From December, AI text carries an invisible mark. What it reveals and what it doesn't

TL;DR. At the end of October, Anthropic told its API customers that its older Claude models now also write an invisible watermark into their text. The reason is the EU AI Act: by December 2, every provider has to mark its text in a machine-readable way. OpenAI marks ChatGPT in the EU, Google has marked its Gemini app since 2024. You cannot check the mark yourself. We rebuilt the open method that Claude's mark is based on and ran it on 80 German business texts: unchanged, every marked text was detected; after every fourth word was swapped, only about one in three. The mark is a tool for auditors, not proof and not a free pass. Your own duty to label stays with you.

What happened at the end of October

According to an email to API customers, reported by The Decoder on October 31, four more models are getting the watermark: Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6. Models released since August 2, such as Opus 5.5, have written it from day one. It cannot be switched off, not even on AWS, Google Cloud or Microsoft.

The reason is Article 50 of the EU AI Act. Anyone who provides an AI system that generates text, images or sound has had to mark its output in a machine-readable way since August 2. For systems that were already on the market before that, amending Regulation 2026/1744 allows time until December 2. Around 190 organizations signed the European Commission's code of practice on this in July, among them Anthropic, Google, Meta, Microsoft, Mistral and OpenAI.

• Anthropic marks worldwide, with no switch. Files also get a signed provenance note (C2PA).
• OpenAI introduced its method, textGrain, on October 5. It is on for ChatGPT and Codex in the EU, and off in the API worldwide, where customers can turn it on.
• Google has used SynthID Text in the Gemini app since 2024, and the method is open.

How the mark gets into the text

A language model writes word by word. After “The weather was cold and …”, “grey” and “dull” fit equally well, and normally chance decides. With a watermark, a secret key decides, together with the preceding words. The text reads the same, but anyone holding the key can calculate whether the word choice matches it suspiciously often. That is how Anthropic describes it in its explainer from August 14: no hidden characters, no extra cost, no information about users or companies.

This leads to the most important point: only those with the key can check. So far, Anthropic gives access to its detection interface only to authorities, media, researchers and companies that have to verify themselves. OpenAI handles it similarly. Online services that promise to detect Claude text don't have the key and guess from typical phrasing.

The catch

• Short texts carry little. By its own account, OpenAI detects about 94% of marked texts at 400 tokens and about 80% at 200 tokens. For math it is only about 60%, even at 400 tokens.
• Editing erases the mark. If 10% of the words are replaced with synonyms, OpenAI's detection drops to 66%, and at 25% to about 17%.
• A hit proves little. A text that Claude only translated carries the mark as well. Anthropic itself says a detected mark is “not fully conclusive”. No hit proves even less.
• A loophole in two models. According to the email, on Opus 4.6 and Sonnet 4.6 the mark only works if three randomness settings stay at their defaults (temperature, top_p, top_k). Change one of them slightly and the text comes out unmarked. Anthropic advises keeping the defaults if you rely on the mark for your own compliance.

We measured it

Only Anthropic has Claude's key. The method the mark is based on is open, though: SynthID Text by Google DeepMind. On November 1, we rebuilt it on a Mac with a small open model (Qwen 2.5, 1.5 billion parameters). 20 everyday business tasks, each run twice, from product descriptions to customer emails: 40 texts with the mark, 166 words long on average, and 40 without. As with OpenAI, at most one in 100 unmarked texts was allowed to trigger a false alarm.

• Unchanged, all 40 marked texts were detected. None of the 40 unmarked ones triggered.
• Length decides. From the first 50 words we detected 29 of 40 texts, from the first 25 words only 9.
• Every swapped word costs. Replace every tenth word and 37 of 40 stay detectable, every fourth word 14, every second word 3.
• Rewording erases it almost completely. Rewritten without the mark, 2 of 40 remain.

Anthropic uses its own variant with a much larger model, so the exact figures for Claude will differ. The direction is the same at OpenAI and in our test: a long, untouched text gives itself away reliably. Shorten it or have it reworded, and the mark disappears quickly.

What this means for mid-sized companies

The watermark fulfills the provider's duty, not yours. As a company using AI, you are a “deployer” under Article 50(4). Deepfakes, meaning realistic generated images, audio or video, must be disclosed. So must text published “with the purpose of informing the public on matters of public interest”, unless a human has reviewed it and holds editorial responsibility. Going by the wording, product descriptions and customer emails are usually not covered, while press releases and public statements can be. Violations can cost up to €15 million or 3% of annual turnover, and for small and medium-sized enterprises the lower amount applies.

If you offer an AI application yourself, such as a chat on your website, you may be a provider under paragraph 2. Then the model's mark counts toward your own duty, and so do the settings.

And: whether a text was written with Claude or ChatGPT is something authorities and media will be able to check. Where customers have contractually excluded AI, this now belongs on the table.

What you should do now

1. List your tools. Note what your company uses to generate text and whether it marks: Claude always, ChatGPT in the EU, the OpenAI API only if turned on.
2. Check your own applications before December 2. If you build Claude or OpenAI into your own products, clarify whether you are a provider. On Opus 4.6 and Sonnet 4.6, keep the three randomness settings at their defaults or move to newer models. With OpenAI, turn the mark on in the API.
3. Settle your own labeling. For deepfakes and public texts, decide who reviews and who is responsible, and put it in writing. The name under the text counts for more than the mark inside it.
4. Don't let an online detector judge people. Not for job applications, not for suppliers. Without the key these services guess, and even a real hit only shows that AI was involved.
5. Talk openly with customers. Where contracts exclude AI or customers don't expect it, clarify now how you use AI.

The mark makes AI text verifiable, but only for a few and only until someone rewords it. The real question remains: who read the text before it went out? If you want to sort your use of AI along the EU AI Act, we are happy to look at it together.