Claude's watermark labels contact, not authorship, and your proofread draft carries it

Anthropic switched on an imperceptible statistical watermark in Claude's text output in August 2026, applied at the token-selection layer and, per its support documentation, active wherever Claude is offered rather than only in the EU ^[1][3]. Because the mark lands during decoding, text Claude merely edited carries the same signal as text it wrote, which hands anyone using Claude as a proofreader a provenance record they did not create and cannot inspect ^[1][10][13].

The driver is EU AI Act Article 50, whose enforcement began across member states on August 2, 2026 and requires providers of generative systems to mark synthetic output in a machine-detectable format ^[2]. Anthropic has signed the Article 50(2) Code of Practice on Transparency of AI-Generated Content and says it will comply with text watermarks plus signed provenance metadata in files such as PDFs, images and SVGs ^[5]. The text method, based on Google's SynthID-Text, partitions the vocabulary into pseudorandom green and red token sets keyed to preceding context and biases the logits of green candidates upward ^[9][7]. It adds no token overhead, no latency and no price change, runs the same across web, API, Claude Code and partner clouds, and encodes no customer identity, prompt payload or conversation metadata ^[8].

That last point defines the ceiling on what a detection hit means: contact, not authorship. The dev.to analysis makes the mechanical case plainly, that a proofreading request is not a red-pen pass but a full regeneration, and the biased selection applies at every position, including positions where the model picks the word you already had ^[10]. Anthropic's own detection language is that content "may have been processed by Claude" ^[11]. The same piece argues a university plagiarism checker, a publisher's AI filter or an applicant screener will not preserve that distinction ^[12]. Anthropic says meaning, quality and readability are untouched ^[6]; John Gruber argues on Daring Fireball that the key sometimes promotes a worse word and that "imperceptible" is simply wrong ^[21].

Legal trade publication Artificial Lawyer, as summarised by The Decoder, is mostly relaxed but flags the cases operators actually meet: clients who have explicitly banned AI use, a sceptical judge, and an AI contribution that becomes provable even when the filed document is factually flawless ^[19]. The marks also travel: a contract can be part-marked, templates carry old marks forward into new agreements, and several models' watermarks can overlap in one file ^[20].

Coverage is uneven in the wrong direction for these workflows. Anthropic says marking is sparser in fact-heavy passages because fewer word alternatives exist, and there is no empirical study of the effect yet ^[14], while detection degrades badly below sixty tokens or after translation chaining and multi-model paraphrase loops ^[15]. The short, precise, high-stakes edit is therefore the least reliably marked and the long discursive draft the most ^[2]. False positives are a separate concern on low-entropy output such as boilerplate code and structured config files ^[16].

There is no opt-out, and no way to see the mark or measure how much of a document it touches ^[13], while stripping it is already a commodity. The watermarks-remover repository took thousands of GitHub stars inside twenty-four hours, per Eduardo Ordax's LinkedIn analysis ^[17], and the paraphrasing tool Declaude removes the signal; its developer James Padolsey says the rule mostly hits ordinary users while doing little against deliberate circumvention ^[18]. The mark therefore persists mainly on people who were not trying to hide anything ^[1].

Watch the retrofit of pre-August Claude models, which Anthropic says is coming over the next months ^[23]; whether Anthropic ever publishes per-document coverage or detection thresholds an editor could audit against their own file ^[13]; and whether academic and procurement policies write down the difference between processed and generated, given that self-hosted open weights leave decoding parameters entirely with the operator ^[24].