Explained: Invisible watermarks in AI-generated content

Anthropic made a big splash when it announced invisible watermarks for text generated by its Claude models. But if you look more closely, you realize: Other AI vendors are doing the same or are working on similar features. One of the reasons is regulatory pressure: The EU AI Act is one prominent example forcing the companies to make AI-generated content detectable. There are other laws as well.

In this article, I’ll give you an overview of the current state of affairs. You will learn what actually counts as a true watermark, how such features are implemented and where, how to test media files for AI usage and what this all means for your everyday content workflows.

Why now?

Since Aug. 2, 2026, every major AI provider, including Anthropic, Google, OpenAI, Meta, Microsoft and Mistral, has been legally required to mark its AI-generated output under the EU AI Act. Similar laws are in force in California and China as well.

What these laws demand and who is affected differ. But the direction is clear: AI-generated content is supposed to be detectable.

On paper, this is the moment when invisible watermarking should become standard practice. In reality, almost none of it works yet.

No Claude model you can currently select carries a text watermark in its output. Public tools that check whether content was marked barely exist, and where they do, they cover only a narrow slice of what’s actually out there. In short: The legal obligation to mark AI content has arrived well ahead of the ability to detect it.

That has direct implications for your work. If a client, an editor or a reader asks whether a piece was written by AI, the honest answer today is usually: We can’t currently prove it either way, and neither can they.

In this article I’ll show you what’s live right now, what’s still a promise, and what it means for how you edit, disclose and defend your own work. Understanding that starts with an important distinction: There isn’t one thing called “AI watermark.” There are at least three.

Not all “watermarks” are the same

“AI watermark” gets used for three technologies that are distinct in several ways:

In-content watermarks are built into the generated content itself: invisible to a human, but detectable by an algorithm that knows what to look for. This is how Google’s SynthID-Text, SynthID-Image and Meta’s Seal family of tools all work. They nudge pixel values or word choices in a pattern only a matching detector can read. Because the mark lives inside the content itself, it tends to survive routine handling such as a screenshot or a re-save, at least for images and audio. Text is the weak link, for reasons I’ll explain below.

C2PA metadata, marketed to consumers as Content Credentials, works differently: It’s a signed record attached to a file, stating what tool created or edited it and when. It’s the one really open, cross-vendor standard in this space, now also an ISO standard. Its weakness: The record lives in the file’s container, not the content, so it’s gone the moment a file is re-saved, converted or uploaded to a platform that strips it.

Heuristic AI-text detectors are tools like GPTZero, Turnitin and Pangram. These don’t read a watermark. They’re pattern-matching on writing style: sentence rhythm, word choice, the statistical shape of AI-generated prose. That makes them a very different, and less reliable, technology from the two above. It has been shown repeatedly that these AI detectors are not trustworthy.

Claude’s watermarks

One prominent example of an AI vendor introducing watermarks is Anthropic. The company confirmed and explained its plans in August. Important to know here: Nothing is live just yet. It only activates on models launched on or after Aug. 2, 2026. Support for older models is in the works with no date announced just yet.

The mechanism itself is simple to describe. Claude generates text one word at a time, and at many points it has several near-equivalent options to choose from. Instead of picking randomly, the watermark uses a secret key to settle those close calls, leaving a statistical pattern that’s invisible to a reader but readable to anyone holding the key. Read more here about how Claude’s watermark works.

For image, SVG and other files Claude generates, the approach is different: Rather than altering the file itself, Anthropic attaches signed C2PA metadata recording that Claude produced it.

Anthropic says the text watermark has no measurable effect on quality, doesn’t add tokens or cost, and adds negligible latency, citing the same studies Google published for SynthID-Text.

For editors and writers, one detail matters most: The watermark only attaches to words Claude actually generated. Have Claude proofread or lightly edit something you wrote yourself, and the vast majority of the words are still yours, leaving little for the watermark to catch. A full translation, by contrast, is fully watermarked, because every word in it is Claude’s choice.

There’s no way to turn any of this off. It also applies worldwide because Anthropic says it currently has no reliable way to scope watermarking by region.

Everyone else’s watermarks

While Anthropic has gotten most of the attention (and some angry comments), commitment under the EU’s Code of Practice is almost universal: Around 190 organizations had signed by the end of July 2026. What each company has actually shipped is a different story. Notable: images are largely covered, but text almost never is.

• Google / SynthID — the biggest operation of the group. This one label stands for four different mechanisms covering text, image, audio and video. The text library is open source, but the rest is proprietary. Google reported watermarking over 100 billion images and video frames by mid-2026, 10 times what it reported a year earlier.
• OpenAI — shipped for images since May 2026: Every picture out of ChatGPT, the API and Codex carries both a SynthID watermark and a C2PA manifest. Text is the gap: OpenAI has committed to marking text, but hasn’t shipped anything yet.
• Meta — the most open on paper and the least documented in practice. Its research arm publishes an unusually complete open-source watermarking suite for audio, video and images, under mostly permissive licenses. But what actually ships in Meta’s own products is thin: Its Content Seal feature, launched in July 2026, uses proprietary tech that isn’t interoperable with SynthID or C2PA.
• Adobe and Microsoft — neither has adopted an in-content watermark. Both build on C2PA instead. Adobe has the deepest integration of any vendor, embedding Content Credentials by default across Photoshop, Lightroom and Firefly. Microsoft has added it to Copilot, Designer and Bing Image Creator, with M365 documents starting to follow.
• The stragglers — Midjourney has shipped no watermark of any kind, no SynthID, no C2PA credentials, putting it at odds with more than one law at once: the EU AI Act covered above, and California’s SB 942, a parallel law requiring the same kind of machine-readable marking for images, audio and video (though not text), which started enforcing with daily fines on Aug. 2, 2026. Midjourney hasn’t made a public statement about how it plans to comply with either. Stability AI signed the EU Code of Practice but hasn’t shipped a confirmed in-content watermark on its own output.
  

How do you check for watermarks?

Another challenge: Even if invisible watermarks are present, it is not easy for mere mortals to actually look for them. A quick overview:

• Anthropic / Claude — nothing public exists yet. An Anthropic engineer said in mid-August that a self-serve detection API is coming, but gave no date, so even once a qualifying model ships, there’s currently no detector anyone outside Anthropic can run.
• Google / SynthID — a gated portal called SynthID Detector, open by waitlist and prioritized for journalists and researchers. The text-watermarking code is open source, so you can run it yourself, but only for content you watermarked with your own key. In other words: It won’t tell you whether a stranger’s Gemini output is marked and is therefore not very useful.
• OpenAI — a public verification tool at openai.com/verify exists, but it only checks OpenAI’s own images. Because ChatGPT doesn’t have a watermark for text yet, there is no text tool.
• Meta — no hosted portal at all. The Seal tools are open source, so a technically capable person can self-host a detector, but there’s nothing an everyday person can upload a file to.
• C2PA (the cross-vendor layer) — any C2PA-aware tool, such as contentcredentials.org/verify, can read a manifest if it’s still attached. This is the closest thing to a universal check, and its biggest limitation is what section 2 described: The metadata can be gone before you get the file.
  

There is no cross-vendor watermark detector. Each vendor uses its own method and its own private key, so Google’s tool can’t read Anthropic’s mark, and OpenAI’s verifier only recognizes OpenAI’s own output.

What most people fall back on today is a heuristic AI-text detector like GPTZero or Turnitin, the technology section 2 mentioned as a different, much less reliable option.

How trustworthy are watermarks?

But even if a watermark exists and you somehow get the chance to check it, how reliable and trustworthy are the results?

Vendor claims and independent research diverge here, especially for text. Multiple peer-reviewed and preprint studies find SynthID-Text detection breaks down under paraphrasing, back-translation and copy-paste dilution. One ETH Zurich team reported scrubbing success above 90% when combined with specific watermark-stealing techniques. Length matters too: The technique’s own reference paper uses 200 tokens (roughly 150 words) as its baseline test length, and independent testing at 50 tokens found only about a 30% detection rate. Removal tools followed just as fast: A script for stripping Claude’s watermark appeared on GitHub the day after Anthropic’s announcement.

Robustness also varies by format. Compression, resizing and moderate cropping rarely defeat an image watermark. The same handling, or a pass through a second model, routinely defeats a text one.

C2PA metadata sits outside this comparison: It’s stripped by nearly any re-save or upload, in any format, which is why I judged it above to be the weakest layer overall.

None of this makes a “verified” result completely meaningless. But it has clear limits. It shows the model likely touched the content, not who wrote it or how much they changed. A negative result tells you even less, since most watermarking isn’t even shipped yet.

What this means for your workflows

What do you need to do? In short: None of this calls for a policy overhaul, just a few adjustments to what you tell people and how you handle images.

If you maintain genuine editorial review over AI-assisted text before publishing, EU rules generally exempt it from a separate disclosure duty. Document that oversight. It costs nothing and is your cleanest protection.

If you want to know more: I’ve written an in-depth report about the EU’s transparency obligations for AI content. This includes the rules for audio, video and images.

Don’t tell clients or staff that Claude or ChatGPT text is now traceable. It isn’t yet, and there’s no public way to check even where marking does exist.

If provenance matters for images you publish, don’t take the label on faith. Upload a test image through your CMS, your image compressor and your social accounts, then check a tool like contentcredentials.org/verify to see whether the information survived the trip.

And don’t use a watermark hit, or a heuristic detector’s verdict, to accuse anyone of anything. Both are weak, uncorroborated signals, not evidence.

What to watch

As you can probably see by now: This field is new and there’s a lot of movement. Things will keep changing in the coming months. Keep an eye out for these three:

The first is Anthropic actually shipping a model released after Aug. 2, 2026, together with a working way for people outside the company to check its watermark. That’s the point where Claude’s watermark turns from an announcement into something real.

The second is Google opening SynthID Detector to everyone, not just journalists and researchers on a waitlist. That alone would make checking a lot of images and video far more practical than it is today.

The third is a fixed date: By Feb. 2, 2027, EU law requires providers to offer a working way to check their own watermarks. That’s the point where regulation forces the detection gap to close.

If you want to keep up-to-date about these and other developments: Subscribe to the bi-weekly Smart Content Report newsletter.

Just add your best email address here: