How AI Watermarking Works at the Token Level, and Why Developers Should Care

On August 11, 2026, Anthropic confirmed that Claude would start embedding machine-readable watermarks into the text it generates. Article 50 of the EU AI Act, which requires providers to make synthetic text, image, audio or video machine-detectable as AI-generated, had taken effect nine days earlier, on August 2.

Text watermarking is not a logo or a metadata tag. It works at the token level, inside the model, during word selection. Nothing is added to the text and no hidden characters are inserted, so the mark stays invisible to readers and undetectable without a matching cryptographic key.

Why the rules arrived now

Article 50(2) applies to providers serving the EU market, with penalties of up to €15 million or 3% of global annual turnover. In July 2026, roughly 190 organizations — including Anthropic, Google, OpenAI, Meta and Microsoft — signed the EU's Code of Practice on transparency of AI-generated content; models on the market before August 2 must comply by December 2, 2026.

Coverage is uneven. SynthID-Text has run inside Gemini since 2024. Anthropic watermarks Claude models launched on or after August 2, 2026, while OpenAI, which marks images and audio with provenance signals like C2PA metadata, has moved more slowly on text; Meta marks images only.

What happens at the token level

A token is not always a full word; it can be a fragment, a punctuation mark or a space. At each step the model builds a probability distribution over candidate next tokens and samples from it with an arbitrary random number generator.

Watermarking changes where the randomness comes from: a secret cryptographic key, combined with the preceding tokens, determines which candidate is selected. The choice still looks random to a reader, but anyone holding the same key can test whether the sequence of choices is statistically consistent with what that key would have produced. Claude's watermark is a version of SynthID-Text, published by Google DeepMind in Nature in October 2024; candidates are scored by pseudorandom functions and compete in rounds, and detection re-runs that scoring.

Does it hurt code and technical writing?

Less than usually assumed. Watermark signal is proportional to how many roughly equally good options exist at a position. Where a genuinely correct next token exists — "2 + 2 =" followed by "4", say — there is nothing to act on, so no signal is applied. Anthropic says code generally carries less watermark signal than prose, and Google's 20-million-response test found no significant difference in user satisfaction.

Tradeoffs remain: detection is weaker on short, highly factual text, and heavy rewriting, paraphrasing or translation can erase the signal. If you call the Claude or Gemini API, some output is watermarked and some is not, while OpenAI text has no confirmed watermark. Pipelines that paraphrase model output should note that this step can weaken the mark, which matters if your compliance obligations depend on it surviving downstream.