plans to expand access over time, and publishes a registration form for interest.

So a hiring manager, an editor or a teacher cannot currently run a check. The population that can detect is narrow and defined by legal obligation rather than curiosity.

What the mark proves, and what it does not

Anthropic is unusually direct about the limits, and they are worth reading closely because they cut in both directions.

A detected mark is not conclusive

Anthropic's own framing: a detected mark indicates content may have been processed by Claude, and does not on its own confirm provenance. Two reasons are given.

Claude may not be the original author. People use Claude to proofread, translate, summarise and convert files. The output can carry a mark even where the ideas, text and data originated entirely elsewhere. A translation carries it at full strength because every output word was model-selected — and so, in principle, does a document whose only machine involvement was tidying.

The content may have changed since. Marked content can be modified, excerpted or combined with other material after Claude touched it.

Absence of a mark proves even less

This is the half that gets ignored, and it is the more consequential one for anyone tempted to treat detection as an adjudication.

Content can be Claude-generated and carry no detectable mark if it came from a model released before marking was supported, if the text has been heavily edited, paraphrased, translated or mixed into other writing, if the passage is simply too short to carry a reliable signal, if a file's metadata was stripped by conversion or screenshotting, or if it came from a surface where that marking type is not supported.

A system where a positive is inconclusive and a negative is uninformative is a transparency signal, not a verdict. Treating it as a verdict is the error to guard against.

Why that matters more than the technology

Nobody has told a hiring manager, an editor or a teacher what to do when a mark turns up — and given detection access is currently restricted, most of them will be reacting to a rumour of a mark rather than a measurement.

With no guidance, people improvise, and the mark gets treated as proof of something it never claimed. The people who were honest about using AI are the ones who pay for it.

Where the industry sits

Google has applied its SynthID marking to Gemini output. Several major providers have signed the same Article 50(2) Code of Practice. The direction of travel across the industry is toward machine-readable provenance signals rather than away from them, and a business planning on the assumption that AI involvement stays undetectable is planning against the trend.

Europe legislated for Europe; Anthropic applied the mark globally. The practical effect is that a European regulation now governs what happens when a business in Melbourne asks a chatbot to tidy up an email.

If you build on Claude

Anthropic's guidance to deployers is worth restating, because it transfers a real obligation. If you deploy Claude inside your own product, you should independently assess what Article 50 requires of your product — the model provider's marking does not automatically discharge your own transparency duties as a deployer.

What this means for AI visibility

Less than it appears, and not in the direction most people assume.

The mark is a provenance signal about how text was produced. AI visibility is about whether your facts can be retrieved and cited. Those are different problems with different failure modes. A page can be entirely human-written and still deliver almost nothing to an agent, because the constraint is structure and retrievability rather than authorship.

What does follow is a reinforcement of something already true: verifiable, sourced, first-party facts are worth more than fluent prose. In a landscape where machine involvement is detectable by some parties and its meaning is contested by everyone, the durable asset is content whose claims can be checked against a registry, a specification or a dated source — not content that reads as though a person wrote it.

The workarounds, and why they are the wrong move

Paraphrasing tools, translation round-trips and "humanisers" all exist, and their pitch is removal of the mark. Reaching for them concedes the framing — that a watermark is an accusation to be evaded rather than a fact about production.

It is also a bad trade on the merits. The techniques degrade the text, they are an arms race against a party holding the key, and adopting them converts an honest use of a tool into something that looks like concealment. Note too that heavy paraphrasing is listed by Anthropic among the reasons a mark may not be detectable — meaning the same action that removes the signal also destroys the writing quality you were using the tool to get.

Frequently asked questions

Does Claude watermark its text output?

Yes. Claude models launched on or after 2 August 2026 support marking at launch, worldwide. Fable 5.1 and Mythos 5.1 are named as supported. Earlier models are in a transition period with no published end date.

Can you see a Claude watermark in the text?

No. Anthropic states the watermark is imperceptible and does not change the meaning, quality or readability of the output. Because it is part of the text, it travels through copy-and-paste and may survive some editing.

Does the watermark identify who wrote the document?

No. A detected mark indicates content may have been processed by Claude. Anthropic explicitly notes Claude may not be the original author — proofreading, translation, summarising and file conversion all produce marked output from source material that came from elsewhere.

Does Claude mark files as well as text?

Yes. Generated files of supported types such as .svg, .png and .jpg carry signed provenance metadata under the C2PA standard, which also allows tamper detection. Anthropic provides a free Content Checker for these.

Can we detect a Claude watermark ourselves?

Probably not yet. Watermark detection is in private preview for organisations obligated under EU law — regulators, law enforcement, media, fact-checkers, researchers, educational organisations, EU civil society — and for enterprises with their own compliance obligations. Anthropic plans to widen access over time.

If no mark is found, does that mean it wasn't AI-generated?

No, and this is the most misunderstood part. A mark may be absent because the model predates marking, because the text was heavily edited or paraphrased, because the passage is too short to carry a reliable signal, because file metadata was stripped, or because the surface did not support that marking type.

Which Claude products are covered?

Claude Platform (API), Claude, Claude Code, Claude Cowork and Claude Tag, plus supported models via Amazon Web Services, Google Cloud and Microsoft Foundry. Some platforms or features may not support certain marking types.

Why does it apply outside Europe?

Anthropic applies marking wherever Claude is offered, worldwide, rather than scoping it to the EU.

Can a Claude watermark be removed?

Tools claiming to do so exist. They degrade the text, they are an arms race against the key holder, and using one reframes an honest disclosure problem as concealment. File metadata, by contrast, is straightforwardly strippable by conversion or screenshotting — which is a limitation of that mechanism rather than a strategy.

Does AI watermarking affect AI search visibility?

Not directly. Watermarking is about provenance of production; AI visibility is about whether your content is structured so a system can retrieve and cite it. The two are independent — though both point the same way, toward verifiable first-party facts.

What should we do if we build Claude into our own product?

Assess your own Article 50 obligations independently. Anthropic's marking covers its models; it does not automatically discharge a deployer's transparency duties.

See what AI can actually read on your site

A free AI visibility audit fetches your site the way ChatGPT does — a raw request, no browser and no JavaScript — across the twelve highest-value commercial pages we find.

---

Published 24 August 2026; corrected and expanded 15 September 2026 against Anthropic's help-centre article "How Claude marks AI-generated content" and its stated limitations. Marking behaviour, supported models and detection availability are set by Anthropic and may change — check the current documentation before relying on any detail here. Norg Pty Ltd — ABN 44 669 712 494 — more articles