The Watermark Is Not a Control

On 2 August 2026, a transparency obligation in the EU AI Act became enforceable, and Anthropic responded by embedding an invisible watermark into everything Claude writes. Within a week, I watched organisations start folding this into their AI policies as though a governance problem had just been solved.

On 2 August 2026, a transparency obligation in the EU AI Act became enforceable, and Anthropic responded by embedding an invisible watermark into everything Claude writes. The mark is applied at the model level, so it appears no matter which product the text comes from, and it applies worldwide rather than only in Europe.

Within a week, I watched organisations start folding this into their AI policies as though a governance problem had just been solved.

It has not. A watermark answers a question almost nobody in a regulated environment is actually asking.

What the mark is

Anthropic has not published its method, so anything mechanical said about it is reasoning from the published literature rather than confirmed implementation. Say that out loud, because the gap matters.

The reference implementation is SynthID-Text, which Google DeepMind published in Nature in October 2024. It does not alter training. It alters sampling. At each step, where the model would ordinarily pick the next token from its probability distribution, the scheme samples a set of candidates and runs them through pairwise rounds, seeded by a hash of the preceding tokens combined with a secret key. The winner becomes the word that gets written.

Do that across a few hundred tokens and the text carries a faint statistical bias that nobody can see and a detector can measure.

Detection produces a score describing how strongly the text correlates with the key. That score is compared against a threshold.

Read that sentence again, because every limitation that follows is contained in it.

Why the mechanism dictates the limits

This is not a serial number stamped on a document. It is a statistical judgement across a body of text.

So a short passage carries too few tokens to score reliably. Paraphrase resamples the tokens and the signal decays. Translation rebuilds the text in a different vocabulary entirely. Any threshold implies a false positive rate, and Anthropic has not published one.

The academic literature is already ahead of the deployment. Researchers at ETH Zurich found spoofing success rates above 80 percent against earlier red-green watermark schemes, falling to 9 percent once tournament sampling and a larger context window were introduced. Better, and not zero. A 2026 paper describes an attack that weakens detectability by exploiting the way the detection statistic aggregates.

Anthropic is candid about the practical consequence. A detected mark means the content may have been processed by Claude. It does not mean Claude wrote it, because someone may have used the model to proofread or translate their own work. And an absent mark proves nothing at all.

Processed, not authored. That distinction is the whole thing, and it is the first casualty when a policy gets drafted quickly.

The question governance actually asks

Article 50 places a transparency duty on the provider of the system. Non-compliance sits in the middle penalty tier under Article 99(4), up to 15 million euro or 3 percent of worldwide annual turnover, whichever is higher.

That is a real obligation. It is also a narrow one. It requires that machine-generated content be machine-detectable. It says nothing about whether the output is correct, whether the person using the tool was competent to judge it, whether the decision it fed should have involved a model at all, or who carries the consequence when it goes wrong.

Now put that beside the regime a pharmaceutical manufacturer actually operates under.

Draft EU GMP Annex 22 covers AI in critical GMP applications, and it scopes itself to static, deterministic models. Probabilistic models, generative AI and large language models are excluded, with the draft stating they should not be used in critical GMP applications. The consultation closed in October 2025 and no final annex had been published as of mid 2026. EMA convened a workshop on 30 June and 1 July 2026 to shape a risk-based approach to generative AI in manufacturing, the category the draft had ruled out.

Hold the two together and the mismatch is obvious.

Article 50 tells you a machine touched the text. Annex 22 tells you the machine should not have been anywhere near that decision.

Those are not two answers to one question. They are answers to entirely different questions, and only one of them is about your liability.

What this looks like in practice

Three things follow, and none of them involve a detector.

Disclosure gets declared by the person, not inferred by a tool. Adopt a simple tag on internal deliverables and write the processed-not-authored distinction into conduct policy now, before the first dispute rather than during it. Detector output is a reason to have a conversation. It is not a finding, and it will not survive an appeal.

Provenance gets captured at the gateway. Model, prompt version, timestamp, hash of the raw output, logged at generation. That record is yours, it is complete, and it does not degrade when someone runs the text through a copy-edit. Never build a control that depends on a vendor signal surviving downstream, because it will not.

Disclosure gets written into vendor contracts. Which models, at which stage, with what human review, named in the SOW. Contractual disclosure matters precisely because detection is unreliable. And if you embed these models in your own product, the Article 50 obligation lands on you rather than on the vendor. Most agency agreements have not caught up with that yet.

The pattern underneath

This is the same failure I keep meeting in AI adoption generally, wearing new clothes.

A technical signal arrives. It is genuinely useful for the narrow thing it was built to do. Organisations then reach for it as a substitute for the organisational work they have been avoiding, which is deciding who is accountable for what, at which point, with what evidence.

Watermarking is a good faith engineering answer to a regulatory transparency requirement. It is not an answer to the question of whether your people should have used the model, whether anyone checked the output, or who signs their name to it.

Schools, employers and platforms are already treating detection as proof, while the documentation in front of them says clearly that it is not. The organisations that get hurt will be the ones that wrote "AI detected" into policy without reading the limitations section.

The mark tells you a machine was in the room. It will never tell you who was in charge.