Anthropic has started embedding invisible watermarks into text generated by new Claude models, applying the mark globally rather than confining it to the jurisdiction that required it. The move answers Article 50(2) of the EU AI Act, which came into force on 2 August 2026 and carries fines of up to €15 million or 3% of worldwide turnover for non-compliance. It is, by most accounts, the most detailed public response any frontier lab has given to the Act's content-marking obligation so far.
It is also, on its own terms, a mechanism that cannot survive contact with the transparency it is meant to provide.
Per Anthropic's own account, the mark is woven into the text itself at generation time rather than attached as metadata: it travels with the text when copied and pasted, and "may persist through some editing." Watermarking is applied at the model level, meaning it is present regardless of which Claude product or surface the text comes from, whether that's the consumer apps, the API, Claude Code, or a cloud partner platform. Files (SVGs, PNGs, JPGs) get a separate treatment: signed C2PA provenance metadata rather than an embedded signal, which shows whether a file was processed by Claude and whether it has since been tampered with.
Anthropic has not published its exact method, but the likely family is a KGW-style approach: a secret key and the preceding tokens generate a hash that splits candidate next-words into two groups, and the model nudges probability toward one group at each step. GPTZero co-founder and CTO Alex Cui, writing publicly on the mechanics, noted that streaming responses forces Anthropic into the weaker end of the available techniques: methods robust to paraphrasing typically plan whole sentences or rewrite text after the fact, and a model generating token-by-token in real time cannot do that.
Code fares worse again. Prose has abundant synonyms to nudge probability toward; working code mostly does not, since a "harmless" word swap can break execution. Anthropic has not published data on how the watermark behaves inside a normal development pipeline: a Claude-authored patch reformatted by a linter, merged, and rewritten across three pull requests is not something the company has shown surviving detection, and there is no particular reason to assume it does.
Which models are actually covered right now is murkier than the headline suggests. Anthropic's own commitment is explicit only about the boundary: models launched on or after 2 August 2026 support marking at launch, and models launched before that date sit in an unconfirmed transition period, with no date given for when, or whether, specific older models get retrofitted. Anthropic has not published a model-by-model coverage table. Third-party reporting places Claude Sonnet 5's launch at 30 June 2026 and Fable 5's at 9 June 2026, both before the cutoff, both therefore presumptively in the unconfirmed bucket, though those dates rest on independent blog sourcing rather than anything Anthropic has stated directly.
Anthropic says it will support users and third parties in detecting its marks, "as the Code requires," with details promised in forthcoming documentation. It has not said whether that means a local tool, an API, or access limited to selected partners. Cui's read on this is the sharpest part of the whole story: release a public detector and you hand attackers a free oracle to test removal strategies against, iterating until the signal disappears. Keep it private and the "transparency mechanism" cannot actually be verified by anyone outside the company that built it.
There is no version of this that resolves cleanly. A public detector defeats the watermark by making it discoverable; a private one defeats the point of calling it a transparency measure. Anthropic is not being coy here so much as caught: the tool has to be simultaneously secret and public to work as advertised, and it cannot be both.
Layer on the key-rotation problem and the picture gets worse. A leaked signing key would let someone strip marks or forge them into text Claude never produced, so Cui's advice is to rotate keys periodically, keeping a couple in rotation to limit blast radius. Anthropic has not said how a detector would then recognise marks made under retired keys, including content generated months or years before a given rotation. Whatever the answer is, it has not been published.
None of this is presented as proof of authorship, and Anthropic is explicit about that: a detected mark means only that content "may have been processed by Claude," not that Claude wrote the underlying work. Someone feeding their own writing through Claude for a translation or a tidy-up pass will trip the same signal as someone who generated the piece from nothing. Anthropic's own limitations section lists Claude as "not the original author" as an explicit, named failure mode. The absence of a mark proves just as little: older models, heavy editing, short excerpts, or a pipeline step that strips file metadata can all leave genuinely AI-authored content unmarked.
Nobody needs to reverse-engineer any of this to defeat it, either. The "Watermarks in the Sand" paper already proves, under defined assumptions, that paraphrase attacks can strip a statistical watermark without meaningfully degrading the underlying content. Cui's own testing found free, off-the-shelf paraphrasing tools already beating Google DeepMind's SynthID specifically, a competitor's production system, not a toy. The weakness isn't a blind spot the developers missed. It's disclosed, in writing, in Anthropic's own limitations section, and it was never built to survive someone who reads the word "watermark" and asks the obvious next question. Its actual threat model is the casual copy-paste, not the determined remover, and the regulation it answers to concedes exactly that: Article 50 itself only demands marking be "effective, robust and reliable as far as this is technically feasible," a carve-out that quietly absorbs the same limitation the company's own FAQ admits to.
Anthropic's own account is unambiguous, and worth quoting precisely rather than relying on secondary coverage: the company states it "has signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content, as a provider of both generative AI models and generative AI systems." That instrument, finalised in June 2026 after drafting by six independent experts and more than 187 participants, is distinct from the earlier GPAI Code of Practice (finalised July 2025, covering Article 53 model documentation and Article 55 systemic-risk safety obligations, retained for ten years). Coverage that cites "the Code of Practice" without specifying which one is conflating two different instruments answering two different obligations. Anthropic is listed among the roughly 190 organisations that had signed by end of July 2026, alongside Google, Microsoft, Mistral, OpenAI, Cohere and others, timed deliberately to land before the 2 August enforcement date.
Signing confers what the Commission calls a presumption of conformity: the evidentiary burden shifts toward the regulator having to disprove compliance, rather than the company having to affirmatively demonstrate it. A voluntary code, signed ahead of a deadline, converts an unverifiable watermark into a legally favourable starting position. That is the compliance-theatre mechanism stated plainly, not implied.
Worth noting, too, that Anthropic is explicit its own obligations stop at the model. "If you deploy Claude in your own product, you should independently assess what Article 50 requires of your products and services," the company states; watermarking supports downstream compliance, it doesn't discharge it. That line matters more than it looks, and it reappears below.
Earlier this week, entirely unrelated to any of the above, we ran a small provenance exercise on our own back catalogue: hashing every published article, GPG-signing the resulting manifest, committing it into version control with a signed tag, and submitting each URL to the Internet Archive's Save Page Now service for independent third-party corroboration.
None of it is glamorous. None of it is marketed anywhere. It took most of an evening, several false starts (a stale DNS cache entry, a WireGuard tunnel dropped mid-diagnosis, half a dozen orphaned draft directories from a scaffolding habit worth fixing), and produced nothing that looks like a feature announcement.
But it is, in every way that matters, more robust than what shipped under regulatory deadline this month. A SHA-256 hash does not degrade under paraphrasing. A GPG signature does not require a detector that defeats itself the moment it is made available. A Wayback Machine snapshot does not depend on Anthropic, or anyone else, choosing to publish a verification tool at some unspecified future date. It is slower, less impressive in a press release, and it is the actual answer to "how do you prove this existed and hasn't been altered," which a statistical watermark, on its own terms, is not built to give you.
For a Crown Dependency angle: the Isle of Man's National AI Office launched in January 2026, allocated £998,822 for its first year, approved by Treasury and drawn from a £5 million fund previously set aside for AI-related activity through the Economic Strategy Fund. Digital Isle of Man is explicit this is "not new public money." There is no intention to expand the civil service as part of the rollout; the office brings together existing government and industry functions rather than standing up a new department.
The office has no AI-specific legislation behind it, and its central deliverable, a National AI Strategy, has now missed one deadline and slipped a second. Back in October 2024, Digital Isle of Man's own chief executive told the BBC the Strategy would be complete by the end of that year. It wasn't. In January 2026, government sources told Manx Radio it was now expected by the end of 2026, with the explicit caveat that Tynwald approval made this "unlikely to be approved within the term of the current administration." Digital Isle of Man's current live page has moved the goalposts again: the Strategy is now expected to reach Tynwald "in early 2027." Three stated dates, at least two years apart, for the one document that would give the National AI Office actual statutory teeth.
Guernsey, meanwhile, is treating the Isle of Man as the model worth building toward. An amendment to Guernsey's Government Work Plan 2026-2029, proposed by Deputies Tom Rylatt and Rhona Humphreys and carried on 29 January 2026, directs Guernsey's Policy & Resources Committee to explore "a dedicated AI office or equivalent function, informed by models adopted in comparable jurisdictions such as the Isle of Man," with recommendations due to the States no later than December 2026. A second Crown Dependency now has its own countdown running on the same underlying question.
The UK has no legislation requiring AI-generated content to be labelled, full stop. A House of Commons briefing from January 2026 acknowledges the case for standardised labelling but records no consensus on what a label should even look like, with Ofcom favouring a mix of signals over any single mandated technique. That briefing, and a promised DSIT review of creator-control mechanisms, both now sit under a department that stopped existing on 20 July.
There is a genuine, on-record Crown Dependency response to AI-generated content, but it is narrower than Article 50: the privacy and data protection commissioners of Guernsey, Jersey and the Isle of Man jointly issued an advisory on AI-generated imagery, as part of a wider 61-country coordination effort against deepfakes. Useful, real, and adjacent, not equivalent.
The Haunted Lighthouse is Isle of Man-based, which under Article 2(1)(c) of the AI Act does not exempt us from anything: the trigger is where an AI system's output is used, not where the company sits. Deliver an AI-assisted report to an EU client and the extraterritorial hook applies regardless of where you are.
What that means in practice is genuinely unresolved, and we are not the only ones saying so. Candy Chan of MannBenham Advocates, writing for a Manx professional audience via Digital Isle of Man's own news channel, put it plainly: Article 2(1)(c)'s "precise meaning is still to be confirmed in practice," while advising Isle of Man businesses serving EU clients to "plan on the basis that you may be within scope" regardless of the ambiguity. On the specific deployer obligation, Chan's reading matches ours: deployers of an AI system that generates or manipulates text made available to the public on matters of public interest must disclose that fact, "unless the AI-generated content has undergone human review or editorial control and a person holds editorial responsibility for its publication." She adds a line worth keeping: "deployer liability cannot simply be outsourced by contract to the AI vendor."
Whether a private, bespoke report delivered to a single named client counts as "published" to "the public" at all is the open question neither Chan's piece nor anything else we have found actually resolves. A lawyer can give you a risk-weighted reading of the text and the recitals. Nobody, including qualified counsel, can give you certainty until the Commission issues guidance on that specific scenario, or a case gets litigated.
That is not a criticism of any one company's watermark, or any one jurisdiction's slow strategy document. It is the same gap, showing up at every layer at once: institutions moving fast enough to announce compliance, and interpretive and enforcement machinery too far behind to make the claims actually checkable yet.
Sources
Cross-reference: The Theatre Pulldown
The Sovereign Auditor covers digital sovereignty, cybersecurity governance, and data protection policy—with particular focus on Isle of Man jurisdiction and Crown Dependency issues.
Payments via PayPal. Credentials delivered by email. No Substack. No Stripe. No middlemen.
