Claude Adds Text Watermarks: Which Models, and Why Now

On November 3, 2026, Anthropic's release notes recorded that text generated by Claude Mythos 5, Claude Opus 4.7 and Claude Sonnet 4.6 now carries Anthropic's text watermark on the platforms listed in its help centre. On September 1, at their launch, the same notes had recorded the mark on Claude Fable 5.1 and Mythos 5.1. With the new entries, sixteen Claude models watermark their output on first-party surfaces, and the cloud rollout for the three newest additions completes on Amazon Bedrock by November 10.

A text watermark is a statistical pattern in word choice that a holder of the right key can test for. It is not a visible label, a hidden character or metadata. For a reader it changes nothing. For a publisher, an agency or a marketing team that drafts with Claude, it raises three questions this post answers from Anthropic's own pages: which models and platforms are affected, who can detect the mark and under what conditions, and what, if anything, it changes about the obligation to disclose AI involvement.

Every claim below comes from five Anthropic documents read on November 5, 2026: the release notes, the text-watermark developer documentation, the help-centre article on how Claude marks AI-generated content, and the August 14 news post explaining the method, updated September 1 for the detection API. Where those pages are silent, so is this post.

The release-notes entry is short. Text generated by Claude Mythos 5, Claude Opus 4.7 and Claude Sonnet 4.6 carries Anthropic's text watermark on the platforms listed in the help-centre article. One caveat is attached to Sonnet 4.6: text generated for a request that sets temperature, top_p or top_k to a non-default value might not carry it. The developer documentation turns that caveat into advice: if you rely on the watermark on Sonnet 4.6, omit all three parameters, including any a framework or client library sets for you.

The September 1 launch entry had covered Fable 5.1 and Mythos 5.1, and added that supported image, video and audio files produced through the code execution tool carry C2PA Content Credentials when retrieved through the Files API. That entry and the developer documentation state that marking requires no changes to requests or response handling. There is no parameter to set and nothing new in the response.

Why the three November models matter: they are older releases. Anthropic's explainer says EU law gives a transition period for models launched before August 2, 2026 and that it is working to add watermarking for them, and the help centre now says Anthropic is adding watermarks to outputs from models released before that date. November 3 is that backfill reaching the previous generation, which is the generation many production systems still run. A team that assumed the watermark applied only to new flagships now has it on the models in their existing pipelines.

The failure case is in the caveat. A marketing stack that calls Sonnet 4.6 through a library with a default temperature of its own may be producing unmarked text while the team believes otherwise. That matters only if you intend to rely on the mark, but if you do, the fix is in your client configuration, not in Anthropic's.

Anthropic's August 14, 2026 explainer describes the method as a version of the SynthID-Text approach that Google DeepMind published in Nature in 2024. When a language model writes, it repeatedly chooses among several words that would each fit. Ordinarily that choice uses a random number generator. With the watermark, the choice is steered by a secret key combined with the preceding words. The text reads the same, but across enough words the choices form a pattern that a holder of the key can test for and nobody else can see.

Three consequences follow, each stated on Anthropic's pages. The mark adds no tokens or hidden characters, so the output is the same length and the same price. It carries no information about the user or the organisation; it can indicate that Claude was likely involved, not who asked. And it has, in Anthropic's words, "negligible impact on the speed of models". Anthropic also reports that in internal testing it saw no impact on the content, creativity or readability of Claude's text; that is a vendor statement about a vendor test, and no third-party evaluation is cited.

An example makes the limit concrete. A model asked for a product's launch date has one correct answer and no near-equivalent words to choose among, so a factual sentence carries little or no mark. A model asked to write three paragraphs of campaign copy makes hundreds of free choices, and the mark accumulates. The same mechanism explains why code, which is mostly constrained, is described by Anthropic as carrying less watermarking.

The help-centre article carries the authoritative table. The first-party column covers Anthropic's own surfaces. The cloud column covers Amazon Web Services, Google Cloud and Microsoft Foundry together, as the table does. Three models carry an asterisk: rollout on Amazon Bedrock completes by November 10, 2026.

Two readings of that table are wrong and worth heading off. An empty cloud cell for Opus 4.6, Opus 4.5, Sonnet 4.5 and Haiku 4.5 means the help centre does not tick it; it does not say those models will never be marked on cloud platforms. And the table is about where the mark is applied, not about what you can do with it; no row implies you can detect the mark yourself.

Anthropic is unusually specific about the limits, and the developer documentation and the explainer between them give a working list. The mark is sparse on factual passages and on code. It is weak on short samples, because the statistical test needs enough free word choices to reach confidence. Light editing probably does not remove it completely; a complete rewrite in which every word is replaced does. Translations carry it. Proofreading of human text may carry too little to detect, because most of the words were not Claude's choices.

The most consequential limit is one of meaning rather than strength. The detector cannot distinguish "Claude wrote this" from "Claude heavily edited this". A human draft that went through a substantial Claude edit may test positive; a Claude draft that a human rewrote line by line may test negative. For any organisation thinking of using detection results as evidence of authorship, in either direction, that is the sentence to keep.

The example that follows for a content team: a short social post drafted by Claude gives the detector far fewer word choices than a long article drafted by Claude and lightly edited by a human. Anthropic says detection does not work well on small samples and that confidence rises with length, but it publishes no word-count threshold. The failure case is the opposite assumption, where a team believes an edit pass "cleans" the text. Anthropic says light edits do not.

Detection needs the key, and Anthropic holds the key. The explainer, updated on September 1, 2026, states that a detection API is in private preview, available to eligible organisations as required under EU law, listing regulators, law enforcement, media, fact-checkers, independent researchers, educational organisations and EU civil society groups, and also to enterprises that are similarly obligated to verify watermarking for their own compliance with the Act. Access is by a request form linked from the help centre.

That leaves most Claude customers, and every ordinary reader, unable to test a piece of text. The free Claude Content Checker that Anthropic offers covers C2PA Content Credentials on files, not the text watermark. Our guide to running an open-source C2PA validator covers that separate, file-based system; the two should not be confused.

Anthropic also answers the ownership question directly. Asked whether the watermark affects ownership or liability for content, the explainer's answer is no: a watermark only helps test whether Claude might have produced or processed the content. It is a provenance signal, not a claim.

The stated reason is regulatory. Anthropic writes that it, along with several other major AI providers, is implementing watermarking to comply with the EU AI Act, and that it signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026, a code it describes as having around 190 signatories. The help centre names the relevant provision as the Article 50(2) code of practice, which concerns machine-readable marking by providers of generative systems.

The decision that affects non-EU customers is scope. Anthropic says it is applying watermarking globally at launch because it does not yet have a durable way to scope it by region. A US publisher drafting for a US audience therefore gets the same marked text as an EU one. The explainer frames this as a current limitation rather than a permanent policy, but no timeline for regional scoping is given.

An example of why region scoping is hard, in plain terms: the mark is applied as the words are chosen, inside generation, and the same request can be served from infrastructure in several places to a customer whose end readers are anywhere. Scoping by region would mean deciding, per request, which law applies to the eventual reader. The failure case for a customer is to treat the global rollout as a sign that Anthropic considers the mark required of them; the pages say it is Anthropic's obligation as a provider. Our checklist of what the EU AI Act's transparency rules require from August 2026 sets out the provider and deployer sides separately.

Start with what the pages do not say. Nowhere do they state that the watermark satisfies, replaces or triggers a disclosure duty for the organisation that publishes the text. The mark is described as Anthropic's compliance step as a provider. Whether a publisher, advertiser or agency must label AI-assisted content is governed by the platform rules and laws that apply to them, which these pages do not address. We keep that distinction strict here and point to our reference on platform labelling rules for advertisers for the platform side.

What does change is the evidential landscape. Text your team drafted with any of sixteen Claude models now carries a signal that an eligible organisation, including a regulator or a newsroom's fact-checking desk, can test for. If your disclosure practice has been to say nothing and rely on nobody being able to tell, that assumption has weakened for a defined set of parties. If your practice has been to disclose where required and keep a record of how content was produced, nothing about that practice needs to change.

Second, the mark is in the words, so it travels with them. Copy drafted by Claude, pasted into a CMS, syndicated and translated keeps the mark unless it is rewritten. For a team running content through several tools, the question "which model touched this" now has a partial technical answer that someone else may hold. A production log that records the model and the degree of human editing per piece is the cheapest way to be able to answer the question yourself, and it is what our content engine engagements build in from the first week.

Third, the detector's blind spot cuts both ways. Because it cannot tell writing from heavy editing, a positive result on a piece a human wrote and Claude polished is possible, and a negative result on a Claude draft a human rewrote is possible. Neither result is proof of authorship. A team should neither fear the first nor rely on the second.

None of these steps is urgent in the way a breaking API change is urgent. All of them are cheap, and the first two close gaps that the November 3 entry opened.