A lock that can be picked is still a lock

← Back to all articles

Georgi Hristov · Sofia · 19 August 2026 · ~10 min read

On 2 August 2026, two things happened on the same day. Article 50 of the AI Act became enforceable. And Anthropic began marking content generated by Claude.

The marking has two parts. An imperceptible watermark woven into generated text, and signed provenance metadata following the C2PA open standard attached to supported file types: .svg, .png and .jpg. Models launching on or after 2 August support marking at launch; earlier models must be brought into line by 2 December 2026. Notably, Anthropic applies this worldwide, not only where the AI Act bites.

On 11 August, a repository called watermarks-remover appeared on GitHub. Within 48 hours it had 4,102 stars. It has since passed 10,000, with at least one outlet reporting over 14,000. Searches for "AI watermark remover" rose roughly 60% in the same week.

The story was picked up quickly and framed consistently. Anisha Sircar covered it for Forbes; Axios called the marks a "new front in AI detection", a framing the EU AI Governance Hub carried to its own audience; Luiza Jarovsky opened her post on the removal tools with the line "The EU did not see that coming."

The framing almost everywhere has been adversarial and simple: the watermark went up, the watermark came down, transparency has failed. That framing is wrong on the law, and it obscures a genuine problem sitting one layer beneath it.

The concession nobody read

Start not with the tool but with the instrument the EU wrote to make Article 50 workable. The Code of Practice on Transparency of AI-generated Content was finalised on 10 June 2026 and confirmed by the Commission and the AI Board as an adequate voluntary tool for demonstrating compliance. Roughly 190 organisations had signed by the end of July.

It does not require a marking method. It requires three: metadata embedding, imperceptible watermarking, and logging. And the reason it gives is the interesting part. As one analysis of the Code put it, the layering is mandated "not because any one method works, but because each protects against failure modes the others cannot."

The EU's own compliance instrument is built on the premise that every individual marking method fails somewhere.

Researcher Natalia Garina states the position without hedging: "no single marking technology currently meets all four requirements Article 50 imposes: effectiveness, interoperability, robustness, and reliability."

What the provision actually says

With that in view, read Article 50(2) of Regulation (EU) 2024/1689:

"Providers of AI systems […] shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated."

Then the qualifier that most commentary has skipped. Providers must ensure their technical solutions are:

"effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art."

Those last eight words do the real work. This is a state-of-the-art standard measured against feasibility and cost, not a warranty of unremovability, and it could not sensibly be one. No marking scheme in any medium has ever been unremovable. A legislature that required one would be legislating for a technology that does not exist, which is exactly what Garina's finding confirms.

The existence of a removal tool does not put a provider in breach. It goes to the "robust" limb, as evidence, not as verdict.

The penalties make the stakes concrete: Article 50 breaches carry fines of up to €15 million or 3% of global annual turnover. Anthropic's response was to implement two independent mechanisms and deploy them globally rather than geofencing to the EU; the company confirmed the marking applies "to every region where Claude is offered, not just the EU". That is the Brussels effect operating precisely as intended, and it is a defensible approach to compliance.

The three layers, and which ones actually work

To see why the "watermark defeated" headline is overstated, you have to look at what the tool does. Its own documentation is admirably honest about this, and separates verifiable removals from best-effort ones.

The distinction matters commercially as well as legally. Stripping C2PA metadata from a PDF is trivial and always has been; metadata has never been a security control, and the Code of Practice's layering requirement exists precisely because it isn't one.

The text layer is harder to characterise, and here I want to be careful about what is actually known. The assumption running through most coverage is that Anthropic's text watermark lives in word choice, which is what a statistical watermark normally means, and what a rewriting attack would target. But The Register made a sharp observation: Anthropic has committed that marking "doesn't change the meaning" of its output, and that constraint probably rules out using word selection as the identifier, since that is exactly what shifting word choice would do.

If that reading is right, two things follow. The text mark may be more fragile than the discourse assumes, and the C2PA layer is carrying more of the compliance weight than anyone is crediting it for. I would not state either as settled. Without the specification, nobody outside Anthropic can, and that is the point of the next section.

The gap that should actually worry you

Now to the part almost nobody has written about.

Anthropic has not published a public detector or a technical specification for its text watermark. It has said documentation on detection is forthcoming. It has not arrived.

Sit with the consequences of that for a moment. Article 50(2) requires output to be marked in a machine-readable format and detectable as artificially generated. Detectability carries equal legal weight in that sentence; "and detectable" is a conjunctive limb of the obligation, not a qualifier. If no one outside the provider can run the detection, then this property cannot be tested by a customer, an auditor, a court-appointed expert, or a market surveillance authority.

The symmetry is almost elegant. The removal tools cannot prove they succeed. The provider cannot readily prove it complies. Independent testing has already found that one popular removal tool "let the most common hidden-payload technique through untouched", which tells you how thin the evidentiary ground is on both sides.

We have a transparency obligation that, at this moment, no one can audit.

This will resolve. Detectors will ship, the Commission's guidance on transparency will thicken, and the Code of Practice signatories (roughly 190 by the end of July) will converge on testable claims. But it has not resolved yet, and the interim is where the risk sits.

Who owes what, and why it is probably not who you think

Article 50 is not one obligation. It is several, allocated to different parties. The public conversation has treated this as a story about Anthropic. For most organisations reading this, the exposure runs the other way.

The Commission's final Guidelines on Article 50, published on 20 July 2026, sharpen the split. They confirm that a single entity can be provider and deployer simultaneously depending on the use, and, for anyone planning to do the minimum, that "generic references hidden in terms and conditions, website footers, or vague labels are unlikely to be sufficient."

Picture the actual scenario. A marketing associate drafts a campaign page with Claude, notices the output contains odd invisible characters, and runs it through a cleaner someone recommended. The C2PA metadata goes. Possibly the text mark degrades too.

Anthropic has still done what the state of the art allows. Your organisation is the one publishing unlabelled AI-generated content. If that content addresses a matter of public interest and no human took editorial responsibility for it, the Article 50(4) duty is yours and it has not been met.

Ten thousand GitHub stars says less about what Anthropic did than about what deployer organisations haven't done. A circumvention practice is spreading, and most of the organisations affected have no policy governing it.

The wider point

There is a habit in technology regulation of treating every circumvention as proof that the rule has failed. It is the same reflex that greeted DRM, then ad blockers, then cookie walls. Sometimes the reflex is right. Here it is not, because the drafters knew perfectly well that marks can be stripped. That knowledge is written into the text as "as far as this is technically feasible", and written into the Code of Practice as a requirement to use three methods rather than one. The circumvention was anticipated. What was not anticipated is how quickly it would organise, and how loudly it would be read as a verdict.

The genuine problem this week is quieter and more structural. An obligation whose central property is detectability has entered into force before the means of detection has been published. The marking has not failed. The specification arrived late, and the fix is a technical document, not a better watermark.

Until it is, the honest position for a practitioner is the one the tool's own author took about his software: say what you can verify, say what you cannot, and do not let the confident number in the headline stand in for the evidence.