What happened?

Anthropic has revealed that it will soon watermark content that is processed — not just generated — by any of its models. In a support article, the company explained that it was rolling out machine-readable watermarks to comply with the European Union's AI Act.

The law requires all AI system providers to watermark AI-generated or manipulated audio, image, text and video outputs. It applies to any AI model released after 2 August and provides a grace period until December 2026 for providers to update previously released models.

How wide is the scope?

Anthropic confirmed that going forward, all new models offered globally — not just in the EU — will mark AI-generated content "from day one". Text outputs will "carry embedded watermarks", invisible to the user, while other "generated files will include digitally signed provenance metadata where supported".

What stands out is that the company has drawn the scope wider than required. The EU does not require watermarking where an AI system performs "an assistive function for standard editing" — the guidance's own example is grammar correction — or where it does not "substantially alter" the user's text or its meaning. Anthropic applies the watermarks to all processed content where supported.

Why the distinction cannot be drawn

A watermark applied at the model level cannot tell wholesale generation from a comma fix. Claude may therefore end up stamping exactly the content the law was written to leave alone.

How thoroughly it truly watermarks will not be known until Anthropic releases a detection tool that can be tested. The company said it plans to eventually share details about how to detect the marks in order to offer the technical support the EU's law requires.

The limits

  • Scope: all processed content, not just generated
  • Text: embedded watermarks invisible to the user
  • Non-text: the C2PA metadata approach for provenance
  • Where it does not work: "some platforms or features" that do not support it
  • Legal timetable: models after 2 August; December 2026 for older ones
  • Detection tool: not yet released

Why does it matter?

The approach described by the EU and implemented by Anthropic has a weakness: it is trivially easy for bad actors to bypass, while potentially punishing users who trust the system.

That asymmetry sits at the centre of the argument. Someone wanting to hide their traces can break the watermark by running the text through another tool; someone trying to hide nothing is left with a stamped text because they asked for a grammar fix.

Why the 'nuke it from orbit' approach

There is a technical reason the company drew the scope wider than required: the model may know what request it received, but it cannot measure how much the output changed under that prompt. Rewriting a paragraph and fixing a comma are the same operation from the model's side — text goes in, text comes out.

Drawing that distinction would require a separate layer measuring how closely the output resembles the input; that layer would need a threshold, and the threshold would inevitably be open to argument. Anthropic appears to have chosen not to open that argument at all.

What is not settled

How robust the watermark actually is, and which operations it survives, cannot be tested until the detection tool is released. No date was given for when Anthropic will share it.