Every Claude model Anthropic has shipped since August 2, 2026 writes with an invisible signature baked into its word choices. We spent the past week testing what that watermark actually touches inside client systems, and the short version is: less than the headlines suggest, but enough that every operator running AI-generated content through a business needs a plan for it.
What actually changed on August 2
The EU AI Act's Article 50 transparency rules took effect on August 2, 2026. Anthropic is one of roughly 190 organizations, alongside Google, Meta, Microsoft and OpenAI, that signed the Code of Practice on Transparency of AI-Generated Content to comply with it. Anthropic's own explanation of the mechanism confirms the watermark applies globally, not only to EU traffic, because it is built into the model itself rather than a regional filter. If Claude sits anywhere in your stack, in a client report, a marketing draft, an internal memo, the output written since that date can carry a detectable pattern whether your business is in Brussels or Bali.
How the watermark actually works
The method Anthropic uses is a version of SynthID-Text, the technique Google DeepMind developed and open sourced for its own models. Nothing gets added to the text. No hidden characters, no extra spaces, no metadata riding along in a footer. Instead, the model changes how it samples the next word. Anthropic describes it as swapping a random dice roll for a key-driven one: at points in a sentence where two or more word choices are equally correct, the model consistently favors the option that lines up with a hidden key rather than picking at random. Do that across a few hundred words and a detector holding the key can tell the text follows a statistically unlikely pattern, even though no single sentence looks different to a human reader.
Two details matter more to us than the mechanism itself.
- It travels with the text. Copy a watermarked paragraph into another document and the pattern goes with it, the same way an image watermark survives a crop or resave.
- Code is mostly exempt. Anthropic is explicit that where an exact token is required, the right closing brace, the right variable name, there is no room to nudge word choice without breaking the output, so the watermark shows up far less there. Prose, emails and reports carry it more than a pull request does.
What erases it
Anthropic and the original SynthID-Text research both flag the same failure mode: heavy paraphrasing, translation, or very short snippets defeat detection. If you already run AI output through an editing pass before it goes out, which is good practice regardless of watermarking, you are also incidentally scrubbing most of the signal.
Why we are not telling clients to switch off Claude
Anthropic is not acting alone here. The Code of Practice was signed by around 190 organizations spanning IT, telecoms, retail and education, and the provider list includes most of the labs operators already route work through. Watermarking is becoming a feature of using any frontier model under EU rules, not a Claude-specific liability. Moving your stack to dodge one lab's implementation just means waiting a few months for the next lab to ship the same thing under the same law. That is not a reason to freeze either. It is a reason to build the review step your business should already have.
| Content type | Watermark exposure | What we do about it |
|---|---|---|
| Long-form prose (reports, blog drafts, emails) | High, persists through copy and paste | Human edit pass before it ships to a client or prospect |
| Short snippets, single-line copy | Low, too few tokens for reliable detection | Still treated as a draft either way |
| Code and structured output | Minimal, exact tokens leave little room to nudge | Standard code review, unaffected by this change |
| Paraphrased or translated AI text | Degraded or erased | No special handling needed |
What we are doing at luup this quarter
We build systems that write on a client's behalf: briefs from an AI Chief of Staff, drafted replies from an AI Operations Agent, summaries a Second Brain assembles from a week of meetings. None of that changes because a watermark now rides along in the phrasing. What changes is that we treat "who reviewed this before it went out" as a build requirement, not an afterthought. Every system we ship already routes generated text through a human checkpoint before it reaches a customer, because that was good practice before August 2 and it still is now. The watermark just removes any ambiguity about whether AI wrote the first draft. It did. We are not hiding that, and neither should our clients.
The operators asking us about this are not worried about getting caught using AI. They are worried about a harder question: do they actually know where AI-generated text lives across their business? Most companies in the 10 to 50 person range do not have a clean answer. A support reply drafted by a bot, a proposal section pulled from a template, a social post ghostwritten by a tool nobody logged. If you cannot list those touchpoints, you cannot decide what needs a disclosure line and what needs a rewrite. That inventory is the first thing we run on every new automation engagement, before we touch a single workflow.
The build list for operators
- Map where generated text ships unedited. Marketing copy, client emails, proposals, support replies. If a human never touches it before it goes out, that is your exposure list.
- Put a review checkpoint on anything client-facing. Not because of the watermark itself, because a watermark just makes visible what should already be a rule: nobody sends raw model output straight to a customer.
- Keep code generation on its own track. Since exact-token output barely carries the pattern, code review workflows do not need to change. Standard PR review is enough.
- Decide your disclosure policy once, in writing. Waiting for a client to ask "did AI write this" is worse than having an answer ready before they ask.
- Do not rebuild your stack over this. Watermarking is heading toward every major lab under the same EU rule. Switching models to avoid it just delays the same conversation by a few months.
Where voice and support fit in
The same logic applies outside written copy. A voice agent handling inbound calls is generating spoken language in real time, not the watermarked text output this rule targets, but the underlying discipline is identical: the script and the review layer matter more than which model is doing the talking. We treat both the same way, draft first, human-approved rails second, and we do not let either improvise past what has been signed off.
The bigger lesson
The watermark itself is a footnote. The real signal is that regulation is now shaping how frontier models behave at the token level, not just at the policy level, and it is shipping globally instead of staying region-locked. That is going to keep happening. Every operator building on these models needs the habit of checking primary sources instead of assuming a headline is close enough, because the gap between "AI text is watermarked" and "code that requires exact syntax barely is" is exactly the kind of detail that changes what you build next.
If you want a second pair of eyes on where AI-generated content and code actually sit in your business, and what a review layer should look like for your specific workflows, that is the first thing we map in an AI Concierge assessment. It costs 999 euros, credited in full to the build if you move forward, and it is usually the fastest way to get a straight answer instead of a guess. You can see how that plays out in practice in our client work, or browse what else we are testing on the blog. If you want to see where the leaks are before you spend anything, run your numbers through the revenue leak heatmap first.