Watermarking is for machines. Disclosure is for people.
Two versions of the same paragraph. One of them was marked by a machine. See whether you can tell which.
"The clause is unusual but not unworkable. Read against the commercial purpose of the agreement, it puts the risk of delay on the supplier, and the parties appear to have understood that when they signed."
"The clause is odd but not unworkable. Read against the commercial aim of the agreement, it places the risk of delay on the supplier, and the parties seem to have understood that when they signed."
Four words differ. Unusual or odd. Purpose or aim. Puts or places. Appear or seem. Every pair is interchangeable, and nobody would spend a minute arguing the choice.
Neither passage is marked. Nothing here is. Even if one were, you could not tell, because these paragraphs are far too short for a watermark to register. But those four choices are exactly where a watermark lives, and that is the one thing to understand before the compliance questions make sense.
What the watermark actually is
A model writes one word at a time, choosing at each step from a shortlist of plausible candidates. Most of those choices are consequential. A few, like the four above, are not. Ordinarily the model settles the inconsequential choices with a random number.
Watermarking changes where that randomness comes from. Instead of an arbitrary number, the model uses a secret key together with the words already written to decide. The output reads exactly as it did before. But anyone holding the key can check the full sequence of choices and calculate how likely it is that they were made using that key.
Nothing is inserted into the text. No hidden characters, no invisible Unicode, no metadata travelling alongside. The watermark carries no identifying information and cannot be traced back to a person, a firm or a conversation.
The limits matter as much as the mechanism. Short passages contain too few free choices to measure, which is why the test above was rigged from the start.
Tightly factual writing offers few of them, because the right word is often the only word. Proofreading leaves almost nothing behind, since nearly all the words remain the author's. A complete rewrite removes the pattern altogether.
Anthropic also states that the watermark says nothing about ownership or authorship and does not change who is legally responsible for the output.
A connection of mine asked last week whether the new watermarking would affect his firm's operations and compliance. Buried in the question is a reasonable assumption: that if something has been added to the output, something now needs disclosing. He wanted to know whether the firm should mention it in its client alerts.
Nothing about the watermark changes what his firm owes. But those client alerts sit close to the centre of the obligation he was asking about, and the watermark cannot help him with it.
Where Anthropic's obligation ends
Article 50 of the AI Act applies from 2 August 2026, and it splits the duty in two. Providers, meaning the companies building the systems, must mark output in a machine-readable format. Deployers, the organisations using those systems, must disclose certain content in a way a person can perceive.
Anthropic is a provider. It signed the first section of the Commission's Code of Practice on transparency of AI-generated content, alongside roughly 190 organisations. The watermark is how it meets that obligation. That is the whole of what it does.
The code has a second section, written for deployers. A law firm is a deployer. Whether that produces an obligation depends on what the firm publishes.
Where a firm's own obligation sits
As a deployer, a firm must label, in the regulation's word, two things: deepfakes, and AI-generated text published to inform the public on matters of public interest. The second deserves a slow reading, because the Commission has published what counts as a matter of public interest. Among the items on its list: the administration of justice, fundamental rights, consumer safety, public health, and economic or financial developments open to public debate.
Set that beside a firm's publishing calendar. The note on a new judgment. The update on employment law. The alert on a consumer contracts regulation. Of all the businesses this provision reaches, law firms publish the material that matches its language most closely.
There is an exemption, and it carries two conditions. The text must have gone through human review or editorial control by someone with the professional judgement to examine its substance, and a person or entity must hold editorial responsibility for publishing it. The Commission is explicit that spell-checking and grammatical correction do not qualify.
A partner-reviewed memo clears that bar comfortably. A client alert assembled by an automation tool and scheduled for Tuesday might need a closer look.
A mark no reader can see
A deployer cannot rely on the provider's machine-readable mark to satisfy its own disclosure duty. The disclosure has to be perceivable by a person, without special tools. A watermark is, by construction, the opposite of that.
So my connection was right that something may need to be done about what his firm publishes. Somebody has to read the alert for its substance and take responsibility for publishing it. Ask who that is, and at most firms three people would give three different answers.