AI Text Watermarking, Explained

AI text watermarking is a hidden signal that an AI company adds to the text its model writes, so that the text can later be identified as machine-generated. It became a live issue in August 2026, when Anthropic began marking everything Claude writes, worldwide, with no way to switch it off. The part almost nobody is saying out loud is that no member of the public can currently check for that mark. Best Answer Hub wrote this guide because the gap between "your text is now marked" and "anybody can verify the mark" is where every practical question actually lives.

This guide separates the three different technologies that get called watermarking, sets out what Anthropic, Google and OpenAI each actually do, tests the marks against ordinary editing, explains who can and cannot read them, and finishes with what the law asks of an ordinary business. It sits alongside the Best Answer Hub pillar on small business AI readiness and the guide to small business AI policy.

What is AI text watermarking?

AI text watermarking is a deliberate, hidden signal placed in machine-written text at the moment it is generated. Unlike a visible label, it is designed to be invisible to a reader and readable by a machine. Three quite different technologies get called by that one name, and most of the confusion in the current coverage comes from mixing them up. Best Answer Hub separates them here because they behave in opposite ways under ordinary editing.

Only the first of those is a watermark in any meaningful sense. The second is metadata that a copy and paste destroys. The third is closer to a trick than a security measure, and it doubles as an attack on the first: the original academic paper on statistical watermarking notes that inserting stray characters breaks enough tokens to remove the watermark entirely (Kirchenbauer et al., ICML 2023).

What did Anthropic actually announce, and when?

Anthropic committed to marking Claude text output at model level, across every Claude surface, worldwide, with no documented opt-out. It was not a press release. The primary source is a Claude Help Center article that appeared around 10 August 2026 and was picked up by the technology press the following day. That quiet arrival is itself part of the story, and it explains why so little technical detail accompanied it.

The support documentation states that when a supported model generates text, it "weaves an imperceptible watermark directly into the text itself," and that the marking covers output "everywhere you use Claude, including Claude Platform (API), Claude, Claude Code, Claude Cowork, and Claude Tag" (Anthropic, 2026). On timing, it is precise: "Claude models launched on or after August 2, 2026 support marking at launch," with earlier models being retrofitted.

What has not shipped is the part that would make any of it usable. Anthropic says it is "working to enable users and other third parties to detect Claude's embedded watermarks," with technical documentation to follow. Until that lands, the practical position is a mark that exists and cannot be checked by anybody outside the company.

Which AI tools actually mark the text they write?

Fewer than the headlines suggest. The popular framing is that the AI industry has started watermarking text, and that overstates it considerably. Two labs mark text today. One built the capability and deliberately shelved it. The rest have signed a European code of practice without shipping anything specific to text. Best Answer Hub sets the position out plainly, because the difference between signing a commitment and running the code matters.

Google reached production first, and by a wide margin. Its SynthID-Text method was published in Nature in October 2024 and validated across roughly 20 million Gemini responses, which remains the only production-scale text watermarking deployment with a peer-reviewed evaluation attached (Dathathri et al., Nature, 2024). Google describes the mechanism openly: the model adjusts the probability scores it assigns to candidate words, in a pattern that is invisible to a reader.

OpenAI is the interesting case, because it made the opposite decision on purpose. Its live provenance documentation lists C2PA and SynthID for images and audio, with text absent entirely. The stated reason for never shipping the text watermark it had already built is worth quoting: the method "has the potential to disproportionately impact some groups," and could "stigmatize use of AI as a useful writing tool for non-native English speakers" (OpenAI, 2024). Hold on to that sentence. It predicts, precisely, the problem set out further down this page.

Does an AI watermark survive copy and paste, or editing?

A statistical watermark survives almost everything except changing the words, and dies the moment somebody does. That is the whole picture, and it explains behavior that otherwise looks contradictory. There is nothing to strip out of the text, because nothing was added: the mark lives in which words were chosen. Retyping the passage by hand preserves it. Running it through a translator destroys it. Best Answer Hub finds this the most useful thing to understand about the technology, because it predicts every other outcome.

Anthropic's own wording matches this exactly: the mark travels with copied text and "may persist through some editing," but detection may fail where text has been "heavily edited, paraphrased, translated, or mixed into other writing," or is very short. Google gives the same caveats for SynthID, adding that watermarking is less effective on factual answers, where there is less room to vary the wording without damaging accuracy.

The academic picture is blunter. A July 2026 evaluation ran three published schemes through meaning-preserving paraphrase across 846 test runs, and found a single pass removed 100 percent of two older watermarks and 98.3 percent of an open implementation of SynthID-Text. The authors concluded that the configurations tested "do not meet the evidentiary bar that courts require" (Tamim and Khan, 2026). A 2024 theoretical result goes further, proving that strong watermarking is impossible in principle once an attacker has a way to rewrite text while preserving quality (Zhang et al., ICML 2024).

Who can actually detect an AI text watermark?

Almost nobody, and that is the single most important fact on this subject. Detecting a statistical watermark requires the secret key used to create it, so detection is a private capability of the company that made the model. Not teachers, not editors, not publishers, not employers, and not the person who received the text. As of August 2026 there are zero public detectors for Claude text. The Google detector portal exists but is waitlisted to journalists and researchers, and its 2026 content detection preview covers images only.

So a strange situation now exists. Text is being marked by law, and the marking cannot be read by any of the people the law was written to protect. Meanwhile the tools those people already use are not watermark detectors at all. They are perplexity classifiers, which guess at whether writing looks statistically ordinary, and they are badly, measurably wrong.

The evidence on that is not close. A peer-reviewed Stanford study ran seven widely used detectors over 91 TOEFL essays written by non-native English speakers and found a mean false-positive rate of 61.22 percent. Nearly one essay in five, 19.78 percent, was flagged as AI-written by all seven detectors at once. Against a control set of essays by native-speaking US eighth-grade students, the same detectors were near-perfect, with a false-positive rate of about 5.19 percent (Liang et al., Patterns, 2023).

The mechanism behind that result is the important part. When the same TOEFL essays were rewritten with richer vocabulary, misclassification collapsed from 61.22 percent to 11.77 percent. The detectors were never finding AI. They were penalizing simple word choice, which is what learning a language looks like. OpenAI's stated reason for shelving its own text watermark, quoted earlier on this page, described this exact harm two years before anyone measured it at scale.

The retired OpenAI classifier gives the numeric floor for how bad public detection was. It correctly identified 26 percent of AI-written text while wrongly labeling 9 percent of human writing as AI, and OpenAI withdrew it in July 2023 "due to its low rate of accuracy" (OpenAI, 2023). Nothing available to the public since has been shown to do materially better.

Does a watermark mean AI wrote it?

No, and the clearest statement of that comes from Anthropic itself. Its documentation concedes that a detected mark means the content may have been processed by Claude, which covers proofreading, translating, summarizing and reformatting text a person wrote themselves. The mark cannot distinguish a novel drafted by a model from a paragraph a human wrote and asked a model to tidy. It also concedes the reverse: the absence of a mark does not mean the content was not AI-generated.

A watermark answers a narrow question about which software touched a passage. It does not answer the question people actually want answered, which is who did the thinking.

This is where the no-opt-out decision bites hardest. Someone who writes their own work and runs it through Claude for a grammar check now ships marked text, indistinguishable at the detector level from text the model wrote from nothing. For non-native English speakers, who are among the heaviest users of AI for exactly that kind of polishing, the effect compounds with the detector bias in the section above.

There is a further problem in the opposite direction. Marks can be forged. A peer-reviewed attack showed that repeatedly querying a watermarked model reveals enough of the hidden pattern to stamp a convincing watermark onto text a human wrote. The authors report that for under 50 US dollars an attacker can both forge and strip state-of-the-art schemes, at an average success rate above 80 percent (Jovanovic, Staab and Vechev, ICML 2024). Tournament-based schemes such as SynthID resisted this far better, but the principle stands. Best Answer Hub draws one practical conclusion from all of it: a watermark result is evidence, never proof, and no disciplinary or contractual decision should rest on one alone.

What does the law actually require of a business?

Far less than most owners fear, because the marking duty falls on the model provider rather than on the person using the model. The European Commission is explicit that Article 50 of the EU AI Act "applies as from 2 August 2026," and the clause driving all of this month's news binds providers: those generating synthetic audio, image, video or text content must ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated" (European Commission, 2026). That is Anthropic's obligation, not a small business obligation.

A separate clause does reach businesses that publish. Deployers must clearly label AI-generated or manipulated text "published with the purpose of informing the public on matters of public interest," and the Commission's own list of what counts is broader than most summaries report: politics, public administration, justice, fundamental rights, public security, public health, environmental protection, consumer safety, and economic, financial, political, scientific or cultural developments that may be a relevant subject of public debate. Ordinary product and marketing copy sits outside that. A blog post on financial or health topics may not.

Penalties for the transparency obligations reach 15 million euros or 3 percent of total worldwide turnover, whichever is higher, which is why providers moved quickly. Systems already on the market before 2 August 2026 have until 2 December 2026 to retrofit machine-readable marking, which is the deadline shaping Anthropic's rollout schedule.

Platform rules matter more day to day than statute does, and text is the gap in almost all of them. Google Search has no disclosure requirement at all: its policy targets scaled content abuse, penalizing unoriginal, low-value pages "no matter how it's created" (Google Search Central). YouTube explicitly exempts AI-written scripts, titles and outlines. Amazon KDP does require authors to disclose AI-generated text at the point of publishing, and academic publishers require a declaration that appears in the finished article. Best Answer Hub recommends checking the venue rather than assuming a general rule exists.

What should a small business actually do?

Set a disclosure standard by what the AI actually did, then hold to it. Three tiers cover almost every real situation, and they are the same three that Amazon, the academic publishers and the EU AI Act arrived at independently, which is a reasonable sign they are the right cut. Best Answer Hub recommends writing them down once and applying them to every deliverable, rather than deciding case by case under pressure.

That last point is worth dwelling on, because the pattern in the real cases is consistent and it is not what people expect. In October 2025 Deloitte Australia agreed a partial refund on a report for an Australian government department after it was found to contain fabricated citations and a misattributed legal quote, with the AI use undisclosed until academics raised questions. In May 2025 a syndicated summer reading list ran in the Chicago Sun-Times in which 10 of 15 recommended books did not exist; the paper refunded subscribers for that edition and the freelancer lost the client permanently. A running database of court judgments recorded 1,870 cases worldwide by 11 August 2026 in which parties relied on AI-fabricated citations (AI Hallucination Cases database, 2026).

Nobody in any of those cases got into trouble for using AI. They got into trouble for shipping invented facts, and non-disclosure turned a correctable error into a credibility failure. Which is why the controls that matter are unglamorous: verify every claim, name the human who checked it, agree the standard with the client in writing before the work starts, and ask what their own policy is. Best Answer Hub would add one prohibition to that list. Never claim content is AI-free or undetectable. Detection is unreliable in both directions, and a false claim of human authorship is a straightforward deception risk in a way that using the tool never was.

The practical starting point is knowing where AI already sits in the business, including which tools have been given standing access to email, files or accounts. That is the same inventory the Best Answer Hub guide to AI agent security argues for, and it is where the free assessment below begins.

Common questions about AI text watermarking

Sources

• Anthropic, How Claude marks AI-generated content, August 2026 (imperceptible watermark woven into the text; surfaces covered; models launched on or after 2 August 2026; C2PA metadata limited to .svg, .png and .jpg; detection tooling still to come).
• European Commission, Transparency obligations under Article 50 of the AI Act, 2026 (applies from 2 August 2026; provider marking duty; deployer labeling of public-interest text; human review exemption; 15 million euros or 3 percent penalty ceiling; 2 December 2026 grace period).
• Dathathri et al., Scalable watermarking for identifying large language model outputs, Nature 634, October 2024 (SynthID-Text; Tournament sampling; validation across roughly 20 million Gemini responses).
• Kirchenbauer et al., A Watermark for Large Language Models, ICML 2023 (green-list token biasing; detection from as few as 25 tokens; stray-character attacks break the mark).
• Kirchenbauer et al., On the Reliability of Watermarks for Large Language Models, ICLR 2024 (watermarks remain detectable after human paraphrase given roughly 800 words).
• Zhang et al., Watermarks in the Sand, ICML 2024 (proof that strong watermarking is impossible given a quality oracle and a perturbation oracle).
• Tamim and Khan, AI Watermark Evidence Fails Forensic Readiness, arXiv, July 2026 (846 runs; 100 percent removal for KGW and Unigram, 98.3 percent for SynthID-Text, after one paraphrase pass). Tests published schemes, not the Anthropic algorithm.
• Jovanovic, Staab and Vechev, Watermark Stealing in Large Language Models, ICML 2024 (under 50 US dollars to both spoof and scrub state-of-the-art schemes, at an average success rate over 80 percent).
• Liang, Yuksekgonul, Mao, Wu and Zou, GPT detectors are biased against non-native English writers, Patterns, 2023 (61.22 percent mean false-positive rate across seven detectors on 91 TOEFL essays; 19.78 percent flagged unanimously; 5.19 percent on native-written controls; 11.77 percent after vocabulary enrichment).
• OpenAI, Understanding the source of what we see and hear online, 2024 (text watermarking built but not shipped; disproportionate impact on non-native English speakers; vulnerability to translation and rewording).
• OpenAI, New AI classifier for indicating AI-written text, 2023 (26 percent true positive rate, 9 percent false positive rate, withdrawn July 2023 for low accuracy).
• Google DeepMind, SynthID and SynthID text documentation (probability-score adjustment; reduced confidence after thorough rewriting or translation; weaker on factual responses).
• C2PA, Technical Specification 2.4 (embeddable file formats; manifests bound to assets rather than to prose).
• Google Search Central, Spam policies for Google web search (scaled content abuse judged on value, not on production method).
• Damien Charlotin, AI Hallucination Cases database (1,870 recorded court cases involving AI-fabricated citations as of 11 August 2026).

More from Best Answer Hub: the small business AI readiness pillar, the AI policy guide, the AI agent security guide, all free tools, and the Knowledge Center assessments.