Let’s talk about the fact that the machine now signs its work, and you still can’t sign yours.
On the third of November, Anthropic started putting an invisible mark inside the text that Claude writes. Nothing you can see on the page. No label at the bottom. A pattern in the words the model chooses, set by a key the company keeps. On the sixteenth, four more models get it — Opus 4.6, Opus 4.5, Sonnet 4.5, Haiku 4.5 — and Amazon Bedrock a few days after that.
Customers can’t switch it off. It lives in the model, so it travels with the model: AWS, Google Cloud, Microsoft Foundry, wherever you rent it.
Why now? A deadline. Europe’s AI Act, Article 50, requires providers to mark AI-generated content, and about a hundred and ninety organisations signed the code of practice in July. Anthropic says it applies the mark everywhere because it doesn’t yet have a durable way to limit it by region.
That’s honest, and it’s worth saying out loud. This was not a moral awakening. It was a date on a calendar. Which is fine. A law is how a default gets changed when nobody in the room wants to change it.
Now here’s the part almost everyone will skip. What does the mark actually tell you?
Anthropic’s own explanation is careful. The key answers one question: what is the likelihood this was partly written by Claude? That’s it. It does not confirm a human wrote it. It cannot tell you another AI wrote it, because a different model has a different key, or no key at all. It doesn’t say who owns the words. It doesn’t say who answers for them.
A mark that says “this probably came from our product” is a receipt for the product. It is not a receipt for the person.
So picture the room this lands in.
A small firm is answering a tender. The client has added a clause, because clients add clauses: all submissions must be original human work, AI-generated content will be disqualified. Fair enough. The woman writing it does the thing she has always done. She talks to two customers, reads the old contract, writes the whole thing herself over three nights, and cuts a third of it on the last morning because it was too long. Every word is hers. She has no way to prove it.
The other bidder doesn’t write it. Generates it, then pays someone to rewrite every sentence, because a full rewrite removes the mark. Anthropic says that plainly too — a complete rewrite where every word is replaced will strip it.
Two submissions arrive. Both come back clean.
The check cannot tell those two documents apart. One is a person’s work. The other is a machine’s work with a human signature rented on top. The mark does not separate human from machine. It separates lazy from careful. And careful was never the question anyone was asking.
There’s a second thing, smaller and uglier. On the retrofitted models, the watermark only applies when temperature, top_p and top_k are left at their defaults. Change one number and it’s gone. Anthropic warns customers about this in its own email: if you rely on the watermark for your own compliance, keep these settings at their defaults.
Read that again. A vendor telling its customer that their legal defence depends on a sampling parameter. The same week the mark became mandatory, it stayed optional for anyone who knew which dial to turn.
And notice where the mark is weakest. Facts. A sentence with only one correct next word gives the watermark nothing to work with. Code, mostly the same. Proofreading your own draft? Almost nothing to attach to, because nearly all the words are still yours. So the mark is strongest in opinion, story and argument — the writing where a person’s voice is the whole point — and weakest in numbers, code and forms, which is exactly where a company needs a clean record.
That’s backwards. And it will not be fixed by a better detector.
Here’s the thing people are missing, and it’s bigger than one vendor.
For two decades we treated a clean document as a human document. That assumption is now dead, and the replacement is worse. Clean means nothing was marked. Generated, then paraphrased — clean. Written by a person — clean. Written by a model from a company that didn’t sign the code — clean. A short note — clean. Anybody who wants to look human only has to be careless with a thesaurus.
Meanwhile the woman who actually wrote the thing has nothing. No key. No record she controls. No way to show the three nights, the two calls, the cut paragraph, the reason she chose that word. Her proof is a memory, and memory is not evidence.
This is the gap I keep landing on. The machine got a birth certificate. The person got a suspicion.
Not because anyone is evil. Because the law asked the machine to identify itself, and nobody wrote the other half of the sentence. Nobody asked how a person proves their own work without handing their draft history to a platform that will train on it.
So the fix isn’t a detector, and it isn’t a better label. It’s a receipt the author holds: a dated trail of the work as it was made, signed by the person, checkable by anyone, without asking a vendor for permission or a key.
If you run anything that ships words, three things. First, put one line in the document: written by this person, assisted by that tool, for this part. A sentence of disclosure beats a detector every time, and it costs you nothing. Second, if a client contract leans on the watermark, go and look at your defaults, because your compliance might be sitting in a parameter somebody changed in March. Third, start keeping your own record now — dated versions, the voice memo, the notes, the file history — somewhere you control. Not because you’ll need it next week. Because the day you need it, you’ll need it to already exist.
The bid went in. She never found out how they decided.
Somebody should be able to answer that.