The sampler doesn't know you wrote it

The EU AI Act's transparency rules came into force on August 2. Nine days later Anthropic published a help page saying Claude now weaves an imperceptible mark into the text it produces. The API, Claude Code, Cowork, Claude Tag, and the same models served through AWS, Google Cloud and Microsoft Foundry. Worldwide, not only in Europe. There is no setting to turn it off.

The complaints arrived within hours, and the loudest came from two groups a content-provenance rule was never aimed at: lawyers and academics who use Claude to copy-edit prose they wrote themselves, and developers who now have marked code in their repositories. Both are right to be annoyed. What makes it interesting is that the EU asked for neither. The law carves out both cases, and Anthropic marked them anyway.

What the law actually says

Article 50(2) is one sentence of obligation followed by one sentence of escape. Providers of systems generating synthetic audio, image, video or text have to mark the output "in a machine-readable format and detectable as artificially generated or manipulated", using solutions that are "effective, interoperable, robust and reliable as far as this is technically feasible". Then the escape: "This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof."

Around that sit the dates and the teeth. The obligation applies from August 2, 2026, with systems already on the market given until December 2 to fit marking, and until February 2, 2027 to make detection interoperable across providers. Penalties reach 15 million euros or 3% of worldwide turnover. Alongside the Act the Commission published a Code of Practice on Transparency of AI-Generated Content, signed by around 190 organisations including Anthropic, Google, OpenAI, Meta, Microsoft, Mistral and Cohere. Signing it is the cheapest available proof of good faith across all 27 member states.

There is a second obligation that most of the coverage skipped. Article 50(4) binds deployers rather than providers: if you publish AI-generated text to inform the public on matters of public interest, you disclose that. Unless the text went through human review and a named person holds editorial responsibility for it. The law's answer to "who is accountable for AI text in public" is a human editor. The watermark is the machine-readable backup, not the mechanism.

The problem it is aimed at

Text is the hardest modality to mark and the one where the case is weakest. An image is a file, and a file has metadata, so C2PA can sign a provenance manifest that travels with it. Anthropic does exactly that for generated .png, .jpg and .svg output. Text has no container. Paste it into a comment box and everything outside the characters themselves is gone.

So the mark has to live in the characters, and the harms it targets are real: political messaging at volume with no attributable author, review and comment spam that drowns out genuine signal, fabricated quotes and documents, coursework and journal submissions passed off as original, and the slower problem of models training on model output until the distribution eats itself. All of it gets cheaper every year. A durable answer would be worth a great deal.

Why the mark lives in the sampler

Here is the part that explains the backlash. A statistical text watermark does not insert characters. It biases sampling. Split the vocabulary with a secret key, then whenever several next tokens are roughly equally good, lean toward the favoured set. Each individual choice looks natural. Across a few hundred tokens the imbalance becomes measurable to anyone holding the key. Google has shipped a version of this in Gemini since 2024 under the name tournament sampling. Anthropic has not published its algorithm, but the description matches: the signal is in the sequence of words chosen, not in hidden Unicode.

Which means the mark attaches below the prompt. The sampler sees tokens. It cannot see whether the request was "write me a paragraph about X" or "fix the commas in this paragraph I wrote". Both produce tokens the model emitted, so both get marked.

That is why the standard-editing exemption is unimplementable at the layer where the marking happens. To honour it you would have to classify user intent at inference time, decide this particular request counts as assistive editing, and disable the watermark for that turn. It would misfire constantly, and the moment anyone noticed, "you are only proofreading this" becomes a one-line watermark removal prompt. Anthropic's help page concedes the outcome plainly: a detected mark means content was processed by Claude, and people use Claude to proofread, translate and summarise, so the mark can be present when the ideas are entirely human.

Read that carefully and the mark means something far narrower than the public will hear. Presence indicates processing, not authorship. Absence indicates nothing at all, because the mark can be edited or paraphrased away. A test that can neither confirm nor deny is not evidence.

Source code was carved out on purpose

The Commission's final guidelines on Article 50 list what falls outside the marking duty: AI-generated translations, short outputs like alt text and captions, machine-to-machine output, intermediate output inside closed-loop workflows, and source code. Source code, explicitly. The guidelines are not binding, but they are what national market surveillance authorities will enforce against.

Anthropic marks Claude Code output anyway, worldwide. And the irony is that code is close to the worst possible host for this kind of mark. The scheme needs positions where several tokens are about equally good. Prose is full of them. Code mostly is not. Identifiers have to match their declarations, syntax is rigid, and at most positions exactly one token compiles. The carrier shrinks down to local variable names, comment wording, and a few formatting choices.

Those are precisely what a formatter normalises. Running Prettier, Black or gofmt across a file is an accidental attack on a token-level watermark, and a rename pass takes most of whatever survived. Compilation discards comments altogether. Work on watermarking code has been reporting this for years: true-positive rates dropping below half after modest variable renaming, and a measurable trade-off between detection strength and whether the program still does what it should.

So the policy reaches furthest past the law in exactly the place it works least well. Your repository gets a mark that format-on-save removes, while the residual risk, that biased token choice picks a slightly worse identifier or a slightly worse structure, sits with you rather than with the regulator.

The detector nobody has yet

Anthropic has not shipped detection. The help page says the company is working to let users and third parties detect the marks, with technical documentation to follow, and an engineer has said a text detection API is coming. Until it lands, the state of things is that Claude output is marked, only Anthropic can read the marks, and nobody outside can evaluate any claim about how well it works.

The fix creates a worse problem. A detector anyone can query is an oracle. Feed it a candidate, read the verdict, paraphrase, query again, repeat until the verdict flips. At current API prices a paraphrase pass costs pennies, so that loop is affordable to anyone who cares about the outcome. Published evaluations of the main schemes already show a single meaning-preserving paraphrase clearing the mark almost every time, SynthID included. Gate the detector and third parties can verify nothing, which is the transparency the Code of Practice asks for. Open it and you have handed out an evasion tool. There is no version that is both checkable and hard to evade.

What breaks downstream

The failure mode is not the one universities already know. Heuristic detectors like Turnitin guess from style and are notoriously bad at it, with false positive rates on non-native English writing high enough that a string of institutions switched them off. A keyed watermark is a different instrument. It is cryptographic, and its false positive rate really is low.

That is the danger. It will be trusted well past what it actually claims. The honest reading of a positive is "this text passed through Claude at some point". It will be received as "this was written by AI". The lawyer who ran a brief through for comma fixes and the student who generated an entire essay produce the same verdict, and institutions will write policy against the verdict, because it arrives with a cryptographic signature and looks like proof.

The other direction is worse. The watermarking literature is consistent that durability and forgeability trade against each other: a mark robust enough to survive editing is a mark an adversary can learn to plant in text somebody else wrote. Once people treat the mark as proof, a forgeable mark is worse than no mark.

And the burden lands unevenly. The mark reaches people using the hosted, paid, compliant product. Anyone running open weights on their own hardware emits nothing at all, and removal services were advertising within days. The population reliably labelled as AI-assisted is the one that was never the problem.

The angle I would add

Watermarks are radioactive. Train a model on marked text and the token bias transfers into the student model, a result replicated across several schemes including SynthID. That makes a watermark two instruments at once: a public transparency measure, and a private enforcement mechanism. It lets a lab detect when its outputs were distilled into a competitor's model, and lets it filter synthetic text out of its own next pretraining run.

None of that appears in the AI Act. I am not claiming it is the motive. But a company optimising purely for Article 50 compliance would have shipped an EU-only, text-only, generation-only mark and taken the source code carve-out that was sitting right there. Anthropic went the other way on all four counts. Every place the policy exceeds what the law requires, it also happens to serve provenance interests the law never mentions. That is worth saying out loud, because "the EU made us do it" is carrying a lot of weight in the coverage.

The rest of the world is not converging on this either. China's labelling measures, in force since September 2025, require both a visible label and embedded metadata, and name a liable party at every layer of the chain. California's AI Transparency Act, operative the same day as the EU rules, mandates latent disclosure for image, video and audio, and does not cover text at all. OpenAI has had working text watermarking since 2023 and still has not shipped it, citing quality damage in non-English output and how easily paraphrase defeats it. Anthropic is the first large lab to put this into text at scale, which means it also gets to find out what breaks.

Where this leaves you

My read is that the marking is honest compliance work aimed at a genuine problem, implemented at the only layer where it can be implemented, and it inherits that layer's blindness. The sampler cannot tell generation from editing, or prose from code, so the exemptions the lawyers drafted have nowhere to land.

What ships by default is a signal that Claude touched the text. What people will hear is that Claude wrote it. Those are different claims, Anthropic says so on its own help page, and the distance between them now travels with every output the company sells.