If you use Claude, GPT, Gemini or any other generative system to write text, that text may carry an invisible mark that makes it possible to detect that an AI took part in writing it.
Anthropic is going to start watermarking the text its models generate, and the explanation lies in European law. This is the full explanation, with the official guidelines in hand: what it is, who it binds, the exemptions, and how it affects open models.
Anthropic has published how Claude's watermark works: its new models generate text carrying an invisible mark that makes it possible to compute, with the right key, whether Claude took part in the writing. OpenAI has confirmed it will implement something similar. The technique originates outside Anthropic: Scott Aaronson, an engineer at OpenAI, proposed it in 2022, and it was Google DeepMind that turned it into a published method.
Those three companies, along with Meta, Microsoft, Mistral and ~190 more signatories , committed to it in July under the European Code of Practice on AI-generated content .
The reason is Article 50 of the AI Act, which applies from 2 August. And here is the new part: on 20 July 2026 the Commission published 50 pages of guidelines on that article that help answer and understand all of this. We have read them.
We have worked through the whole thing, and this article is the result: what watermarking is, who it actually binds, what falls outside, and what happens when the model is open.
What a text watermark is
When a model generates text, it picks each word from several candidates. Many of those choices do not matter: "the sky was grey" and "the sky was overcast" say the same thing, and normally a random number makes the call.
The watermark changes the source of that randomness: instead of a die, the choice comes from a private key combined with the preceding words. The text stays natural, no hidden character is added, and no reader can tell. But whoever holds the key can analyse a text afterwards and compute statistically whether it is consistent with the choices the model would make with that key.
To use Anthropic's own analogy: it is like playing Monopoly with "dice" that are really the digits of pi. The game is identical; anyone who knows pi can verify afterwards that the game used pi.
Aaronson's proposal (2022) is what Google DeepMind turned into a published, tested method: SynthID-Text, published in Nature (2024), tried on real Gemini traffic without users noticing a difference. Anthropic uses a version of that same approach, and the method is published in the open.
Detecting AI-generated text: the limits of the method
It has limits, and the labs themselves admit them:
- It needs long text. With little text the origin cannot be determined reliably.
- It barely marks factual content: if there is only one correct answer, there is no word choice to make.
- It survives light editing, but dies with a full rewrite. Running the text through another LLM, for instance, wipes the trace.
- It answers one question only: "did this model take part in the writing?". It does not detect other models, and the absence of a mark does not certify that a text is human.
The sources:
- Anthropic's FAQs on watermarking
- Aaronson's blog , where the technical proposal comes from, and the DeepMind paper
Article 50 of the AI Act, the law behind watermarking
Article 50 (2) of the AI Act requires providers of AI systems that generate synthetic content (audio, image, video or text) to do two distinct and inseparable things:
- Mark it: outputs must carry a machine-readable mark.
- Make it detectable: detection means must be available to whoever is exposed to the content. Marking without offering detection does not comply.
The watermark is one technique for point 1 (there are others: metadata, cryptographic provenance methods), and the detection APIs the labs are announcing are for point 2. If it cannot be detected, what would be the point?
The dates that matter:
- The obligation applies from 2 August 2026.
- Generative systems already on the market before that date have until 2 December 2026 for machine-readable marking (the extra window from the Omnibus).
Article 50 penalties sit in the band of up to 15 million euros or 3% of global turnover, enforced by national authorities. National authorities have not settled how they will fine yet, and they are working on it.
And a very important nuance here: the obligation belongs to whoever provides the system, not to whoever develops the model. When you use Anthropic's API, Anthropic is the system provider, which is why it marks your text. We will get to what this means for open models.
Does it affect you as a company? The four doors of Article 50
We use this metaphor of doors because they come straight out of the legal guidelines. So ask yourself these questions if you use AI in your company.
Door 1: does your AI generate synthetic content that people perceive?
If your systems only classify, extract, search, recommend or predict, Article 50 (2) does not affect you: they generate no content. If they generate text, images, audio or video that somebody is going to see, it does.
Door 2: is it generation or is it assistance?
Standard editing is exempt: grammar correction, minor polishing, formatting, and translation and transcription are expressly listed as exempt too.
Summaries and paraphrasing that changes style or structure do require marking, because they transform the content rather than assist it.
Door 3: does the content leave the company?
The guidelines recognise an exception for industrial and B2B applications, but it is narrow and carries three cumulative conditions: the generated output is strictly technical (engineering designs, internal process documentation, technical instructions), it is perceived only by a limited and predefined group of professionals inside the organisation, and it is not intended to leave the company, with safeguards to keep it from doing so.
If your case meets all three, you need to mark nothing. But if the content ends up on your website, in an email to customers or on social media, it does not cover you.
Door 4: I generate it, but I publish it, does it affect me?
Even though the technical marking in Article 50 (2) belongs to the system provider, if your company publishes generated content you have your own transparency obligations as a deployer: label deepfakes, and label generated text that informs the public on matters of public interest (with one important way out: if there is substantive human review and somebody takes editorial responsibility, labelling the text is not mandatory).
And if a chatbot of yours deals with people, they must know it is a machine. These obligations are yours whichever model you use, and the lab's watermark does not meet them for you.
One of the important things this text marking opens up: if you generate your corporate content with closed APIs, that content is now detectable, with the lab's key.
For many companies that will be irrelevant, or they will not care. For the ones that live on text (agencies, media, consultancies, law firms) it is a positioning decision and a possible reputational exposure.
Does it affect you as a developer? Code, agents and Article 50
Here the guidelines come through almost verbatim.
AI-generated code falls outside Article 50
With a generous definition: code in any programming, scripting, markup, query or configuration language, including the natural-language comments that form part of the code.
And expressly excluded: SDKs, SQL, Infrastructure as Code, YAML, JSON configuration, schemas, scripts, APIs and libraries.
If your agent generates code, that output needs no mark. But the natural-language documentation it generates separately does.
AI agent reasoning falls outside
Chain of thought, intermediate steps and non-perceptible actions (a web request, a browser action) are not synthetic content within the scope of Article 50 (2). Only what the agent produces for a person to perceive gets marked.
Agent-to-agent communication falls outside
Machine-to-machine outputs, with no exposure to humans, are excluded.
The AI Act and open source models: what changes with open models
There is a technical side and a legal one. Let us try to summarise both.
Technical fact 1: the watermark lives in the sampler, not in the weights. It is a modification of the sampling algorithm, applied at inference time by whoever runs the engine. In the watermarking approach we are looking at, the mark is introduced during generation, in the sampling and inference layer, and it is not stored in the model weights. Under this approach, Z.ai or Alibaba can neither guarantee nor impose anything about what happens when you run their model on your GPU.
Legal fact: open source does not exempt you from Article 50. Article 2 (12) exempts freely licensed systems from the regulation EXCEPT in three cases, and Article 50 is one of them, cited expressly. Providers and deployers of open source systems within the scope of Article 50 have to comply all the same. A model being open does not by itself determine who the system provider is, nor does it remove the transparency obligations of the system you build on top of it.
Technical fact 2: marking can sit in the inference layer. Marking may be implemented "embedded in the inference process of the system", and the system provider may rely on the marking solution of "a third party providing it, for example as an open standard or as a specialised service". The verb MAY matters here, because offering marking is not an obligation of inference providers; it is an obligation of the AI system provider.
At Helmcode we are going to work on offering an optional marking solution for companies using our inference.
The consequence is quite asymmetric, and it can amount to a competitive advantage:
- With a closed model, the mark belongs to the lab. Its key, applied globally (Anthropic marks worldwide traffic because it cannot scope by region: a European rule ends up marking the text of a user in Kansas), with no option to remove it where you do not need it, and no way for you to use it for anything, because the key is not yours.
- With an open model, the mark is yours. You decide it, or your platform does, with your key, exactly where your real obligation demands it after walking through the four doors above. And your own key brings advantages: nobody outside scans your content without your permission, and you gain traceability over your own output.
The method is published as well (SynthID-Text is open source, detection included), so watermarking an open model is today an engineering decision in the serving layer.
Labelling AI-generated content: what to do, in five steps
- Walk the four doors for every system that generates content. Most real workloads (classification, extraction, code, internal agents) fall at the first or the second and carry no marking obligation.
- Keep marking separate from your labels. Article 50 (2), which is technical and belongs to the system provider, and your deployer obligations (disclosing the chatbot, labelling deepfakes and published text of public interest) are different things. The second set is always yours. This AI Act checklist has them by profile so you can see where you stand.
- If you use closed APIs, decide consciously what corporate content you generate there knowing it is detectable with the lab's key, and ask your provider for its detection API.
- If you build on open models, marking is your own decision in the serving layer, and there is a deadline: 2 December 2026 for systems that predate 2 August.
- Document the decision, whatever it is. "We assessed Article 50 (2): our output is code and agent-to-agent communication, outside the scope per points 63 and 68 of the guidelines; reviewed on [date]." Put it in your evidence folder along with everything else you need.
If you want to understand the rest of the AI Act obligations, there is our earlier article on the AI Act , and the detail of each obligation by profile in the checklist we have ready for you.
