How AI Text Watermarks Work and Where Major Providers Stand Under the EU AI Act

Hello, this is Ryuta Hamamoto from TIMEWELL.

A lot of people in Japan have been asking me about Claude’s new “squash.” Speech-to-text turns sukashi (watermark) into squash with depressing reliability. What they mean is an invisible mark. Nothing shows up on the screen. Copy the answer into another window, and a machine-readable signal can come along for the ride. Anthropic started doing this on new Claude models from August 2026¹.

I first pictured a faint logo stamped on a page. That is the wrong picture. A text watermark does not sit on top of the words. It lives in the dice the model rolls when it picks the next token. Today I want to walk through how that bias is built, why the industry suddenly had to ship it, and why ChatGPT and Grok were slower to put the same thing on text.

If you want a snapshot of how far your own team has actually gotten with generative AI, take the AI literacy check first. The second half of this piece is really about what you should and should not trust.

What changed since the 13 August original

I re-read this piece on 6 November 2026 and updated three things. First, OpenAI. On 5 October 2026 it announced text watermarking for ChatGPT and Codex in the EU. In August ChatGPT had no text watermark; today the position is "EU-first, rolling out." I could not confirm whether the mark has reached individual users yet.

Second, Claude's detector is still a private preview, not a public tool. Third, the Commission's signatory page was updated on 24 September, and the Code's task forces started in September. The grace period for systems already on the market, 2 December 2026, has not moved, and it is now less than a month away.

This article is a summary of the technology and public information, not legal advice. Check your own obligations with counsel.

The news is Claude. The calendar is Brussels.

Anthropic’s help center is unusually plain. Claude models launched in the EU on or after 2 August 2026 will mark content from day one. Generated text gets an embedded watermark. Supported files get digitally signed provenance metadata. The mark applies on Claude itself, the API, Claude Code, Claude Cowork, Claude Tag, and through AWS, Google Cloud, and Microsoft Foundry. It is not an EU-only switch. It applies wherever Claude is offered¹. The same page also notes that the Amazon Bedrock rollout is due to complete by 10 November, and that on Sonnet 4.6 the text watermark may not reliably appear if temperature or similar sampling settings are changed from their defaults.

Older models get a grace period. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking rule. Anthropic says it is working on those older models as well¹. That grace period is explained as coming from the amendment that simplified the AI Act (the Digital Omnibus). I could not open the Official Journal text this time, so the deadline here rests on the vendor's statement and several secondary summaries. For what the amendment changed, see our Digital Omnibus explainer.

The date is not a product whim. Article 50(2) of the EU AI Act (Regulation 2024/1689) requires providers of systems that generate synthetic audio, image, video, or text to mark outputs in a machine-readable format so they can be detected as artificially generated or manipulated. That clause applied from 2 August 2026². I wrote about how Japanese companies get pulled into the Act’s extra-territorial reach in a separate piece on the 2 August general application date. This one is only about what “mark the output” did to the engineering stack.

The statute does not say “put a watermark on it.” It is technology-neutral. Recital 133 lists watermarks, metadata identifiers, cryptographic methods for proving provenance, logging methods, and fingerprints. What the law asks for is a solution that is effective, interoperable, robust, and reliable as far as this is technically feasible². Perfect resistance to a determined attacker is not the legal test.

On 10 June 2026 the Commission and the AI Office published the final Code of Practice on Transparency of AI-generated Content. By the end of July about 190 organisations had signed. Named examples in Section 1 include Aleph Alpha, Anthropic, Black Forest Labs, Cohere, Google, Meta, Microsoft, Mistral, OpenAI, and Synthesia. xAI's name does not appear on that page as updated on 24 September 2026 either³. Signatories are invited to join two task forces that started in September to share practices. Signing is voluntary. Article 50 still applies if you do not sign.

Fines need a careful reading too. The Act’s headline ceiling is EUR 35 million or 7 percent of worldwide turnover. Obligations in the Article 50 class sit in the middle band of Article 99: EUR 15 million or 3 percent, whichever is higher⁴. Either way, a research topic became a shipping item in the summer of 2026.

The mark is hidden in the next-word choice

There are only three serious ways to tell AI text from human text. The SynthID-Text paper lays this out cleanly⁵.

Retrieval: the provider stores every generation and looks it up later. Reliable, and brutal for privacy. Post-hoc detection: a classifier guesses “how AI this sounds.” DetectGPT and its cousins live here. You do not have to touch the generator. You also inherit a well-documented bias against non-native English writing, and the method gets weaker as models get better. I wrote about why "sounds like AI" is such a shaky test in the uncanny tone problem. Watermarking: you intervene at generation time and leave a statistical signal. Detection can then be explained with a p-value, and in some designs a third party only needs the secret key and the tokenizer, not the model weights.

Kirchenbauer et al. (ICML 2023) gave the field its working vocabulary. When an LLM picks the next token, it scores the whole vocabulary. Hash the previous token with a secret key, use that as a seed, and split the vocabulary into a green list and a red list. Nudge the green tokens up a little, then sample. A detector with the same key rebuilds the lists and counts how many green tokens landed. Unmarked text sits near half green. Marked text sits higher. The difference becomes a z-statistic. You do not get “80 percent AI.” You get “the chance this happened by accident is under one in a million”⁶.

Think of a loaded die, not a logo on letterhead. One roll tells you nothing. Fifty rolls and the sixes look wrong. The detector is just counting those sixes.

That is also why the method dies when the next word is obvious. After “Barack,” the model almost has to say “Obama.” Force anything else and the sentence breaks. A watermark feeds on the model’s uncertainty. Low entropy, weak signal. The paper calls this spike entropy⁶. Code, runs of proper nouns, and short greetings are weak for the same reason.

Google DeepMind’s SynthID-Text keeps the same kind of randomness source and changes the sampling. Tournament sampling. Draw candidates, run them through secret scoring functions, keep the winners, repeat. The surviving token tends to have a high secret score. Detection looks at the average. The default is 30 layers. On about 20 million live Gemini responses, the thumbs-up rate moved by 0.01 percent. Latency rose 0.57 percent. That is the real claim: you can put this in production without wrecking quality⁵.

Berkeley’s Mark My Words then beat the methods up on quality, the number of tokens you need, and tamper resistance. In the temperature range people actually use, the Kirchenbauer-style shift is strongest. About 50 to 60 tokens, roughly 40 English words, is enough to detect. On code, accuracy drops and detection gets shaky. A GPT-3.5 paraphrase removes the mark more than 60 percent of the time, even on the best scheme they tested⁷.

Anthropic has not published the exact algorithm. Green list, tournament, something else: the help page only says the mark is woven into the text, does not change meaning or quality, and can survive a copy-paste¹. The shared idea since 2023 is the same. You do not hide a special character. You hide a bias in the statistics of word choice.

Files are a different layer. SVG, PNG, and JPG from Claude can carry C2PA signed provenance¹. That is an envelope on the file, not a bias in the tokens. A screenshot usually strips it. The Code of Practice’s two-layer picture (embedded mark plus signed metadata) exists because each layer fails in a different way.

Why ChatGPT and Grok were late

In August it was easy to read this as a morality play: Claude did the right thing, everyone else is late. I do not buy that. The public record shows different constraints, not different ethics.

OpenAI said in May 2024 that it already had a text watermark. The August update is blunt. The method survives local paraphrase. It fails against translation, a rewrite by another model, or the cheap trick of inserting a special character between every word and deleting it later. Trivial for a motivated attacker. The same note warns that the mark could stigmatize non-native English speakers who use the model as a writing aid⁸. At the time, the company put images and audio first. Those were the higher-risk modalities for deception.

As of August 2026, OpenAI's help page said images carry C2PA metadata and a SynthID watermark, audio carries SynthID, and text was a goal: expand provenance signals to all modalities, including text. No shipped text feature was described⁹. That is the picture in the original version of this piece.

Then things moved. On 5 October 2026 OpenAI announced that it will add an invisible watermark to text generated in ChatGPT and Codex in the EU. The method is called textGrain, and it puts a statistical signal into word choice. It rolls out to eligible users on all plans over the coming weeks, in the EU only. In the API, developers worldwide can opt in for selected models; it is off by default, and OpenAI says it is not a global default at launch¹⁰.

OpenAI states the limits up front. The mark can show that an OpenAI system generated or processed part of a text. It cannot identify the user, measure how much a person contributed, establish ownership, or verify accuracy, and a missing mark does not prove a human wrote the text. Short passages and later edits make detection less reliable. Detector access starts with approved researchers and expert organizations¹⁰. Press coverage reports that in OpenAI's tests, replacing 10 percent of words with synonyms cut detection from about 92 percent to about 66 percent¹¹.

This makes the contrast with Anthropic clear. Claude marks text worldwide. OpenAI marks ChatGPT and Codex in the EU only, and makes the API opt-in. I read that as a design difference in how far to read the regulation and how to explain it to non-EU users, not as right versus wrong. How OpenAI weighed its 2024 worry about stigmatizing non-native English speakers, I cannot judge, because I could not retrieve the full announcement.

When providers differ on whether and where they mark, your internal lines get uneven too. Deciding which AI tools may receive which data starts with designing an in-house policy that assumes shadow AI.

Signing the Code and shipping a mark are separate things. OpenAI is a signatory³. Article 50 is technology-neutral, so methods other than watermarks are allowed. I would not write “no text watermark means illegal,” and I would not write “watermarked means compliant” either.

Google already put SynthID-Text into Gemini in 2024 and published the paper⁵. The implementation is open source, available in Hugging Face Transformers v4.46.0 and later, and its detector returns one of three results: watermarked, not watermarked, or uncertain. Google's developer documentation itself says the mark is less effective on factual answers, loses confidence after heavy rewriting or translation, and is not designed to directly stop motivated adversaries¹². Claude is not the first production text watermark. It is the first time a chatbot that Japanese knowledge workers live in all day started marking the body of the reply. That is why it feels sudden.

Grok is thinner on the record. xAI’s name does not appear on the Commission’s signatory page, updated 24 September 2026³. I also cannot find an Anthropic-style help article that says Grok embeds a text watermark. I am going to stop there. Absence from the Code is not an exemption. If you offer a generative system in the EU, Article 50 still applies. The Code is a smoother way to show conformity, not a waiver. Whether xAI marks some other way, is using the grace period for older models, or will ship later is not something I can split from public documents.

My own read: the reason OpenAI held back in 2024 was not “the science is missing.” It is “text lies less easily than pixels.” An image watermark can hide in many pixels. A text watermark has a small set of next-word choices, and one paraphrase can wreck the statistic. OpenAI’s 2024 worries line up with later papers. Jovanović, Staab, and Vechev showed you can approximate a secret watermarking rule from a public API for under $50, and push scrubbing success above 80 percent¹³. Zhang et al. proved that, under natural assumptions, strong watermarking is impossible¹⁴.

So I will not pick a hero. The lab that shipped first matched the regulatory calendar and published the limitations next to the feature. The lab that followed knew how the mark breaks and chose a narrower rollout. Both stories fit the public evidence.

Where the mark disappears

Anthropic says this first, which I respect. A detected mark does not mean Claude wrote the original ideas. People use it to proofread, translate, summarize, or convert a file. No mark does not mean the text is human. Old models, heavy edits, translation, mixing with other writing, very short passages, stripped file metadata: all of those can come back clean¹.

Map that onto the research and the failure modes are boringly specific. Short text. Code. Strings of proper nouns. Structured JSON. A determined paraphrase. Open-weight models run locally. There is no practical way to force a watermark onto a model someone else downloaded. The SynthID-Text authors say so themselves⁵.

It still does useful work. Casual copy-paste gets more expensive. Platforms can filter at scale. A provider can find its own outputs later. And it is one concrete way to implement “machine-readable marking.” Mark My Words is honest about the threat model: a student trying to skip homework is unlikely to translate, rewrite with a second model, and sprinkle special characters⁷. Not a vault. A speed bump.

The stealing paper is nastier because removal and spoofing arrive together. If an attacker stamps hate speech with “that company’s watermark,” the blame slides toward the provider¹³. This is not an ID check. I keep coming back to a seatbelt. It will not stop the crash. Driving without one makes the crash worse.

I would also not transplant the English token counts into Japanese without blinking. Tokenization is different. A particle can split a phrase. “Detectable at 50 to 60 tokens” is an English result. Until Claude’s detector is public, the honest operating rule is: long prose keeps the signal, a two-line Slack reply probably does not.

Treat it like a seatbelt

If I were writing the internal policy, I would start here: do not let a detector decide a hiring, academic, or legal outcome by itself. Job applications, papers, press drafts, customer letters. A hit or a miss is not enough. Short text misses. Light editing still hits. Both are in the vendor’s own docs¹.

Hold two layers instead. A statistical mark in the text, and signed metadata on the file (C2PA). That is the stack the Code of Practice is pushing. For anything that leaves the company as an image or a slide, ask whether a screenshot or a re-save will strip the envelope. For text, log which model, when, and from which prompt. The watermark is a backup. It is not the system of record.

We are also past the point of judging writing by whether it “sounds like AI.” As I noted earlier, better models close the gap. Post-hoc detectors have already hurt non-native writers. That is why providers started marking at generation time. I think that move is right. Over-reading the mark creates the next accident: treating watermarked prose as dirty prose. That is exactly the stigma OpenAI flagged in 2024⁸.

If I had to bet on the rest of 2026, the fight will not be “who watermarked first.” It will be “who is allowed to use a detection result, and for what.” Universities, recruiters, newsrooms, platforms. The cost of a false positive is different in each room. The Code's task forces have been running since September 2026³. Japanese companies should be in that conversation with operational language, not just a translated FAQ. In Japan, the AI Guidelines for Business from MIC and METI were reported to have been revised to version 1.2 in March 2026. I could not confirm how that text treats watermarks or provenance, so please check the original before setting your own policy.

The harder job sits in front of the watermark: how the company treats model output, and which human still owns it. That is the work we do in WARP. Model choice and prompts, yes, but also provenance, internal rules, and the literacy of the people who hit send. If “we’ll just buy a detector” already feels thin, start from a conversation.

Invisible marks will become plumbing. Once they are plumbing, the valuable skill is not owning the mark. It is knowing how to read it.

References

Footnotes

1. Anthropic, How Claude marks AI-generated content (Claude Help Center) ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

2. Regulation (EU) 2024/1689, Article 50 / Recital 133 ↩ ↩²

3. European Commission, Strong backing for the Code of Practice on Transparency of AI-generated Content (published 31 July 2026, updated 24 September 2026) ↩ ↩² ↩³ ↩⁴

4. Regulation (EU) 2024/1689, Article 99 ↩

5. Dathathri, S. et al. (2024). Scalable watermarking for identifying large language model outputs. Nature 634, 818–823. DOI: 10.1038/s41586-024-08025-4 ↩ ↩² ↩³ ↩⁴

6. Kirchenbauer, J. et al. (2023). A Watermark for Large Language Models. ICML 2023. arXiv:2301.10226 ↩ ↩²

7. Piet, J. et al. (2025). Mark My Words: Analyzing and Evaluating Language Model Watermarks. IEEE SaTML 2025. arXiv:2312.00273 ↩ ↩²

8. OpenAI, Understanding the source of what we see and hear online (7 May 2024, updated 4 August 2024) ↩ ↩²

9. OpenAI Help, Provenance signals (Content Credentials, SynthID) in OpenAI-generated content ↩

10. OpenAI, Our approach to EU text provenance rules (OpenAI Developer Community, Announcements, 5 October 2026). The full text on openai.com could not be retrieved, so this is confirmed through the official forum post ↩ ↩²

11. TechCrunch, OpenAI will start watermarking ChatGPT's text in the EU (5 October 2026). The synonym-replacement figures are press reports of OpenAI's tests and were not checked against a primary source ↩

12. Google AI for Developers, SynthID Text ↩

13. Jovanović, N., Staab, R., & Vechev, M. (2024). Watermark Stealing in Large Language Models. ICML 2024. arXiv:2402.19361 ↩ ↩²

14. Zhang, H. et al. (2024). Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models. ICML 2024. arXiv:2311.04378 ↩