Skip to content
BC Consulting

BlogClinical Research posts

Claude Now Watermarks Everything It Writes

By Bryan Clayton7 min read

Originally published on LinkedIn.

  • ai
  • claude
  • governance
  • eu-ai-act

Anthropic has confirmed that Claude models launched on or after August 2, 2026 weave an invisible, machine-readable watermark directly into the text they generate, and attach signed provenance metadata to the files they produce. The marking is applied at the model level, so it applies everywhere Claude is offered: the API, the chat app, Claude Code, Claude Cowork, and Claude Tag. It carries through when supported models are accessed on AWS, Google Cloud, or Microsoft Foundry, and it applies worldwide, not just in Europe. If someone on your team drafted a site memo in Claude yesterday and pasted it into Outlook, the mark probably went with it. Older Claude models are not marked yet, and Anthropic says it is working to add support for models released before that date.

Why is this even a thing?

The root cause is regulatory. Anthropic signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content, the voluntary instrument the European Commission and the AI Board have assessed as adequate for demonstrating compliance with Article 50. Article 50(2) requires providers of generative AI systems to mark synthetic audio, image, video, and text output in a machine-readable format so it is detectable as artificially generated. Signing the Code gives a provider a defensible, predictable way to show it has met the obligation regardless of geography or oversight body. That part is drawing some pushback from the AI user community.

The decision to roll this out is Anthropic's own, since the obligation itself is European for now. The implementation is global, because maintaining one marked model for Europe and one unmarked model for everyone else is a worse engineering and compliance position than simply marking everything. If you work for a sponsor or a vendor outside the EU, keep an eye on this, because it is how most of the AI Act's transparency requirements are likely to reach US clinical operations. Not through direct enforcement, but through vendors standardizing on the strictest requirement anywhere in their footprint. It is the same way EU privacy language ended up in US vendor contracts years after GDPR, long before any US regulator asked for it.

How a watermark hides inside ordinary text

If you have taken any of our AI courses, you have heard me describe how these models actually write. A Large Language Model does not "know facts," and it does not retrieve a sentence from a database. It predicts text one small piece at a time, calculating a ranked list of plausible next words, or tokens, along with their probabilities, and then selecting from the top of that list. Words are coordinates in a very large space, and the model is doing probability math on which coordinates sit closest to where it already is. The whole reason prompt quality matters so much is that your prompt sets the starting coordinates for that prediction. It gives the model its background context.

The watermark lives inside that selection step. At most positions in a sentence, several candidate tokens are close enough in probability that any of them would read naturally. Take the sentence "the site reported a protocol ___." The next word would most likely be "deviation," although "violation," or "issue," would be acceptable to most human readers. A watermarking scheme uses a secret key to bias the choice toward a specific subset of those acceptable candidates, and the subset shifts with every token. Think of it like a weighted coin flip at each fork in the sentence, where the key decides which way the coin leans. One flip tells you nothing, and to a human reader the choice looks random. Across a few hundred flips, the pattern becomes statistically obvious to a machine holding the key. That is why the mark survives copy and paste. There is no hidden character, no metadata field, no altered font to strip, and no tiny white pixel. The mark is the word choice itself, or more accurately the mathematical pattern behind the word choice.

Anthropic has not yet published its technical specification, so treat the description above as the mechanism established in the published research, not a confirmed account of Anthropic's own implementation. Detection tooling documentation is coming, but it is not available yet. In fact, as I write this, there is no public tool that reads this mark. The only party who can is Anthropic.

Files are handled differently. They carry signed C2PA provenance metadata on supported file types such as .svg, .png, and .jpg. That metadata is conventional, and it can be stripped by a screenshot or a format conversion.

What a detected mark actually does

An AI watermark does not do much in practice, at least not to the human reader. A detected mark tells you the content was probably processed by Claude. It does not tell you Claude wrote it. Proofreading a paragraph you wrote, translating a German adverse-event term into English, summarizing your own meeting notes, or reformatting a table all produce marked output that is built entirely from your ideas. The words came from Claude; the substance came from you. Someone who treats a positive detection as proof of ghostwriting has misunderstood what the mark is, and may also be reading a false positive.

The reverse is weaker still. An absent mark really doesn't prove anything either. Text from an older model carries no mark, heavy editing or paraphrasing degrades the signal, short passages do not contain enough tokens for reliable detection, and any output produced through an unsupported surface is unmarked. As a test for "was this AI-written," the watermark produces confident false negatives in exactly the cases where someone was actively trying to hide it. The person doing sloppy, disclosed AI work gets flagged; the person deliberately laundering their generated text doesn't.

What clinical teams should do

The short answer is that you do not need to do anything urgently, but two things will be worth doing soon.

First, assume the mark is present on anything Claude touched, and write your AI use policy on that basis. This is a strong argument for a policy that permits disclosed AI assistance rather than one that pretends it is not happening. A deviation narrative that Claude helped structure is not a compliance problem when your SOP says AI assistance is permitted with human review and documented approval. It becomes an awkward problem only when your policy says AI is not used and a detection tool suggests otherwise. Most of the organizations I talk to are already running well ahead of their written policies here, and this is a reasonable moment to close that gap.

Second, if your team uses Claude on protocol documents, site correspondence, regulatory submissions, or anything a journal or health authority will eventually read, ask two questions of your vendors and your own IT: which model versions are in use, and what happens to marked text as it moves through your document workflow. Sponsors with EU operations should also expect the Article 50 marking and labeling obligations to arrive contractually, through vendor agreements and quality documents, before anyone audits them directly.

None of this changes what AI is good for in clinical trials. Language work, summarization, deviation narratives, and site communication are still where these tools earn their keep. Mathematical calculation is still not one of them. Yes, there are tools that bolt a calculator onto the model, but the LLM by itself is not computing anything. Ask it "what is two plus two" and it is not adding; it is predicting that the most probable next token after that question is "four," the same way it predicts "deviation" after "protocol." It is right about arithmetic for the same reason it is fluent about everything else, which is that the pattern is overwhelming in its training data. If you push it somewhere the pattern is thin, the guessing starts to show.

What changed with this LLM watermarking is subtle, and you likely would not have noticed it if you had not read this far into the article. I can't help but recall in J.K. Rowling's Harry Potter and the Half-Blood Prince, Dumbledore takes Harry into a seaside cave to hunt a Horcrux, runs his hands over the rock, and senses concealed magic. Harry asks how he can tell. "Magic always leaves traces," Dumbledore answers, "sometimes very distinctive traces. I taught Tom Riddle. I know his style." That is essentially what Anthropic has built. The model now signs its own work in a pattern only the teacher can read. So it turns out that AI, like magic, always leaves traces.

Sources

Working on something like this?

We run AI Bootcamps and build custom tools for sponsors and service providers in clinical research. A short call is the fastest way to find out whether your problem fits.

Talk About Your TeamBrowse the Catalogue