An invisible change to AI-generated text produced a very visible reaction: people started looking for ways to strip it out.

In August 2026, Anthropic confirmed that text generated by Claude would carry a watermark. The announcement drew immediate criticism from users who objected to their work being marked as AI-assisted, and within days, search interest in "AI watermark remover" and "Claude watermark remover" climbed from near-zero to a measurable peak.

A few days later, on 14 August, the company published a detailed explanation of how the watermark works. Read carefully, that document undercuts most of the assumptions circulating on both sides of the argument, including the assumption that a watermark can tell an employer whether a candidate was honest.

That question is what makes this a workplace story rather than a technology story. CVs, cover letters, application answers, presentations and internal documents are increasingly produced with some degree of AI assistance. A detectable watermark can indicate that a model was involved. It cannot explain why, how much, or whether any rule was broken.

What Claude's watermark actually is

The first thing to establish is what the watermark is not.

It is not a visible label. It is not a set of hidden Unicode characters, invisible spaces, or extra content inserted into the text. Anthropic states plainly that nothing is added to the text, that there are no hidden characters, and that a watermarked response is indistinguishable to a reader from an unwatermarked one.

The mechanism is subtler than most coverage suggests. A language model generates one word at a time, and at each step it often has several equally reasonable candidates. Normally, the choice between them is settled by a random number. Watermarking replaces the source of that randomness with a value derived from a private key and the preceding words. The words remain effectively random, the model is not pushed toward particular vocabulary it would not otherwise use, but the resulting sequence can later be checked against the key to estimate the likelihood that Claude produced it.

Anthropic compares this to a board game in which players use digits of pi instead of dice. The moves are just as random and the game plays identically, but afterwards you could work out that the sequence probably came from pi.

The method is a version of SynthID-Text, published by Google DeepMind in Nature in 2024, and belongs to a family of approaches dating back to a 2022 proposal by Scott Aaronson. Anthropic reports no measurable effect on quality, creativity or readability, and no additional cost or latency, since the technique generates no extra tokens.

Crucially for anyone worried about surveillance: the watermark carries no identifying information. Anthropic states there is nothing in the watermark or its key that would allow anyone to recover information about a user, their organisation, or their conversations.

The company has also said it will offer a watermark detection API, but that it is still working out the implementation details. At the time of writing, no public detection tool is available.

This is not only a European story

Much of the early commentary framed the change as an EU compliance measure with limited relevance elsewhere. That framing is wrong, for two reasons.

First, the legal trigger is broad. Article 50 of the EU AI Act, which applies from 2 August 2026, requires providers of systems generating synthetic text, audio, image or video to mark outputs in a machine-readable format that makes them detectable as AI-generated. The obligation reaches providers established outside the EU whenever their system's output is used inside it. Anthropic and roughly 190 other signatories signed the associated Code of Practice on Transparency of AI-Generated Content in July 2026.

Second, and more consequentially: Anthropic says it is applying watermarking globally at launch, because it does not yet have a durable way to scope the feature by region. It has said it will continue evaluating approaches.

The practical result is that a document produced with Claude in Nairobi, São Paulo or Jakarta carries the same mark as one produced in Dublin. And because other major model providers signed the same Code of Practice and are implementing their own watermarks, this will not remain a single-vendor issue. Employers everywhere should assume marked AI text is becoming the norm rather than the exception, regardless of whether their own jurisdiction requires anything.

Two dates are worth noting for anyone tracking how quickly detection becomes practical. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement, under a grace period agreed in May 2026. Providers face a further deadline of 2 February 2027 to implement an interoperability solution for watermark detection. Anthropic has separately said it is rolling watermarking out to its own older models over the coming months.

Until interoperable detection exists, the ability to check a document is limited, which makes the current wave of confident claims, in both directions, premature.

Why people search for a watermark remover

Some motivations are easy to guess. Someone may want to conceal that an essay, an assessment or a professional document was produced almost entirely by a model.

Other motivations look different. A person may have written their own CV and asked a model to fix the grammar. A non-native speaker may have translated a cover letter they wrote themselves. An employee may have asked for a report to be made more readable without altering its analysis. Someone else may simply fear that any trace of AI will be read as evidence of dishonesty, whatever the reality.

These cases are not equivalent, and the search query does not distinguish between them.

This is the transparency paradox at the centre of the story:

A watermark supplies a signal. It supplies none of the context needed to interpret that signal fairly.

Do watermark removers work?

That depends entirely on what a given tool actually removes. "AI watermark remover" is currently used to describe at least three technically unrelated things, and treating them as interchangeable is how people end up misled.

Tools that strip hidden characters. Some scan a document for zero-width spaces, unusual Unicode or formatting artefacts. That is useful for cleaning text copied between applications. It has no bearing on Claude's text watermark, because the watermark is not made of hidden characters in the first place. A service claiming to remove Claude's watermark by deleting invisible characters is solving a different problem.

Tools that strip file metadata. When Claude produces a supported file type, it attaches a content credential, a cryptographically signed note in the file’s metadata recording that the file was made or processed with Claude, using the open C2PA standard also used by camera manufacturers and photo-editing software. Anthropic explicitly distinguishes this from the text watermark: nothing inside the file changes, and the credential contains no identifying information. Removing metadata from an image has no effect on the statistical pattern in generated prose.

Tools that rewrite the text. Anthropic acknowledges that light editing probably will not remove the watermark entirely, while a complete rewrite in which every word is replaced will. As the company notes, at that point it becomes arguable whether the result can still be described as AI-generated at all.

There is a further reason to treat marketing claims sceptically. With no public detection API yet available, and no interoperable detection standard in force, it is difficult for any commercial service to demonstrate that it removed a key-based watermark rather than simply changing how text looks. Buyers currently have no way to verify the central claim.

What a watermark can and cannot prove

This is where the hiring conversation usually goes wrong, and the primary source is unusually explicit about the limits.

What it can indicate: the likelihood that Claude was involved in producing a passage of text. Confidence rises with length, because longer passages contain more word choices to measure.

What it cannot do:

• It cannot distinguish "Claude wrote this" from "Claude heavily edited this."
• It cannot identify the user, their organisation, or the conversation involved.
• It cannot confirm that text was written by a human. A negative result proves nothing.
• It cannot detect a different AI system, which would use a different key or method entirely.
• It works poorly on short samples, where there are too few word choices to measure.
• It is sparse in factual writing, where accuracy leaves fewer equally valid alternatives.
• It is largely absent from code, which usually has to be exact, though it can appear in comments.
• It may find almost nothing to attach to in lightly proofread text, since nearly all the words remain the author's.
• It says nothing about ownership or authorship, and does not change a user's legal rights.

Apply that list to recruitment and the conclusions narrow sharply. A long cover letter largely written by a model may carry a strong signal. A short CV of names, dates, job titles and terse bullet points may carry very little. A document that was only proofread may register nothing. A full translation is more likely to carry a watermark, because every word in the output was chosen by the model.

So a positive result would not establish that a candidate lied, invented experience, or broke a rule. It would suggest that a model was probably involved at some stage. In an international labour market where candidates routinely apply in a second or third language, treating that as proof of fraud would penalise people for using a language tool, while telling the employer nothing about whether the described experience is real.

Watermark detection is not the same as an AI detector

This distinction matters practically, because many organisations already buy "AI detection" software and may assume the two are equivalent.

They work on fundamentally different principles. Watermark detection uses the provider's own key to check for a deliberate statistical pattern. Commercial AI detectors do not have that key; they infer AI authorship from stylistic tells, recurring constructions and word preferences typical of model output. Anthropic describes these as fundamentally different approaches.

The implication for employers is uncomfortable. Stylistic detection penalises anyone whose natural writing resembles model output, a category that disproportionately includes non-native speakers and anyone trained in a formal register. Deploying such a tool as a gate, and describing the result as watermark detection, would misrepresent what the organisation is actually measuring.

The real issue is undisclosed substitution

The useful boundary is not between "AI" and "no AI." It is this:

The rows differ in kind, not degree. No detector can tell them apart. Only a stated policy can.

Notably, the EU's own marking obligation reflects a version of this distinction: it does not apply where a system performs only an assistive function for standard editing. Even the regulation treats proofreading differently from generation.

What a candidate AI policy should cover

A workable policy does not need to be long. It needs to be published before people apply, and specific enough that a recruiter can apply it consistently. At minimum:

1. Permitted uses in application materials, grammar, translation, structure, clarity, research.
2. Disclosure, whether candidates must declare substantial AI assistance, and how.
3. Take-home tests and technical assessments, what is allowed, and what is not.
4. Live interviews, whether any real-time assistance is permitted.
5. The employer's own AI use, which stages involve automation.
6. Detection, whether applications are analysed, by what kind of tool, and how a result is interpreted.
7. Human review, who makes the decision, and at what point a person sees the file.
8. Appeal, how a candidate contests an automated signal.
9. Data protection, the lawful basis for any analysis, retention, and candidate rights.

That last point deserves emphasis. Running detection software over an application is processing personal data. Under the EU and UK GDPR, and under comparable regimes elsewhere, candidates have rights concerning automated decision-making and meaningful human involvement. Rejecting someone on the strength of a probabilistic score, with no human review and no route of appeal, is a compliance question as much as a fairness one. Organisations should take their own legal advice on this.

Transparency has to run both ways

Candidates are increasingly expected to disclose how they used AI. Employers who ask for that should meet the same standard, because AI now touches most stages of hiring: drafting adverts, sourcing candidates, matching CVs to requirements, scheduling, transcribing interviews, summarising notes, analysing pipeline data, and supporting assessments.

None of that is inherently unfair. But candidates cannot calibrate their trust in a process they cannot see. An employer that demands disclosure while concealing its own automation is asking for a transparency it does not offer.

Publishing clear rules also has a self-interested benefit: it removes the incentive that sends people searching for a watermark remover in the first place. Most of that traffic is not sophisticated evasion. It is uncertainty.

What candidates should do

Nobody needs to avoid AI tools. Everyone remains responsible for what they submit.

Before sending an AI-assisted application:

• Verify that every fact, achievement and qualification is true.
• Be able to explain every sentence in your own words, unprompted.
• Keep the document in your own professional voice.
• Do not use live assistance in an interview or assessment unless it is explicitly permitted.
• Read the employer's candidate AI policy, and ask when it is unclear or absent.

The workable standard is short: AI can improve how you communicate your experience. It should not manufacture experience you do not have.

The arms race will not settle the trust question

Providers will add watermarks. Vendors will sell detectors. Users will look for removal tools, and new systems will try to make those tools less effective. That cycle is not ending soon.

The surge in searches for watermark removers is therefore about more than a technical feature. It reflects uncertainty about how AI assistance will be judged, in education, in recruitment, and at work.

Claude's watermark may help establish that a model was involved in a piece of text. It cannot establish intent, accuracy, or whether a rule was broken. For employers, the lesson is not to treat a signal as a verdict. For candidates, it is not to hide AI use that replaced their own knowledge or ability.

The question is not whether AI touched a document. It is whether AI replaced the skill, judgment or experience the document claims to represent.

Frequently asked questions

Does Claude add a watermark to generated text?

Anthropic has confirmed that future Claude models generate watermarked text, and that it is being applied globally rather than only in the EU. Models launched before 2 August 2026 fall under a transition period, with watermarking being added over the following months.

Is the watermark made of hidden characters?

No. Anthropic states that nothing is added to the text and there are no hidden characters. The watermark is a statistical pattern arising from how the model selects among equally valid word choices.

Can it be traced back to me or my employer?

No. Anthropic says the watermark carries no identifying information about a user, their organisation, or their conversations.

Can a Claude watermark be removed?

Anthropic says light editing probably will not remove it completely, while a complete rewrite replacing every word will. Whether a commercial "remover" works depends on whether it targets the statistical watermark or merely strips formatting, Unicode characters or file metadata, which are different things.

Can an employer detect a CV written with Claude?

A compatible detector may estimate whether Claude was involved, most reliably in longer passages substantially written by the model. It cannot prove Claude wrote an entire CV, identify the candidate, or establish dishonesty. Anthropic has said a detection API is coming but has not released one.

Does proofreading a CV create a detectable watermark?

Often not. When only a handful of grammar or punctuation changes are made, there may be too few model-chosen words to register.

Does a translation carry a watermark?

Yes. Anthropic says translations carry the watermark, because every word in the translated output is chosen by the model.

Is a negative result proof that a human wrote the text?

No. Anthropic states the method cannot confirm that text was human-written, and cannot detect a different AI system, which would use a different key or method.

Is using AI to write a CV cheating?

There is no universal rule. Many employers permit AI for grammar, translation, structure, research and interview preparation, while prohibiting fabricated experience, unauthorised assessment help and live interview assistance. Check the specific policy, and remain accountable for every statement submitted.

Sources

• Anthropic, How Claude's text watermark works (14 August 2026), https://www.anthropic.com/news/claude-text-watermark
• Google DeepMind, SynthID-Text, Nature (2024), https://www.nature.com/articles/s41586-024-08025-4
• EU AI Act, Article 50, https://artificialintelligenceact.eu/article/50/
• European Commission, Transparency obligations under Article 50, https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act
• European Commission, Guidelines on AI transparency obligations, https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations
• European Commission, Code of Practice on Transparency of AI-Generated Content, signatories, https://digital-strategy.ec.europa.eu/en/news/strong-backing-code-practice-transparency-ai-generated-content
• C2PA, https://c2pa.org/