No American Voted for Claude's Watermark. It Shipped Here Anyway.

On August 11 the news went around that Claude now hides a watermark in the text it writes. People got angry before they finished reading the details. Anthropic's own support article is three screens long and pretty dry. The replies were loud.

I wanted to name what I was actually mad about before I joined in.

Credit, stigma, disclosure, the feeling of being tagged — none of those held up once I looked at what actually shipped. The part I couldn't drop was the path it took to get to my desk.

What Anthropic's watermark actually does

There are two systems, depending on what Claude is making.

For text, Anthropic embeds what it calls an imperceptible watermark "directly into the text itself." They say it doesn't change how the writing reads or what it means. Because the mark lives in the words, it survives copy-paste and "may persist through some editing." For files — .svg, .png, .jpg — Claude attaches signed provenance metadata using the C2PA standard. That's the same approach camera and imaging companies already use.

Coverage is broad. Models launched on or after August 2, 2026 support marking at launch. Older models are listed as in progress. It covers the Claude Platform API, Claude, Claude Code, Claude Cowork, and Claude Tag. It applies wherever Claude is offered, worldwide. And it runs at the model level, which is the part that matters if you build on this stuff. No settings toggle. No API header. The thing that picks the next word is doing the marking.

The docs don't describe an opt-out, and the design doesn't leave room for one. You can try to strip a mark later. There is no way to ask the model to skip making it.

Can the Claude watermark be removed?

For files, yes, and it's easy. C2PA metadata strippers have been on GitHub for years. C2PA was built as a paper trail for people who want one. Anyone who doesn't can peel it off.

For text, nobody outside Anthropic knows. They haven't published the scheme. They say they'll help third parties detect the marks once the technical docs come out. Until then there's no public detector. So if someone says "this text is watermarked," you currently have no way to check that claim, either way. TechCrunch asked how much editing it takes to remove and got no answer. Anthropic's own caveats do the rest: a detected mark means content may have been processed by Claude, and a missing mark proves nothing about whether a human wrote it.

People are fighting about credit and stigma over a signal nobody can currently read. Motivated people can probably beat it. The vendor already warns you not to treat it as proof of authorship. A student who wants to cheat will paraphrase. A content farm will run the output through a second model. The mark lands hardest on people who weren't hiding anything.

Set that fight aside and a bigger problem is still sitting there.

Did the EU AI Act require this worldwide?

No. That's the part I keep coming back to.

Article 50 transparency rules took effect on August 2, 2026. Penalties can hit €15 million or 3% of global turnover. The Code of Practice on marking and labelling AI-generated content is the voluntary playbook that helps a provider show they're in line. Anthropic signed it. All of that is normal if you want to sell into a market. I have no problem with a country setting terms for its own market.

Then Anthropic turned the marking on everywhere.

The legal obligation ended at the EU border. Running two versions of a model costs more than running one, and the marking sits at the model layer — the layer where a split is most expensive to keep and easiest to get wrong. Faced with that math, a rational company builds it once and ships it globally.

Brussels wrote a rule for Europe. Anthropic exported it. You could stop there and call it a private product decision. That reading lets everyone off the hook.

I don't buy it. The EU wrote the rule against how the product itself behaves. They could have required a disclosure to European users and left the model alone. Once you regulate the core of the product, the cheap path is to comply once and ship that version everywhere. That spillover has a name — the Brussels Effect — and we've seen it before. Vehicle emissions. Chemical restrictions. The cookie banner you click through fifteen times a day. This is one of the cleanest cases of it hitting a software product in years, and it hit the part of the product that chooses the next word.

Why one jurisdiction sets everyone's default

So a tool that American engineers, lawyers, and researchers use every day now behaves the way a body no American votes for wanted it to. There was no comment period I could file in. No representative to call. No ballot line. The EU's own consultation was open to EU stakeholders. That's how their process works. It doesn't help if you live in Virginia and your contract-review workflow just changed.

The obvious pushback: Anthropic is a private company. They can ship whatever they want. If you don't like it, leave. That's true. It also stops being a great answer the moment you notice how few places there are to go, and how fast the same rule reaches them. Compliance defaults spread across a market faster than alternatives show up in it.

My own government does this to me too. A Commerce directive switched Fable off for every customer on June 12, mid-quarter, and I lost a model I was in the middle of evaluating. The order was aimed at the vendor and still landed on me. Europe is just the sharpest case right now, because the rule crossed a border to get here. A body accountable to someone else changed a property of the tool my work runs on, and the first I heard of it was a support article.

People got loud about the watermark. The way it shipped got a news cycle and a shrug. That second part is the one that will get used again.

Does watermarking degrade legal and scientific writing?

This is where the policy hits a desk. A Brussels disclosure rule can change a word in an American contract faster than it looks.

Anthropic hasn't published its scheme, so this next part is about how text watermarking has to work. I don't have their private implementation. Every published approach — green-list biasing, Gumbel sampling, the tournament sampling behind Google's SynthID-Text — hides the signal the same way. When a model writes, it picks the next word from a list of likely options. Sometimes one word is the obvious winner. Sometimes a few words would all work. Watermarks live in those close calls. The model slightly prefers one option so a detector can later spot the pattern. If one word is clearly the only right choice, the scheme skips that spot. Changing it would make the sentence look broken.

That gives you a simple test. The watermark only moves when the model is unsure. Your risk depends on whether your field can tolerate that kind of swap. When those two don't line up, you eat the difference.

Usually they do line up. Code, surprisingly, comes out fine. The uncertain spots tend to be variable names, error-string wording, the order of two independent statements — stuff that doesn't change what the program does. The spots where a swap would break everything are already locked in by context.

Legal prose is where they come apart. Legal drafting uses ordinary English words as terms of art.

I use AI to help me redline contracts and agreements, and sometimes just to understand what a clause is doing before I respond. It's genuinely good at that. But a switch from "shall" to "will" is a real change in legal meaning — obligation versus something that happens later. Courts have spent a lot of time on that difference. To a language model, in most sentences, those two words look almost interchangeable and both sound fine. High uncertainty by every measure the sampler has, sitting on a distinction with zero room for error. So I watch for exactly that kind of swap.

The same pattern shows up across the words that carry the legal load. "Best efforts" versus "reasonable efforts." "Including" versus "including without limitation." "And" versus "or" in a list of conditions. Scientific and clinical writing has the same shape — "associated with" versus "causes," a conjunction in a trial protocol's inclusion criteria that decides who enrolls. We build clinical-trials software at Zenpo, and protocol language is the last artifact I'd take from a first pass.

Here's the chain: a European transparency rule, a change in how the model picks words, a nudge at an uncertain token, a word in a contract that means something different than the one it replaced. Four steps. No border anyone had to approve. And nobody who wrote step one has any idea step four exists.

The size of the effect is small. I still wouldn't ignore it. What you do about it is the discipline you should already have: the model assists, a person authors, and skipping the verification layer is the failure that keeps showing up under new names. Diff generated language against your own template for every clause that carries real legal weight. Never let a model write obligation language it won't be asked to defend.

Why this pushes buyers toward open weights

Every constraint you can't turn off, baked into the model, is a gift to the competitors that impose nothing.

Kimi, DeepSeek, and GLM were already getting evaluation attention on price and capability, and the gap keeps closing in months rather than years. Now there's a line on the comparison table the closed labs can't match: you can read the sampler, and no compliance rule reaches through the weights to change it. For a general chat workload that's a curiosity. For a firm doing contract work or regulatory submissions, "we control how tokens get picked" will show up in a procurement document within the year.

A transparency rule written to make AI output more accountable may send precision work toward models running outside every lab the policy was written to govern. That would move more enterprise weight to open models than a decade of open-source pitching managed, and nobody planned it that way.

I'm not saying dump Claude tomorrow. I've been encouraging people not to get married to a model or an AI platform. Keep your options open, because options are cheap. That's the same product-led argument: pick the tool for the problem, and don't fuse the work to one vendor's stack. Governance just handed you a second reason to want it.

Does the EU AI Act apply to US companies?

Article 50 binds providers placing AI systems on the EU market. It doesn't govern US-only deployments. When a provider implements compliance at the model level, though, the resulting behavior ships globally. That's what happened here.

Can you turn off Claude's watermark?

No documented opt-out exists. Marking is applied at the model level across Claude products worldwide, including the API, so it isn't a per-request or per-account setting.

Is there a tool to detect Claude's watermark?

Not publicly, as of August 2026. Anthropic has committed to publishing technical documentation supporting third-party detection. Until it ships, neither the presence nor the absence of a mark can be verified outside Anthropic.

Should lawyers stop using AI for contract drafting?

No, but treat operative language as author-only work. Diff every generated clause against your own template and read specifically for term-of-art substitutions like "shall" to "will" or "best" to "reasonable" efforts.

A watermark shipped this month that nobody can currently read, that motivated people can probably strip, and that comes with a vendor disclaimer against the conclusion everyone is arguing about. At the same time, a property of American software got set by a body no American votes for, worldwide, because compliance is cheaper when you only build it once.

The mark will get a detector eventually, and the credit argument will sort itself out. The precedent is already in production. The next rule that travels this way won't be about watermarks.