The watermark says touched. Your client hears wrote.

Since 2 August, the text coming out of Anthropic’s newest models carries a mark. Not a label and not a disclaimer — a statistical signature woven into the word choices themselves, invisible on the page, readable by anyone holding the key. Google is doing the same inside Gemini. OpenAI and Meta are marking images. The trigger is Article 50 of the EU AI Act, in force that day, which requires AI-generated content to be machine-readable as artificially generated.

Anthropic applied it worldwide rather than only in Europe. Models released from 2 August carry it now, older ones before 2 December. It covers the consumer app, the API, Claude Code, and Claude bought through AWS, Google Cloud and Microsoft Foundry. There is no documented way to switch it off.

Read the intent and it sounds settled. You should be able to tell when a machine made the thing in front of you.

Read what was actually built and it is something narrower. The mark does not record that a machine wrote the text. It records that a machine touched it.

That gap is the whole story. It is also a business decision rather than a technical one, and the date for making it has already gone past.

The watermark says touched

Start with what the thing physically is, because the word “watermark” is doing damage.

When a model writes, it repeatedly picks among words that are all equally fine. Anthropic now makes those coin-flips with a key instead of at random. The result reads identically — Anthropic’s position is that meaning, quality and readability are untouched — but the pattern of choices is no longer arbitrary, and a party with the key can measure it.

Now read the limits, all of which are Anthropic’s own. The mark shows “the likelihood that Claude was involved.” A detection is “not fully conclusive.” It “doesn’t work well on small samples.” It cannot confirm that a human wrote something unaided, and it cannot recognise another company’s model. It survives copying and light editing; a full rewrite removes it.

Then the sentence that matters. Anthropic states that Claude may have processed rather than authored the text — through proofreading, translation, or summarising. All three leave the mark. So does asking a model to tighten a paragraph you wrote yourself.

This is a fingerprint, not a signature. It records that a hand was on the object.

There is one more asymmetry worth naming. Anthropic can read the mark today. You cannot. A public detection tool is promised, with the details still being worked out. Until it exists, the signal on your work is legible to the vendor and to whoever the vendor equips, and not to you or to the person judging you.

Your client hears wrote

None of the above is what the mark will mean in practice, because meaning is set by the reader.

Procurement is already building the machinery. In March, the US General Services Administration floated a contract clause that would have required contractors to disclose every AI tool used in performing the work. Industry pushed back. The June revision narrowed it to systems processing government data, and comments on that version closed on 3 August. But the opening position was total disclosure — and an opening position tells you what the buyer actually wants. Federal language migrates into enterprise contracts. “Did you use AI on this” is on its way to becoming a line in a contract with a remedy attached.

Set a probabilistic signal next to a contractual question and the hedging evaporates. No procurement officer, no client, no university is going to hold “likely involved” and “not fully conclusive” in mind. They will hold a green tick or a red one. Your proposal gets flagged because someone asked a model to fix the commas, and the tool’s own caveat will not travel with the accusation.

Now the part that should decide your view of the policy. The mark only lands on people who used the compliant products. Anyone running an open-weight model on their own hardware controls the sampling directly and emits nothing at all. The signature is a property of the vendor’s runtime, not of machine-written prose.

So the rule marks the paying customer and misses the person with something to hide. A firm that buys Claude through a proper contract is legible. A firm that downloads weights and runs them in a cupboard is not. The transparency regime resolves, in practice, into a register of who followed the rules.

That is not an argument for removing the mark. Provenance is a real problem and a real attempt is better than a slogan. It is an argument against anyone treating an unmarked document as clean.

What to settle this week

This lands on an owner’s desk, not an engineer’s, and it needs no technical knowledge at all. Four questions:

• What leaves the building? Proposals, tenders, reports, legal drafts, published copy. Anything a model touched is starting to carry a record of it. Decide which categories that is acceptable for, before a client decides for you.
• Polishing or drafting? Your people already know the difference. The mark does not. If you want to keep using a model as an editor on client work, say so out loud now, in writing, while it still reads as a policy rather than an excuse.
• What have you already promised? Check live contracts for AI clauses signed when nobody could check them. Those clauses have quietly acquired teeth.
• Who answers the accusation? Someone will eventually be told their document was flagged. Name the person who responds, and write the two sentences they will say, today rather than that afternoon.

The click that protected nothing was an internal control that never held. This is the mirror image — an external signal that really is a mechanism, and still reports something narrower than everyone will read into it.

The regulation asked for honesty about machines. What shipped is a record of contact. Decide what your business lets a machine touch, because the mark is already being made.