There is now a real AI watermark. You don't have the key.
Somebody hands you a document and asks whether AI wrote it. A supplier's report, a job application, a piece of copy you're paying for. You paste it into a detector, get a percentage back, and make a decision about a person or an invoice.
That percentage is not evidence. It's an opinion produced by software that is guessing from style, and on August 14 the reason became a great deal clearer.
What Anthropic published
Anthropic put out a technical explanation of how Claude watermarks the text it generates.
The mechanism is elegant. When a model writes, it constantly picks between words that are all equally viable. Instead of choosing at random, Claude uses a key plus the few words that came before to settle which one to pick. Do that across thousands of small choices and a pattern accumulates in the text.
A reader can't perceive it. The wording stays natural, because every option it chose between was a reasonable option. But the pattern is mathematically verifiable if you hold the key.
Anthropic also attaches content credentials to supported file types, using the C2PA standard for formats like .png, .jpg, and .svg. That part is metadata on a file rather than a pattern inside the words.
The key is the whole story
Detection requires the key, and Anthropic holds it. The company says it's still working out the details of a detection API.
So there are two entirely separate things both called AI detection.
One is the watermark: a deliberate, verifiable signal placed by the model's maker, readable by whoever holds the key. The other is the third-party detector your team pastes text into, which has no key and never will. It's inferring from writing style. Those tools are doing something genuinely different from what the watermark does, and the arrival of real watermarking does nothing to make them more reliable.
If your organization makes decisions about people based on a detector score, that is worth sitting with. The score was never reading a watermark. It was reading prose and forming an impression, and now there's a real signal in the text that it still can't see.
What the watermark itself does not prove
Anthropic is unusually direct about the limits, and the limits matter more than the mechanism.
A watermark can only establish that Claude was likely involved with the content at some point. It can't distinguish "Claude wrote this" from "Claude heavily edited this." It carries no information about which person used the tool. It says nothing about ownership, and nothing about who is responsible for what the text claims.
For most workplace questions, that gap is the entire question. "Did a person write this" and "was a model involved anywhere in producing this" are different questions, and only the second one is answerable.
Where the signal thins out
The technique has honest failure modes, and Anthropic lists them.
It gets sparser on factual passages, because there are fewer word choices available that don't damage accuracy. It works poorly on short samples, since fewer choices means less signal. It barely applies to code, where the correct output often isn't a choice at all. When Claude edits text a person wrote, there's little to mark, because nearly all the words are the person's.
Light editing probably won't remove it. A complete rewrite where every word changes will. Translation keeps it, because every word in the translation was chosen by the model.
Read that list as a shape. The watermark is strongest exactly where a model wrote freely at length, and weakest where a person and a model worked together. Collaboration is the common case in most companies, and it's the case the signal handles least well.
Why this landed now
Marking synthetic content became a legal obligation in the EU on August 2, 2026, under the AI Act's transparency rules.
Alongside that, the Commission ran a voluntary Code of Practice on Transparency of AI-generated Content. By July 31, 2026, around 190 organizations had signed: 82 as providers and 152 as deployers, with Anthropic, Google, Meta, Microsoft, and OpenAI among the providers. The Code is voluntary. The underlying obligation is not.
That's the context for a watermarking explainer arriving in August. The marking duty is live, the major providers have committed to a shared approach, and the tooling that lets anyone else verify a mark is still being built.
