How Claude Marks AI-Generated Content?

Anthropic has signed the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content, and it’s now putting that commitment into the models themselves. Claude models launched on or after August 2, 2026 embed a machine-readable mark in what they produce. Text gets an imperceptible watermark woven into the words. Generated files get cryptographically signed provenance metadata.

The part most people miss: this is not an EU-only feature, and it’s not limited to the chat app. It applies to output from supported models across the Claude Platform (API), Claude, Claude Code, Claude Cowork, and Claude Tag, worldwide. If you call the Claude API from your backend, the text you get back carries a mark, and so does everything you forward to your users.

That has real consequences for anyone shipping an API that wraps a model. Below is what the marking actually is, where it applies, what it can and can’t prove, and the concrete checks worth adding to your pipeline. If you’re testing AI-backed endpoints today, Apidog is a good place to put those checks so they run on every build instead of living in someone’s head.

The short version

What Anthropic actually committed to

The Code of Practice on Transparency of AI-Generated Content was published on June 10, 2026 and had roughly 190 signatories by the end of July. The European Commission and the AI Board confirmed it as an adequate voluntary route to demonstrating compliance with Article 50 of the AI Act. Anthropic signed as a provider of both generative AI models and generative AI systems.

Four commitments come out of that, in Anthropic’s own framing:

• New models mark from day one. Claude models launched in the EU on or after August 2, 2026 support machine-readable marking at launch.
• Marking follows you across products. Output from supported models is marked on the API, in Claude, in Claude Code, in Claude Cowork, and in Claude Tag.
• Detection will be supported. Anthropic says it will help users and third parties detect its marks, with technical documentation to follow.
• Older models are in progress. The law allows a transition period for models launched before August 2, 2026, and retrofitting is underway.

The last two matter more than they look. Detection is promised, not shipped. And the fleet is mixed: a model from earlier in 2026 may produce completely unmarked text right next to a new one that marks everything.

Technique one: an invisible watermark inside the text

When a supported Claude model generates text, it weaves a watermark into the text itself. You don’t see it, and it doesn’t change the meaning, quality, or readability of the response. There’s no visible tag, no appended sentence, no hidden Unicode character you can spot in a hex editor with any confidence.

Two properties follow from that design:

It travels. Because the watermark lives in the text rather than in a file wrapper, it survives copy and paste. Move a paragraph from Claude into an email, a CMS field, a pull request description, or a Slack message, and the signal goes with it. That’s the whole point: metadata-based approaches die the moment content leaves its container, and text watermarking doesn’t have that failure mode.

It’s applied at the model level. Not at the product layer, not by a filter in front of the API. That means there’s no header to set, no request parameter to flip, and no enterprise tier that removes it. If you’re building on the API and hoping to strip it for a white-label product, that option doesn’t exist.

The tradeoff is statistical. A watermark embedded in word choice needs enough words to be readable. A three-word response has nowhere to hide a signal, which is why very short passages fall below the detection floor.

Technique two: signed C2PA provenance on files

When Claude generates a supported file type, currently .svg, .png, and .jpg, it attaches signed provenance metadata following the C2PA open standard, the same Content Credentials format used across the industry.

C2PA works differently from a watermark. Instead of hiding a signal in the content, it attaches a cryptographically signed manifest describing where the file came from and what was done to it. Because the manifest is signed, tampering is detectable: if a byte changes and the manifest isn’t re-signed, the signature breaks and any C2PA reader will say so.

That’s a genuinely useful property, and it comes with a genuinely annoying one. C2PA metadata is a container-level attachment, so anything that rewrites the container can drop it. Re-encoding, resizing, format conversion, a screenshot, or an image CDN doing automatic optimization will all happily throw the manifest away. Your own upload pipeline is one of the most likely places for that to happen, which is why testing whether your API strips C2PA metadata is worth doing before you promise anyone provenance guarantees.

If you want to inspect a manifest yourself, c2patool reads them from the command line, and the Content Credentials verification page does it in a browser. The same tooling powers the classifier-plus-manifest approach in building an AI image detector API with C2PA.

Where the marks apply

Coverage is broader than a typical launch feature, so it’s worth reading the boundaries carefully.

Models. Marking ships with models launched on or after August 2, 2026. Anything older is mid-retrofit. In practice, if your app pins a model ID from earlier in the year, you should assume its output is unmarked until Anthropic says otherwise.

Products. Embedded watermarks apply to all generated text across Claude Platform (API), Claude, Claude Code, Claude Cowork, and Claude Tag. Provenance metadata applies where Claude supports processing files.

Cloud partners. Embedded watermarks carry through when supported models are accessed via AWS, Google Cloud, or Microsoft Foundry. Signed provenance metadata may not be, depending on what each platform’s file handling supports. If your compliance story depends on C2PA specifically and you route through Bedrock or Vertex, verify rather than assume.

Regions. Worldwide. The obligation is European, the implementation is global.

What a detected mark actually tells you

This is the section to read twice, because the marketing shorthand (“Claude watermarks its output”) invites a conclusion the technology doesn’t support.

A detected mark says the content may have been processed by Claude. It does not establish authorship, and Anthropic is explicit about that. Two failure modes make it weaker than people expect:

Claude might not be the author. People use Claude to proofread, translate, summarize, and convert files. A human writes 900 words, asks Claude to tighten the prose, and the result carries a mark. The ideas, the reporting, and most of the sentences are human. The mark can’t tell those cases apart from wholesale generation.

Content changes after the fact. Marked output gets edited, excerpted, and blended with other material. A mark found in a document says something touched part of it at some point, not that the document as it stands came out of a model.

What no mark tells you: nothing

The reverse error is worse, because it’s the one that gets used against people. Content genuinely produced by Claude may carry no detectable mark when:

• it came from a model released before marking was supported;
• the text was heavily edited, paraphrased, translated, or mixed into other writing;
• the passage is too short to hold a reliable signal;
• a file’s metadata was stripped by format conversion, re-saving, or a screenshot;
• it came through a platform, feature, or file type where that marking type isn’t supported.

Any workflow that treats “no watermark found” as proof of human authorship is broken by design. That includes academic integrity tooling, hiring screens, and content moderation pipelines. The same asymmetry has already burned people relying on image classifiers, which is the argument in why AI image detection fails.

What this means if you build on Claude

Anthropic’s guidance to developers is short and pointed: if you deploy Claude in your own product, assess independently what Article 50 requires of your products and services. Being a customer of a compliant provider does not make you compliant.

The split matters. Anthropic is the provider and owns the machine-readable marking obligation under Article 50(2). You are usually the deployer, and Article 50(4) puts a separate duty on you around deepfakes and AI-generated text published on matters of public interest. Those are different obligations with different remedies, and the Article 50 breakdown for API developers walks through which one lands on you.

Three practical items for an engineering team:

Know which model IDs are marked. Keep it in the same place you keep your model routing config, and treat “is this model marked?” as a property of the model, not a global yes. Mixed fleets are the normal state right now.

Stop stripping provenance by accident. Any endpoint that accepts, transforms, or re-serves a file is a candidate for silently dropping a C2PA manifest. Resize, thumbnail, transcode, and CDN paths are the usual suspects.

Disclose in your own contract, not just your UI. If your API returns model output to another team’s code, a banner in your web app doesn’t help them. A response field or header does. That’s the argument in adding AI disclosure to your own API.

Turning this into tests you actually run

The compliance conversation tends to stall in a document. The parts that hold up are the ones wired into CI.

A workable set of contract tests for an AI-backed API:

1. Model pinning. Assert the response reports the model ID you expect. A silent upgrade or fallback changes whether output is marked.
2. Disclosure field present. If your schema promises ai_generated: true or an X-AI-Generated header, assert it on every path that returns model output, including error and cached paths.
3. Provenance survives. For any endpoint that returns or re-serves an image, assert the C2PA manifest is still there and still verifies after your pipeline has touched the bytes.
4. Schema conformance. Validate the response against your OpenAPI definition so disclosure fields can’t quietly disappear in a refactor.

All four are ordinary assertions. In Apidog you can express them as response assertions plus a post-response script, save them as a test scenario, and run the scenario from apidog-cli in your pipeline so a regression fails the build instead of surfacing in an audit. The mechanics are the same ones covered in API assertions and automating API tests in GitHub Actions. Download Apidog if you want to build the scenario while reading.

FAQ

Can I disable Claude’s watermark for my product? No. Text watermarking is applied at the model level, so it’s present regardless of which Claude product or surface the text comes from. There’s no API parameter, header, or plan tier that removes it.

Does the watermark change the quality of Claude’s output? Anthropic says it doesn’t change the meaning, quality, or readability of the response. You won’t see it, and neither will your users.

Is there a public tool to check text for Claude’s watermark? Not yet. Anthropic has committed to supporting detection for users and third parties and says technical documentation is coming. Until it lands, treat any third-party “Claude detector” as an unvalidated classifier, not a reader of the official mark. The detail is in how to detect Claude’s watermark.

Do older Claude models watermark their output? Not automatically. The AI Act includes a transition period for models launched before August 2, 2026, and Anthropic is working to add marking to those. Until it ships, assume older model IDs produce unmarked text.

Does this apply if I call Claude through Bedrock or Vertex? Embedded text watermarks do. Signed provenance metadata may not, since it depends on the file-handling features each platform offers.

How is this different from what OpenAI and Google do? Google’s SynthID covers images, audio, video, and text, and the text version has been open-sourced. OpenAI attaches C2PA Content Credentials to generated images and committed in May 2026 to embedding SynthID alongside them, but has not shipped a text watermark. The comparison is laid out in Claude vs ChatGPT vs Gemini watermarking.

The takeaway

Claude’s marking is two things doing two different jobs. The text watermark is durable and travels with the words, but it’s a probabilistic signal that needs enough text to read and can only ever say “maybe Claude touched this.” The C2PA metadata is precise and tamper-evident, but fragile enough that your own image pipeline can destroy it without anyone noticing.

Neither is a plagiarism detector, and neither makes you compliant on its own. What they do give you is a signal you can build on, provided you handle it honestly and test the parts of the chain you control.