Europe Asked for Provenance. Anthropic Built a Detector Only Regulators Can Run

From 3 November 2026 Anthropic embeds an invisible text watermark, based on Google DeepMind’s SynthID-Text, in output from Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6; it adds no characters or tokens, carries no user identifiers, and can only be checked by eligible institutions through a private-preview API.

You cannot see it. You cannot strip it out with find-and-replace. And when it fires, it proves less than almost everyone will assume it proves.

From 3 November, Anthropic embeds a text watermark in output from Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6, with the Amazon Bedrock rollout following a few days later. Claude Opus 5.5 already carried it. Models launched before 2 August 2026 are being brought into line over the coming months. Anthropic frames the whole exercise as compliance with the EU AI Act, and applies it worldwide because it cannot yet scope by region.

What it is not

Start with the misconceptions, because that is where the commentary goes.

It is not a hidden character — no zero-width space, nothing a text editor will surface. It is not a token overhead, and Anthropic says it changes neither quality nor readability. It is not a label or a disclosure. And it is not a receipt: the company states the mark carries no information that could trace text to a user, an organisation or a conversation.

How a secret key hides inside word choice

At every step, a language model picks among plausible next tokens. Many are near-equivalent — “begin” or “start”, “big” or “large”. Some of that choice is randomness. Watermarking replaces part of the randomness with a pattern derived from a secret key and the preceding text.

The prose still reads normally, because every candidate chosen was already a good candidate. What changes is the statistical shape of those choices across a long passage. A detector holding the same key can estimate how unlikely that shape would be without the pattern.

Anthropic is explicit that this is a version of SynthID-Text, published by Google DeepMind in Nature. That paper reported no measurable quality degradation in its evaluations, which is what made the technique practical rather than theoretical.

Who can actually check anything

Here the story narrows sharply, and this is the least discussed decision in the rollout.

Detection runs through an API in private preview, open to eligible organisations: regulators, media outlets, fact-checkers, independent researchers and similar bodies. It is not a consumer tool. You cannot point it at a suspicious email and get an answer.

A traceability system only institutions can operate is not a transparency measure for the public. It is an audit capability for authorities, with the public as subject rather than user.

For files, Anthropic uses a different mechanism entirely: signed C2PA content credentials on supported formats such as PNG, JPG and SVG, verifiable through a free checker.

Where the mark falls apart

Every limitation below is acknowledged by the vendor, and each one is decisive in practice.

Short texts are unreliable — too few choices to build a pattern. Highly factual or constrained text gives the model little room to manoeuvre. Light proofreading leaves almost nothing to find, because the model did not choose the words. And a full rewrite removes the mark.

That last sentence dismantles most enforcement fantasies. Anyone motivated enough to paraphrase can, and anyone who drafted with AI and then rewrote substantially will produce text that reads as unmarked without being untouched.

What the numbers look like

OpenAI’s publicly described testing on its own textGrain system is the most useful benchmark available, not because it describes Anthropic’s model but because it establishes the shape of the decay.

Substitute one word in four with a synonym and detection falls to around 17%. That is a system that works on untouched output and stops working on edited output — which is to say, it works on the exact case nobody is worried about.

And the inference is weak in both directions. A detected mark suggests Claude was involved somewhere: it may have corrected grammar, translated a paragraph, or restructured an outline. A missing mark says nothing at all about human authorship.

The fairness argument users are making

The backlash is not really about accuracy. It is about what the mark implies about people who use these tools properly.

The argument, made publicly and sometimes angrily, runs like this: a hiring manager or an instructor can now hold evidence that Claude touched a document, and conclude the author cheated — when the author used the tool for a grammar pass on their own argument. The tool did the polish. The thinking was theirs. The watermark cannot see the difference, and neither can the person reading the output.

There is a predictable second-order effect. The people most able to rewrite around the mark are the ones with the most skill and the least to hide. The people least able to rewrite carry the suspicion.

What this changes in practice

If you publish, assume anything you ran through an assistant may be flagged as “AI-involved” by an institution holding the key. That is not a moral judgement, but some readers will treat it as evidence.

If you are assessed — coursework, applications, commissioned writing — keep a version history. Process evidence is the only defence a detector cannot argue with, and it costs nothing to preserve.

If you are an editor or marketer, note the twelve-month consequence: the interesting question is no longer whether content was AI-assisted. Almost all of it is. The interesting question is who can demonstrate an authorship workflow.

FAQ

Can I remove the watermark by pasting text elsewhere? No. It lives in word choices, not formatting, so it survives normal copy-paste. A substantial rewrite removes it; a trim and a reword usually will not.

Does it prove a student or applicant used AI? No. It suggests a Claude model was involved at some point, which includes editing, translating and summarising.

Does it identify me? Anthropic says the mark carries no user, organisation or conversation identifiers. Detection estimates whether a pattern is present, not who produced it.

Why can’t the public run a check? Detection is a private-preview API for eligible institutions, because access to the keys is controlled rather than because the capability is limited.

What about images? Files use signed C2PA credentials instead, verifiable through a free checker rather than a keyed detector.