Anthropic Adds Cryptographic Watermarking to Claude Output to Comply With EU AI Law

Anthropic is watermarking all text and image output from Claude to comply with new European Union AI transparency rules, the company announced. The watermark is invisible to readers, requires no extra tokens, and does not slow down generation or affect output quality, according to Anthropic.

The method works by changing how Claude selects words during generation. Large language models typically choose each next word from a ranked list of contextually appropriate candidates, using a random number generator to introduce variation. With watermarking enabled, Claude instead uses a cryptographic key to determine which word to pick from that list. Anthropic's example used the digits of pi as an illustrative key: if the key starts with 2, Claude selects the sixth word from its candidate list, then the fifth, then the third, and so on based on subsequent digits.

The approach is adapted from Google DeepMind's SynthID-Text watermarking method, published in Nature. Anthropic says it will release an API containing decoding keys that can determine whether a given block of text was likely generated by Claude.

The watermarking has notable limitations. It cannot distinguish between text Claude wrote from scratch versus text it merely edited or translated — both get watermarked. Anthropic says the system can only indicate that Claude was "likely involved" with a piece of text at some point, not confirm authorship. Short text blocks may not carry enough of a pattern to be reliably detected, and light editing of watermarked text likely won't strip the watermark — full rewrites are needed to remove it.

Code presents a specific edge case. Because code generation typically requires exact, deterministic output with fewer word-choice alternatives, Anthropic says code carries "generally less watermarking than some other forms of text." When no meaningful choices exist during generation, no watermark can be embedded — a relevant detail given ongoing debate over whether AI-generated code can be copyrighted absent significant human input.

Images generated by Claude get a separate treatment: a cryptographically signed note embedded in file metadata identifying Claude as the source.

Anthropic said it is applying watermarking globally rather than restricting it to EU users, citing the lack of a reliable way to implement region-specific rollout. The change applies to output from Claude models released after August 2, and Anthropic plans to extend watermarking capability to older models over the coming months.

What this means

This is a compliance move, not a model upgrade — no new Claude version, weights, or capabilities are involved. The EU's AI transparency requirements are pushing major labs toward standardized provenance mechanisms, and Anthropic's adoption of DeepMind's SynthID-Text approach suggests early convergence on a shared technical standard rather than competing proprietary schemes.

The practical impact is limited by design. Watermarking can flag that Claude was probably involved in producing a piece of text, but it cannot prove authorship, catch heavily edited content, or reliably tag short passages or code. That leaves plenty of room for AI-generated content to pass undetected, particularly in adversarial contexts like plagiarism detection or disinformation tracing — the exact use cases most people assume watermarking is meant to solve. It is best understood as a compliance checkbox and forensic aid, not a robust detection system.