Since August 2, AI providers serving the EU market are required to mark AI-generated content under the EU AI Act’s Code of Practice — and Anthropic just published the clearest technical explanation yet of how it’s complying. In a post dated August 14, the company confirmed that future Claude models will generate text containing a watermark, built on Google DeepMind’s SynthID-Text method, published in Nature in 2024. The idea traces back to a 2022 proposal by Scott Aaronson.
The short version: text from future Claude models will be statistically watermarked, invisible to readers, and recognisable only to whoever holds the key.
How you watermark text without changing it
Language models generate one word at a time, and at most steps several words fit equally well. “The weather today was cold and…” could be followed by “overcast” or “grey” with no real difference in meaning. Normally the model settles these low-stakes coin flips with an ordinary random number.
Watermarking changes where the randomness comes from. Instead of a generic random number, the choice is derived from the watermark key plus a few preceding words. Anthropic’s analogy: it’s like playing Monopoly where instead of rolling dice, each player’s moves come from the digits of pi. The moves are still effectively random and the game plays out normally — but if you know it’s pi, you can later tell that game apart from one played with dice.
Crucially, the model isn’t biased toward particular words. One sentence gets “overcast,” the next gets “grey,” just as it would anyway. Anthropic states the watermark doesn’t push the model toward words it wouldn’t normally use, adds no hidden characters, costs no extra tokens, and carries no identifying information about who wrote the prompt. In DeepMind’s testing — serving watermarked output to a slice of Gemini traffic — thumbs-up/thumbs-down ratings showed no statistically significant difference from unwatermarked output.
What it can and can’t do
The output is a probability, not a verdict: a check can estimate the likelihood that Claude was involved in writing a passage. That matters for the plausible real use case — long AI-generated texts used deceptively, where an accumulating statistical signal becomes meaningful. A short watermarked paragraph proves little. A 5,000-word essay is a different story.
Three limits are worth stating plainly. First, the detector requires the key, which Anthropic controls — so independent verification means trusting Anthropic, or whatever auditing arrangements emerge. Second, watermarks are for AI-generated text specifically; they don’t address misinformation from other sources. Third, paraphrasing and heavy editing erode the signal, and determined adversaries with API access can attack the mechanism itself.
Anthropic notes other major developers signed the same Code of Practice and will implement their own watermarks — so this becomes an industry-wide baseline in the EU rather than one company’s feature.
The open-weight problem
Here’s the tension the announcement doesn’t dwell on: watermarking works because the provider controls inference. Open-weight models running on your own hardware have no such chokepoint, which is partly why watermarking mandates bind cloud providers and not the weights themselves. Our earlier coverage of how watermarks are splitting the open-model world and the C2PA and SynthID labelling ecosystem covers that fault line.
For New Zealand readers, the practical effect is indirect but real: text produced by Claude, Gemini and other signatory models for EU-market users will be statistically marked. Nothing visible changes, but the provenance of the text flying across your inbox becomes — in principle — checkable, if you’re the provider or someone they’ve granted access.
— CJ Murden, editor of Singularity.Kiwi. Former digital technologies teacher, author of AI-focused books. Writing with a New Zealand focus.
