Claude Now Marks Its Own Work, Which Means Your Disclosure Policy Is Overdue

Anthropic published a support page this week stating that Claude models launched from August 2 onward embed an invisible watermark into every patch of text they generate, and attach signed provenance metadata to supported file types such as .svg, .png and .jpg ^[1][2]. Provenance has therefore stopped being an optional tool a buyer switches on and become a property of the output itself, which means any team shipping Claude-assisted copy or assets needs a disclosure position before a customer, an auditor or a regulator supplies one.

The mechanism determines the reach. Anthropic says the text watermark works by statistically biasing Claude's word choices according to a key the company holds; individual choices look unremarkable, but across enough text the pattern becomes detectable ^[5]. The mark is applied at the model level, so it is present no matter which Claude product or surface the text comes from, and it travels with the text when copied and pasted and may persist through some editing ^[6]. Coverage includes the API, Claude Code, Claude Cowork and deployments through AWS, Google Cloud and Microsoft Foundry ^[7]. Older models are being retrofitted with no stated timeline ^[8]. Anthropic is applying the requirement globally, not only to EU users ^[9].

File provenance is the weaker half. The metadata follows the Coalition for Content Provenance and Authenticity standard, the same one Google and Adobe use, and a signed label indicates a file was processed by Claude while allowing tamper detection ^[3][10]. It can also be stripped by re-saving or format conversion, which is why Anthropic frames the two systems as complementary ^[11].

The trigger is Article 50 of the EU AI Act, enforceable from August 2, which requires generative AI providers to mark outputs in machine-readable formats so downstream users, regulators and platforms can identify AI-generated content ^[12]. Non-compliance can reach EUR 15 million or 3 percent of total worldwide annual turnover, whichever is higher ^[13], so the percentage branch is the binding one for any company above roughly EUR 500 million in turnover ^[14]. The cutoff is not incidental: the watermarked models start on the same day the article became enforceable ^[25]. Anthropic signed the Act's Code of Practice on Transparency of AI-generated Content, a voluntary framework that confers a presumption of meeting the Article 50 standard, which almost 200 companies including Microsoft, Google, Meta and OpenAI had signed as of late July ^[15][16]. xAI has not signed ^[17]. Google has watermarked AI-generated images since 2023 and extended that to text, audio and video ^[18]. OpenAI has reportedly had the capacity to watermark ChatGPT text for years and has not done so, which the Wall Street Journal attributed to concerns including false positives and competitive risk ^[19].

The operational trap is what a hit actually proves. A detected watermark means content may have been assessed or processed by Claude, not that Claude wrote it: someone who used it to proofread, translate or summarise their own work produces marked output for text that is substantially theirs ^[20][21]. Absence proves little either, since older models, very short passages, heavily paraphrased text and files whose metadata was stripped by screenshots or format changes carry no detectable signal ^[22]. Anthropic says it will release detection tools so users and third parties can check text and files ^[23]. Lawyers, academics, researchers and writers have already objected to editing assistance carrying an AI marker they did not choose ^[24].

Three things to settle internally: where your line sits between drafting and assistance, what you tell clients and regulators about each, and how you respond when a counterparty runs a detector and treats a hit as proof of authorship.