On August 11, Anthropic started adding a machine-readable watermark to Claude's text output, everywhere, not just for EU users. It's compliance with Article 50(2) of the EU AI Act, which requires providers of synthetic content to mark it as machine-generated, and Anthropic signed the EU's Voluntary Code of Practice covering exactly this. Search Engine Land covered what that means for publishers and SEO, and the mechanism underneath it is worth understanding on its own, separate from the compliance story.
What the watermark actually is
It isn't hidden characters, invisible metadata, or anything embedded after the fact. A language model generating text doesn't always pick the single most probable next word; it samples from a set of plausible candidates, and that's normally where the model's own randomness lives. The watermark replaces some of that randomness with a bias, guided by a secret key, toward a particular subset of those candidates. Run a statistical test with the key afterward and the pattern shows up. Nothing about how the sentence reads changes, and per the reporting, no measurable hit to output quality.
Why "detectable" isn't the same as "always detectable"
The whole scheme depends on there being real candidates to bias in the first place. That condition doesn't always hold.
Plenty of a generated sentence is low-entropy: a version number, a proper name, a line of syntax with only one correct next character, a quoted phrase copied verbatim. There's no plausible alternative to bias toward in those spans, so there's nothing for the watermark to attach to. A long technical answer is a mix of wide-open phrasing and narrow, constrained spans, and only the first kind carries a signal.
Sampling itself has to be stochastic for the mechanism to apply. Set a model to greedy decoding, always take the single highest-probability token, and there's no distribution left to bias — one legal choice every time, watermark or not.
Editing afterward degrades the signal in proportion to how much the surface text changes: paraphrasing, translation, or running the output through a second model disturbs the exact token sequence the statistical test is looking for, even when the meaning survives intact.
And detection itself is a statistical test, not a lookup. It accumulates confidence across many tokens. A short excerpt, a sentence quoted out of a longer piece, may simply not carry enough of them to cross a meaningful confidence threshold either way.
None of that is Anthropic-specific; it's how this general class of token-bias watermarking behaves; Anthropic hasn't published the exact internals of its version. But the shape of the failure modes tells you something concrete about what the watermark is testing for: enough tokens, enough genuine choice among them, and no downstream mangling. Fewer of those, weaker the signal, whether or not that was anyone's intent.
What the SEO angle actually is
Search Engine Land's read is that this creates a new binary without a way to read it correctly. A detected watermark says "Claude touched this text somewhere" and nothing about how: full generation from a bare prompt reads identically to a paragraph a human wrote and asked Claude to tighten. Whoever's on the other end of that detection, a platform, an editor, a reader, gets a flag with no context attached to it, and human nature reads a flag as a mark against something rather than a neutral fact.
The piece also names the incentive that follows directly from the durability limits above: once people know editing weakens the signal, testing exactly how much editing is needed to clear it becomes its own genre of tinkering, the same shape as every other SEO cat-and-mouse game that's ever existed around a detectable signal. And it flags the global rollout, rather than an EU-only one, as the company reaching further than the regulation it's citing actually required.
Where that leaves a site like this one
These articles get drafted with Claude before I publish them. Whatever this watermark does, it presumably does to that text the same as it would to anything else generated the same way. The house style this site has settled into, calibrated against its own back catalog for voice and phrasing, operates on a completely different axis than a statistical bias in token sampling: one is about how the sentence reads, the other is a signal underneath the sentence that reading it can't see and wasn't trying to hide from. Matching the voice was never a defense against the other thing, because they were never answering the same question.
The more useful takeaway isn't about this site specifically. It's that a watermark which only sometimes fires isn't a broken watermark, it's a probabilistic test doing exactly what a probabilistic test does: strong signal on long, open-ended, unedited generation, and progressively weaker signal the closer the text gets to short, constrained, or reworked. That's a real fact about how these models produce text, independent of whether anyone downstream ever runs the detector at all.