When AI text becomes visible: what companies now need to settle

Anthropic switched over on the same date. Claude models released on or after 2 August 2026 embed a watermark, imperceptible to human readers, directly into every piece of generated text. This applies worldwide and not only to European users, and it applies across every route of access: the chat interface, the application programming interface, Claude Code and the enterprise variants. Retrofitting for older models has been announced. When Claude produces a file such as .png, .jpg or .svg, it additionally attaches signed provenance data following the open C2PA standard.

A language model assembles text by calculating probabilities for each next token, the small building block a model works in, and then selecting from them. A statistical watermark intervenes at exactly that point: it shifts those probabilities according to a secret pattern, so that the resulting word choice forms a signature across many tokens. Google describes its own SynthID method in the same way, as an intervention in the distribution at the moment of generation.

Four properties follow that matter in practice.

The text looks normal. Anthropic states that meaning, quality and readability remain unchanged. Nothing is visible to the naked eye, neither in the formatting nor in hidden special characters.

Copy and paste does no harm. The signature sits in the word choice itself, not in a file's metadata. It travels along when text is dragged from the chat window into Word, Outlook or a content management system. According to the provider it also survives light editing.

Heavy rewriting destroys it. Rebuilding sentences, translating the text, retyping it or passing it through a different model breaks the pattern. Google reports the same effect for SynthID.

Short texts do not carry it reliably. The EU Code of Practice on transparency of AI-generated content, published on 10 June 2026, lowers the reliability requirements for text below 200 tokens, roughly under 150 words. A subject line or a two-line note carries no dependable signal.

This is where public discussion regularly slips. Anthropic itself is cautious: a detected mark is described as a signal that the content was processed by Claude, but not fully conclusive.

Processing is not authorship. Anyone who has Claude proofread, shorten or translate a proposal they wrote themselves ends up holding a marked text. The hit shows that the model was involved. It does not say to what extent. Conversely, the absence of a mark proves nothing either. It can mean no model was involved, that a different provider was involved, or that someone rewrote the text thoroughly.

There is also a plain gap. At present nobody outside the provider can check the mark at all. Anthropic writes that it is working to enable users and third parties to detect its watermarks, with details to follow in technical documentation. The Code of Practice requires signatories to make a detection solution available, generally free of charge. At the time of writing it has not shipped. Anyone basing internal rules on the idea that suspected cases can be checked later is basing them on a tool that does not yet exist.

Google marks text. SynthID is rolled out in the Gemini app and the web experience. The limits are the same: confidence scores drop sharply when text is thoroughly rewritten or translated, and short factual answers leave little room for a signature. The public SynthID Detector portal accepts image, video and audio files; text is not on that list.

OpenAI does not mark text. According to its own developer documentation, OpenAI's provenance signals cover images (C2PA and SynthID) and audio (SynthID). Nothing is provided for generated text.

In practice this means text from Claude and from Gemini carries a marking, while text from ChatGPT currently does not. Building an internal detection regime on that basis means building on uneven ground.

For organisations that deploy AI systems rather than provide them, paragraph 4 of Article 50 is the part that counts. Anyone publishing AI-generated text to inform the public on matters of public interest must disclose that it was artificially generated. The obligation falls away where the content underwent human review and a natural or legal person holds editorial responsibility. In practice: define who answers for which type of text, and make that review verifiable.

The second point relates to the marking only indirectly, but it weighs more. A marked text inside the company is the visible residue of something that already happened: company content left the building. The watermark is not the damage. It makes visible after the fact that a proposal, a draft contract, a personnel file or a customer record went to an external service. Looking for detection tools first means treating the symptom.

The figures are unambiguous. Software AG surveyed 6,000 knowledge workers in the United States, the United Kingdom and Germany. More than half use AI tools that have not been approved. 46 per cent stated they would continue using personal AI tools even if their employer banned them completely. 33 per cent say their own IT department does not provide the tools they need.

The second and third figures belong together. Employees do not go around the rules out of defiance. They go around them because the work has to be finished and there is nothing internally that would finish it. A ban without an alternative moves the task from the company machine to the private device and the private account. There the organisation has no logs, no data processing agreement and no access. Usage does not fall; visibility falls. It was no different with cloud storage and private messengers.

Monitoring is the other unworkable route. Even once the detection solution arrives, it checks one provider, works only above a certain text length, cannot distinguish proofreading from authoring, and breaks under thorough rewriting. A rulebook built on that produces disputes rather than clarity.

An organisation that provides a usable internal tool needs neither bans nor monitoring. The question of whether a text is marked loses its edge once the documents no longer leave the company network.

IonKon GmbH trains a company's own language model from its documents. The method is LoRA fine-tuning, which adapts an existing base model to a specific body of material. There are two sizes: M with 9 billion parameters based on Qwen3.5-9B for 25,000 euros net as a one-off, and L with 27 billion parameters based on Qwen3.8-27B for 60,000 euros net as a one-off. Operation is local, on customer hardware inside the company network. There is no licence server; ownership of the model transfers to the customer. The AnythingLLM interface is included. Processing during creation takes place in the EU and Switzerland, and uploaded documents are deleted no later than 30 days after delivery.

The marking obligation applies here too, and that belongs in the open: outputs from an IonKon model carry signed metadata under Article 50(2) of the EU AI Act, verifiable with a tool supplied alongside it. The difference from the case described at the start is therefore not whether output is marked. It is where the documents go.