AINEWS
Anthropic is replacing Claude's word choice randomness with a key driven pattern to meet the EU AI Act's August 2, 2026 deadline, with no visible mark and no per user traceability.
The change is invisible because it happens before any text exists. Anthropic's new watermark for future Claude models swaps the random number generator the model uses to pick the next word for a key-driven one, embedding a statistical pattern across many low-stakes choices that no reader can see. The swap is the entire mechanism.
A language model writes one token at a time, choosing from a list of candidate next words. Each choice has some probability of being picked; the actual selection uses a pseudo-random number generator. Anthropic's watermarking scheme replaces the arbitrary RNG with one whose output is determined by a secret key and the tokens already chosen. Over many low-stakes picks, the resulting text carries a pattern that the vendor, or anyone with the key, can detect, but readers cannot.
The trigger is regulatory. The EU AI Act requires that providers of AI systems generating synthetic text mark outputs "in a machine-readable format and detectable as artificially generated or manipulated," language Anthropic quotes and which took effect on August 2, 2026 for general-purpose models. Anthropic's post is the first mechanism walkthrough any major lab has published for its implementation. The obligation applies to text served in the EU; non-EU chats may not carry the watermark.
Anthropic's post is explicit: nothing is added to the text. There are no extra tokens, no additional cost, and "no impact on quality or content of Claude's outputs." The pattern lives in which word was picked, not in what the words say.
It is also not user-specific. The key is held by the vendor, not derived from the user's identity, chat, or organization. Anthropic frames the watermark as carrying no identifying information and as not traceable to a specific person, organization, or chat. That is built into the architecture, not promised on top of it. Detectability is global (anyone with the key can find the pattern), but the signal is unattributable to a single user or session.
It is not unique to Claude. Other major model developers have signed the same Code of Practice and will implement their own schemes, the company says. That matters for the reader who assumes this is Anthropic differentiating itself; it is Anthropic complying, and the same default will land on every other major model served in the EU.
Three real limits sit in the design, two of which the source surfaces and one of which it does not.
The key is shared, not personal. That is why the watermark cannot be used to prove "this user sent this message." It is also why anyone who obtains the key can detect every watermarked Claude output. The vendor's own explainer is the strongest source for this trade-off.
The "undetectable to readers" claim is the vendor's own. A reporter chasing independent verification should look for the kind of statistical test that distinguishes watermarked from unwatermarked text at human reading speed, not just at forensic resolution. The Anthropic post does not cite that test.
The third limit is one Anthropic does not address: paraphrase, translation, and token-level rewriting can erode the pattern. Watermark removal is an active research area, and any reader assuming a watermark is permanent is reading past the literature the source does not summarize.
The EU's August 2, 2026 deadline for general-purpose AI providers to mark synthetic text is the date every major lab is racing toward. Anthropic is the first to publish a mechanism explainer. Other major model developers have signed the same Code of Practice and will implement their own schemes, the company says.
The pattern the EU asked for is now in the model. What is not yet in the model, or in the public literature, is a robust, peer-reviewed answer to how it holds up against the simplest attack: paste the watermarked text into a different model and ask it to rewrite.