Anthropic has introduced a new capability in Claude that could have significant consequences for the legal profession: AI-generated text can now contain an invisible, machine-readable watermark.
At first glance, this sounds like another development in the increasingly crowded field of AI detection. It is more interesting than that. The technology potentially creates a way to establish something about the provenance of AI-generated text after it has left the model.
That matters to lawyers because legal work is unusually sensitive to questions of authorship, attribution and process. A brief may be drafted by an associate, revised by a partner, checked against authorities and ultimately filed with a court. Increasingly, AI will be somewhere in that chain.
The question is whether the resulting document will contain evidence of that involvement.
How do you watermark ordinary text?
The obvious problem with text watermarking is that there is nowhere obvious to put the watermark. A photograph can contain a faint logo. A PDF can contain metadata. A digitally signed document can carry information about its origin. Plain text is much harder.
The solution takes advantage of how large language models actually generate language. When Claude produces the next token, it is working with a probability distribution over possible tokens. Sometimes one choice is overwhelmingly likely. In other cases, there are dozens of reasonable ways to continue the sentence.
Suppose Claude generates the sentence:
“The court ultimately concluded that the defendant…”
The model might consider “breached,” “violated,” “failed,” “had,” and other possibilities. Some will have higher probabilities than others, but there is still room for the model to choose among alternatives. A watermark can exploit that flexibility.
One established approach, described in academic research by researchers at the University of Maryland and other institutions, divides possible tokens into two pseudorandom groups, commonly referred to as a “green list” and a “red list.” The model then gives a small statistical preference to tokens on the green list. Each individual decision remains essentially invisible, but over a sufficiently long passage the aggregate pattern becomes statistically unusual and can be detected.
This is the clever part. The watermark does not have to be added to the document after Claude has finished writing. It can be created through the choices the model makes as it generates the document.
To a reader, the output looks like normal prose. To a detector that knows what pattern to look for, it can contain a statistical fingerprint.
This is different from an AI detector
The distinction is important in understanding how it works.
A conventional AI detector looks at completed text and tries to infer whether it was generated by an AI system. It might examine word choices, sentence structures, predictability or other characteristics and then produce a probability that the text was AI-generated.
A watermark works in the opposite direction. The AI system intentionally embeds a signal during generation, and a detector subsequently looks for that signal. The difference is essentially between inference and provenance.
An AI detector is saying that a document looks like something an AI might have written. A watermark can potentially provide evidence that a particular AI system participated in generating the text.
That still falls short of proving who wrote the document or how much of it was produced by AI. But it is a substantially different evidentiary proposition.
Consider a typical legal brief
Imagine an attorney asks Claude to prepare a first draft of a motion. Claude produces 20 pages. The attorney then spends several hours reviewing the material, rewriting the introduction, adding authorities, removing sections and changing the substantive arguments before filing the final version.
The finished brief could look entirely like the attorney’s work. Some of the underlying Claude-generated language could nevertheless retain its watermark.
Anthropic says its watermark is designed to survive copying, pasting and some editing, while acknowledging that more substantial transformations can interfere with detection.
That creates an interesting distinction between authorship and provenance.
The attorney may properly be regarded as the author of the final brief. At the same time, some of the language may have originated with Claude. Watermarking potentially provides a technical means of establishing that fact after the document has left the AI system. That is where the issue becomes interesting for litigation.
Imagine opposing counsel discovers the watermark
Today, if opposing counsel thinks a brief was written with AI, they could run it through an AI detector. The result might say that the document has an 80% probability of being AI-generated. However, that is unlikely to settle anything.
Now imagine that the same lawyer has access to a reliable Claude watermark detector and finds that substantial portions of the brief contain Claude’s watermark.
The argument is much narrower and potentially much stronger: the text contains a provenance signal associated with Claude.
That still does not establish who operated Claude, what prompt was used, how much the lawyer subsequently changed the output or whether the lawyer independently verified the legal analysis.
It does, however, potentially establish that Claude generated some of the underlying text.
For a legal proceeding, that distinction could matter.
A watermark is not a digital signature
There is a temptation to treat watermarking as a kind of cryptographic authorship certificate. That would be a mistake.
A positive watermark detection would not necessarily prove that an entire document was generated by Claude. It would not establish that the lawyer did no substantive work, that the lawyer relied on Claude’s legal conclusions or that the lawyer breached a professional obligation.
The converse matters as well. An unwatermarked document would not necessarily prove that humans wrote it.
Anthropic acknowledges that transformations can affect detection and that the absence of a watermark cannot simply be treated as proof of human authorship.
That means the eventual legal fight is likely to be less about whether a watermark exists and more about what conclusions can reasonably be drawn from its presence.
Lawyers will want to know the detector’s false-positive and false-negative rates, how much text is required for reliable detection, how paraphrasing affects the signal and whether an independent expert can reproduce the result.
Those are familiar forensic questions. AI watermarking simply introduces them into a new context.
Legal writing creates another complication
Legal documents contain a lot of language that gives an AI system little freedom.
A statutory quotation needs to be accurate. A case citation has a prescribed form. A party’s name has to be spelled correctly. Defined terms may have to be reproduced exactly.
There may be relatively few statistically plausible alternatives for the model to choose from. Watermarking works most naturally when the model has multiple reasonable ways to express an idea. That makes the length and character of the text important.
A three-word passage offers very little statistical evidence. A 30-page memorandum gives the watermarking mechanism considerably more opportunity to reveal itself.
This is another reason lawyers should be cautious about treating watermark detection as a binary test. It is fundamentally statistical.
Now consider discovery
The discovery implications may be more significant than the courtroom detection question.
Lawyers already think about how documents were created, modified and stored. Generative AI adds another potential layer to that history.
Consider a corporate investigation in which an employee uses Claude to prepare a report. The legal department subsequently revises it and distributes the final version to management.
In a future dispute, the relevant universe of information could conceivably include the original AI-generated draft, prompts, model information, subsequent edits and records showing who reviewed the output.
It could also include provenance information associated with the AI-generated material.
That does not mean any of these materials would automatically be discoverable. Privilege, work product, relevance, proportionality and the other ordinary rules of discovery would continue to apply.
The important change is that AI generation may become easier to identify as an event in the document’s history.
What if opposing counsel knows where AI was involved?
There is also a strategic dimension. Suppose opposing counsel can identify which sections of a brief originated with Claude. They now know something about the opposing side’s drafting process that would previously have been difficult to establish.
They could focus their review on those sections. They might check the citations more aggressively, investigate factual assumptions or look for contrary authority that the model failed to identify.
They could also compare the argument against other AI-generated approaches to the same legal question.
The watermark would not tell them whether the argument was good. It could tell them where AI entered the drafting process. That is potentially valuable litigation intelligence.
Law-firm AI policies may need to address provenance
Most law-firm AI policies have understandably focused on confidentiality, accuracy and permitted use.
Can client information be entered into the model? Does the provider retain prompts? Has the output been reviewed? Are citations being checked?
The ABA’s Formal Opinion 512 already makes clear that lawyers using generative AI remain subject to existing duties involving competence, confidentiality, communication, supervision and reasonable fees. The opinion also emphasizes that lawyers need to understand the capabilities and limitations of the AI systems they use.
Watermarking introduces another policy question: what happens to AI provenance once AI-generated material becomes part of ordinary firm work product?
A sophisticated firm may eventually want to know which system generated a piece of text, when it was generated, how extensively it was edited and who reviewed it. That starts to look less like an AI policy and more like a new form of document governance.
Billing becomes more interesting
The ABA has also addressed the implications of generative AI for reasonable legal fees. Suppose Claude produces a memorandum in 30 minutes that would previously have required five hours of attorney drafting. The lawyer then spends two hours reviewing and revising it. How should that work be billed?
Watermarking does not answer the question. It could, however, make the underlying workflow more auditable.
An AI-native legal platform could eventually maintain a record showing that AI produced the initial draft, an attorney conducted independent research, the attorney substantially revised the argument and the final work product was reviewed before delivery.
That could make it easier for firms to demonstrate responsible AI use. It could also make questionable billing practices easier to identify.
The privilege question is more complicated
The presence of a watermark does not itself determine whether material is privileged.
The usual questions still matter: why was the material created, for what purpose, who received it and how was it used? But provenance could become relevant to those factual questions.
If a party characterizes a document as an attorney’s independent legal analysis and another party can demonstrate that significant portions originated with an AI system, the provenance of the document may become relevant to understanding how it was created.
That does not answer the privilege question. It provides another piece of evidence about the document’s history.
As AI becomes more deeply integrated into legal workflows, that history could become increasingly important.
Who controls the detector?
There is another issue that lawyers should pay attention to. Anthropic says it is developing detection tools for users and third parties. But the underlying technology is controlled by Anthropic.
Imagine that a case turns on whether a brief contains a Claude watermark. Who has the authoritative detector?
Can opposing counsel independently reproduce the result? Can an expert examine the methodology? Can the relevant detection mechanism be obtained through discovery? Can Anthropic be compelled to provide information about the technology?
These are not entirely new legal problems. Courts routinely deal with proprietary forensic technologies and expert methodologies.
AI watermarking introduces a particularly interesting variation because the AI provider created the technology that determines whether its own system generated the text.
If watermark evidence becomes important in litigation, questions about independent verification, methodology and error rates are likely to become central.
There will be a watermark arms race
If AI companies can watermark text, people will try to remove the watermarks.
Paraphrasing is the obvious approach. Take Claude’s output and ask another model to rewrite it. Translate it into another language and back again. Rewrite it manually. Mix it with human-written material.
Each transformation can disrupt the statistical pattern. Academic research has already examined the robustness of LLM watermarks under paraphrasing and other attacks. The results suggest that watermarking can remain detectable after some transformations, while more aggressive rewriting can weaken or eliminate the signal.
The likely result is an arms race between watermarking and watermark removal. That is another reason lawyers should avoid treating a watermark as an infallible forensic test.
The bigger shift is from AI detection to AI provenance
This is ultimately the most important development. The AI industry has spent years asking whether it is possible to detect AI-generated text.
The more consequential question may be whether it is possible to establish where that text came from. Yet, those are different problems.
Detection asks whether something looks like AI-generated content. Provenance attempts to establish something about the history of the content.
Anthropic’s approach is part of a broader move toward machine-readable provenance for AI-generated material. For supported files, Anthropic is using digitally signed provenance information. For text, it is using an invisible watermark embedded during generation.
The underlying idea is straightforward: AI generation should leave evidence behind. For lawyers, that should sound familiar. It is essentially another potential layer in the chain of custody of a document.
The AI-native law firm will need a provenance layer
This may ultimately be the biggest implication.
Today’s legal technology largely treats the document as the primary object. An AI-native legal platform may need to treat the document’s provenance as an equally important object.
Imagine opening a brief and being able to see that one paragraph was attorney-authored, another was generated by Claude, another was substantially revised by an attorney and a citation was independently verified.
That is far more useful than simply recording that “AI was used.” It creates a provenance history for the legal work product. That history could eventually become part of document management, quality control, client reporting, discovery, billing and professional-responsibility compliance.
In that sense, Claude’s watermark may be less important as an AI detector than as an early example of something bigger. AI-generated legal work may become traceable by design.
What lawyers should be thinking about now
The practical questions for law firms are straightforward. Which AI systems does the firm permit? Which of those systems watermark their output? Does the firm preserve important AI-generated drafts? Does the document-management system capture AI provenance? What happens to provenance information when content is copied into another system?
And perhaps most importantly, what should a lawyer do if opposing counsel claims that a filing contains AI-generated material?
The legal profession has spent the last few years asking what AI can do for lawyers.
Watermarking introduces a different question: what trace does AI leave behind when it does it? That could prove to be just as important.
A brief may look like a conventional piece of legal writing. Underneath the words, it may contain evidence about how those words came into existence.
For lawyers, AI provenance could therefore become almost as important as AI generation itself.
Sources
Anthropic, “How Claude marks AI-generated content”
https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content
The Verge, “Claude will apply invisible watermarks to AI text and images”
https://www.theverge.com/ai-artificial-intelligence/977823/anthropic-claude-ai-watermarks-c2pa-text-images
TechCrunch, “Anthropic says it will watermark text generated by its AI models”
https://techcrunch.com/2026/08/11/anthropic-says-it-will-watermark-text-generated-by-its-ai-models/
Kirchenbauer et al., “A Watermark for Large Language Models”
https://proceedings.mlr.press/v202/kirchenbauer23a.html
Kirchenbauer et al., research on watermark robustness and paraphrasing
https://arxiv.org/abs/2306.04634
American Bar Association, Formal Opinion 512, “Generative Artificial Intelligence Tools”
https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf
American Bar Association, “ABA issues first ethics guidance on a lawyer’s use of AI tools”
https://www.americanbar.org/news/abanews/aba-news-archives/2024/07/aba-issues-first-ethics-guidance-ai-tools/
European Commission, EU AI Act
https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
C2PA, Coalition for Content Provenance and Authenticity
https://c2pa.org/