A Claude Watermark Can’t Prove a Student Cheated

I was scrolling TikTok when a video came up about Anthropic putting invisible watermarks in Claude’s text. The narrator was using the voice anyone who spends time on the app knows, the BREAKING NEWS delivery that turns a help-center update into a five-alarm fire.

The claim was that Claude now embeds a mark in everything it writes, and that a teacher will be able to run a submitted assignment and see it. Underneath, in the comments, people were trading ways around it.

Nobody in the video mentioned Article 50 of the EU AI Act, which is the reason the mark exists. Nobody mentioned that the mark can’t answer the question the video was asking of it.

Anthropic’s own help page is candid about this. “A detected mark provides a signal that content was processed by Claude, but is not fully conclusive,” it says. A detected mark doesn’t mean Claude wrote the content, because people use Claude to proofread, translate, summarize, and convert files. Because the mark is part of the text, Anthropic says it travels with copied text and may survive some editing. Heavy rewriting, paraphrasing, or translation can make it undetectable, and a short passage may not carry enough text for a reliable signal.

So a detected mark can show that Claude processed some text. It can’t show that Claude came up with the argument, that a student broke a rule, or that the final draft wasn’t rewritten line by line. A missing mark shows less than that.

Most teachers can’t check for the mark at all. Anthropic’s detector is in private preview, open to groups that qualify under EU law, such as regulators, researchers, and educational organizations, and to companies that need it for their own compliance.

Article 50 began to apply on Aug. 2, 2026. It gives different duties to two kinds of actor, and most of the coverage I saw folded two of those duties into one.

The first belongs to the provider, the company that builds the model. Providers of systems that generate synthetic content have to mark what they produce in a machine-readable way. That is what Anthropic announced, a watermark the company says is woven into the text as the model generates it, and signed provenance data, called Content Credentials, on supported files such as .png and .jpg. Anthropic says the marking applies worldwide, across the API, Claude Code, Claude Cowork, and Claude Tag. It signed the European Commission’s Code of Practice on Transparency of AI-Generated Content, and its models launched on or after Aug. 2 support marking from the start.

Older systems get a little more time, though less than the headlines suggested. The Digital Omnibus, Regulation (EU) 2026/1744, took effect July 27 and didn’t move the Aug. 2 date for Article 50. It added a four-month transition, to Dec. 2, 2026, for the marking duty, and only for generative systems already on the EU market before Aug. 2.

The second duty belongs to whoever publishes. Deployers who put out AI-generated or manipulated text to inform the public on matters of public interest have to disclose that it was artificially generated, unless the text went through human review or editorial control and a person or organization holds editorial responsibility for it.

That exception is narrower than it sounds, and the Commission’s guidance says so. Human review means people with relevant knowledge and professional judgment deliberately examining the substance. Editorial control means an editor with the authority to approve, change, or reject the text on substantive grounds, including fact-checking and vouching for sources. Spell-checking and grammar fixes count as neither. Editorial responsibility is a separate test, which requires a person or organization to hold legal responsibility for what’s published.

That is what undoes the assumption behind the TikTok video. Article 50 treats the two duties separately. Providers embed machine-readable marks. Deployers clearly label qualifying content for the people who see it.

An assignment handed privately to a teacher isn’t a publication under Article 50(4), which covers text published to inform the public, meaning text a large and open-ended group of readers can see. School integrity policies still have to weigh conduct and evidence themselves. The law does none of that work for a teacher, and the students in those comments are solving a problem it never posed.

AI evidence has been overturned before. In February, Inside Higher Ed reported that a judge ordered Adelphi University to remove a plagiarism finding from a student’s record. Turnitin’s AI detector had marked his paper as fully AI-written. Two other detectors said a person wrote it.

The Thread went out for the first time in December 2024. It was a weekly digital museum built out of obituaries, with real names, real people, and the original obituary linked in every exhibit, on the premise that AI could find patterns across hundreds of lives no human editor would have time to read. The model did the clustering. I did the interpreting and the fact-checking. Over the year I published 39 issues, 33 of them in the museum format, and closed the archive after a six-part finale.

The questions started after the first few issues. They came as email replies. One reached me through a reader who told me a friend of theirs had subscribed, the two of them had talked about the newsletter, and then the friend wrote to me to relay what the first person had said.

So in early 2025 I published a Member’s Guide, an FAQ on its own page, so I wouldn’t have to keep defending the project one email at a time. It laid out why I used real names, why every obituary linked back to its source, and what the AI did and didn’t do. On images: “I use AI-generated art in this newsletter, but never images of the people who passed away that I write about. Those stay in their original obituaries where they belong.”

The newsletter’s host was an AI persona called Echo Weaver, whose appearance I modeled on my cousin Yolanda, who died in 2017. Its About page says it in the third line: “Yes, I’m AI.”

Nobody made me write any of that.

In my master’s program, an assignment for a UX research class asked us to scope out a study rather than run one. I picked AI-generated voice deepfakes of dead people used in political advocacy, and I recommended disclosure by platforms, consent from families before a voice is used, and industry-wide guidelines. It was never fielded. I have no findings, only a plan.

Article 3(60) of the AI Act covers AI-generated or manipulated audio that resembles a real person and would falsely appear authentic, alongside image and video. So one of those recommendations, disclosure of synthetic political audio, now resembles an enforceable duty across 27 member states. Only one of the three. Nothing came of the consent protocols, and the duty in the law sits on deployers rather than on the platforms I was writing about. The Act had already been adopted by then, so I can’t claim I got there first.

The FAQ has a second half I had almost forgotten, on why the newsletter used AI art and never photographs of the dead. Copyright made permissions difficult, which is how it started. Then it turned into something I believed.

I cited Sarah Jeong’s piece in The Verge on Google’s Pixel 9, which argued that the era of a photograph working as a shortcut to reality was ending, and that the default assumption about any image was about to flip to fake. See a roach in your takeout, snap a picture. Document damage to a rental car. Photograph smoke over your neighborhood during a fire. Her point was that all of it stops working as evidence once anyone can edit reality on a phone.

The Content Credentials half of Anthropic’s announcement, two years later, is one attempt to answer that problem. A credential can record capture, generation, and later editing, and Anthropic’s signature indicates that Claude processed a file, not necessarily that Claude created the image inside it. It’s imperfect and easy to strip. Re-save the file, convert the format, or take a screenshot, and it’s gone. But a file is at least a container, and a production history can travel inside one.

Plain text has no durable container. A blog post is words in an order. It can be drafted by a model and rewritten by a person, drafted by a person and proofread by a model, or reported by a journalist and run through a model for translation or tightening. Any of those can leave a mark. Any of them can also end with no detectable mark at all, depending on what went through the model and how much changed afterward.

What Article 50 asks of a publisher is whether someone with relevant competence examined the substance of the work, and whether a person or organization holds legal responsibility for it. That is an arrangement between people. A disclosure page can document it. A disclosure page doesn’t create it, and neither does a detector.

I wrote The Thread’s page in early 2025 because readers asked and I got tired of answering the same email one at a time.

The page is still up.

Update, Oct. 18, 2026: Anthropic’s help page now lists which Claude models carry text watermarks. Detection is still in private preview for eligible organizations, including educational ones, and Anthropic says it plans to widen access. It hasn’t yet published the technical guidance on how marks are detected.

How we use AI

Corrections