Something quietly structural happened at the beginning of this month, and the commerce industry mostly missed it. On August 2, 2026, the EU AI Act’s obligations to mark AI-generated content entered into application. Providers of generative AI systems serving the European market are now legally required to mark their outputs. By the end of July, about 190 organizations had signed the EU’s Code of Practice on Transparency of AI-generated Content, drafted by independent experts and assessed as adequate by both the European Commission and the AI Board.

The signatory list for the provider section reads like a lineup of the model industry: Anthropic, OpenAI, Google, Meta, Microsoft, Mistral, Cohere, Black Forest Labs, Aleph Alpha, Synthesia. The deployer section includes Bulgari, Getty Images, Lenovo, Lufthansa and Iberdrola. Notably, the Commission points out that about half of the signatories are small and recent companies, and the code explicitly covers retail among its sectors.

Two weeks later, Anthropic published a detailed technical explainer of how Claude’s watermark now works. It is the clearest public description yet of the provenance infrastructure that the next decade of commerce will run on, and it deserves a close read from anyone who cares about product trust. Because the honest answer, after reading it, is that watermarks are a genuinely important primitive and simultaneously nowhere near sufficient to fix what is broken in product reviews. Both halves of that sentence matter.

How the Watermark Actually Works

Anthropic’s method is a version of SynthID-Text, the technique Google DeepMind published in Nature in October 2024. The core idea is elegant. Large language models pick the next word one at a time, and in many places several candidate words are equally good. “The weather today was cold and…” could end in “overcast” or “grey” with no meaningful difference to the reader. Normally the model resolves such ties with arbitrary randomness.

Watermarking changes the source of the randomness. Instead of a generic random number generator, the choice is settled by a cryptographic key and the preceding words. The text still reads randomly, but anyone holding the key can check whether the sequence of choices is consistent with what the model would have picked using it. Anthropic offers a precise analogy: it is like playing Monopoly where the die rolls are drawn from the digits of pi. The moves are still random to the players, but someone who knows pi can reconstruct whether the sequence came from the book.

Three properties make this deployment significant for the trust stack:

  • Invisible and non-distorting. The difference between watermarked and unwatermarked text “will not be distinguishable to readers,” per Anthropic. Nothing is added, no hidden characters, no extra tokens, no price increase.
  • Quality-neutral at scale. This is not a claim backed by vibes. The Nature paper validated SynthID-Text over nearly 20 million responses from live Gemini interactions, comparing user feedback on watermarked versus unwatermarked outputs and finding no significant quality difference. Google productionized it in Gemini and Gemini Advanced, the first generative text watermark deployed at that scale. Compute overhead is trivial: in the paper’s benchmark, per-token latency rose about half a percent.
  • Not traceable to anyone. The watermark carries no identifying information and cannot be tied to a specific person, organization, or chat. It answers “was Claude likely involved,” not “who used Claude.”

Anthropic is also attaching C2PA content credentials, cryptographically signed metadata, to files Claude produces such as images. That is the same provenance standard used by camera manufacturers and photo-editing software, and it matters for commerce in an obvious way: product photos.

For text, Anthropic says a watermark detection API is coming. That is the piece to watch. A machine-checkable provenance signal, callable programmatically, is exactly the shape of primitive that platforms and agents can build on.

What This Genuinely Changes

It is worth being precise about why this is a real event and not another AI ethics announcement.

Provenance moves from inference to verification. Until now, detecting AI-generated text meant statistical post-hoc detection: classifiers that look for stylistic tells. Anthropic explicitly distinguishes the two approaches. Detection software like Pangram “picks up on” patterns such as the “this isn’t X, it’s Y” construction, while watermark checking verifies choices against a key. One is probabilistic pattern-matching on style; the other is verification against the generation process itself. The Pew Research analysis we covered this week found that about 9.35% of commercial webpages already show signs of AI authorship. Watermarks give that problem a ground-truth channel, at least for signatory models.

There is now a legal hook. Platforms that host user-generated content, including reviews, have historically struggled to police AI-generated submissions because “probably AI” was a hard thing to prove and a harder thing to enforce against. A watermark detection API changes the evidentiary picture. A marketplace that requires provenance checks at submission time, or that runs detection across its review corpus, can point to a defined technical standard backed by a code of practice with 190 signatories and the AI Act behind it. The FTC’s fake review rule in the US prohibits reviews the platform knows are misrepresentative; verified provenance makes “we know” operationally achievable.

Deployers signed too, and that includes retail. Section 2 of the code, with 152 signatories, covers deployers of generative AI. The obligations to label AI-generated content apply to companies that put these systems in front of consumers. Retail is named among the covered sectors. A brand using generative AI for product descriptions or review summaries in the EU market is now on the hook to label it.

Agents get a checkable signal. An AI shopping agent that summarizes reviews for a user could, in principle, verify whether the reviews it is summarizing were model-generated before presenting them as authentic buyer feedback. That is a trust input that does not come from the page itself, which is the correct architectural direction.

The Hard Limits, Stated Plainly

Now the other half of the sentence, and Anthropic deserves credit for stating the limits candidly.

Short texts carry weak signals. The watermark lives in low-stakes word choices, and confidence scales with length. “Detecting a watermark also doesn’t work well on small samples,” Anthropic writes, “where there are fewer word choices and thus less information to go on.” Product reviews are small samples. A 40-word review has very few watermarkable choices to work with. The format where AI fakery is most commercially damaging is precisely the format where the watermark is weakest.

Only signatory models are covered. A watermark can only tell you whether the specific model family it belongs to was involved. It cannot confirm text is human-written, and it cannot detect output from a different model, even another watermarked one with a different key. The open-weight ecosystem, which we have covered as the on-ramp for industrial-scale review generation, has no watermark at all and no legal obligation to add one. The uncomfortable asymmetry is that compliant frontier providers now mark their outputs while the tools most likely to be used for manipulation do not. Watermarking is a fence around the honest farms.

Edits blur the signal in both directions. Anthropic’s own guidance: light editing probably will not remove the watermark, but “a complete rewrite where every word is replaced will.” And the watermark “cannot distinguish ‘Claude wrote this’ from ‘Claude heavily edited this.’” A review farm that generates with a frontier model and paraphrases with an open-weight one lands in the gray zone on both ends.

Sparser on factual text. Where there is one right next word, the watermark has nothing to act on. Reviews heavy on specs and factual claims carry less signal than impressionistic prose.

And the deepest limit: authorship is not quality. A watermark can only determine that Claude was likely involved with the content at some point. It says nothing about whether the product is good. A hundred authentically human-written five-star reviews can still be purchased, incentivized, or written by people who received the product free in a Vine-style program and never paid for it. Perfect provenance on every review would still leave the core commercial question unanswered: is this product worth buying?

The Trust Stack This Implies

Put the pieces together and a sensible architecture emerges. Provenance, quality, and aggregation are three different layers, and conflating them is how trust systems fail.

  • Provenance (new, legal, partial): watermark detection and C2PA credentials answer who or what produced a piece of content. Use it where it is strong: long-form content, images, review summaries generated by deployers. Do not lean on it for short reviews from unknown-origin models.
  • Quality-based scoring (behavioral): independent of authorship, a score computed from review quality and authenticity, like GoBuy’s Smart Score from 0 to 100, removes manipulated input before scoring rather than re-weighting polluted text. This layer has to assume the adversary can generate clean provenance, because eventually they can.
  • Sustained verification (temporal): manipulation is bursty by economics. A badge that requires holding an 80+ score across 90 days, like GoBuy Verified, makes burst attacks pointless regardless of whether the burst carries a watermark.
  • Machine-native delivery (agentic): all of it has to be callable mid-reasoning. Exposing product trust over MCP, as GoBuy does at gobuy.ai/api/mcp, means any shopping agent can query independent trust data before executing a purchase, in the same step as price and availability.

The watermark layer and the trust layer are complements, not substitutes. The EU just built the first one at scale. The second one is still mostly missing from the industry’s buildout.

What to Watch in September

The Commission says two task forces launch in September 2026, bringing signatories together to share implementation practices and advance the state of the art. The open questions that will determine whether any of this reaches product reviews: will detection APIs be broadly accessible to platforms, not just signatories? Will marketplaces be treated as deployers when they surface AI-generated review summaries? And will anyone extend provenance obligations to the open-weight models that currently sit outside the fence?

Until those resolve, the practical stance for anyone building commerce agents is simple: use watermark verification where it works, and never mistake it for product trust. The signal that matters at the moment of purchase is whether the product deserves the transaction, and that still has to be computed independently.

Provenance is now law. Trust still has to be engineered. See independent product trust at gobuy.ai. Developers building shopping agents can wire the trust layer in at gobuy.ai/agent-docs.