Approximate reading time: 10 minutes. Last updated September 26, 2026.
AI is watermarking your code and content: Is that a problem for Federal Government contractors?
Two things happened this year that have gotten tangled together in a lot of conference rooms.
The first is that the Department of War declared Anthropic a supply chain risk and told defense contractors to get Claude out of their contract work. The second is that on August 14, 2026, Anthropic switched on an invisible watermark in text written by Claude.
Put those next to each other and a rumor writes itself: the government does not want anyone using Claude, and now the government can tell if you did. I have heard versions of this from people at several firms, usually arriving as "we're not allowed to use Anthropic," full stop, with no contract number attached and no clause cited.
That version is wrong, and the gap between it and the actual record is wide enough to cost a company real productivity. Here is what is actually true, with citations you can forward.
The short version
No statute, regulation, contract clause, or court order prohibits a company from using Claude to write a proposal. Pre-award business development is not contract performance, and the restriction that exists reaches contract performance.
The binding restriction that remains in force today applies to the performance of Department of War contracts. It does not reach civilian agency contracts, it does not reach commercial work, and it does not reach a company's own internal operations.
The presidential directive that told the whole government to stop using Anthropic, and the secondary boycott that told military contractors to cut commercial ties, were both ruled unlawful and vacated by a federal judge on August 27, 2026. (See 25 Sep 2026 update at the end of this article).
The watermark is a European transparency requirement, not an American enforcement tool. It carries no information about you, your company, or your account, and there is no public detector for text.
Everything below is the support for those four statements. None of it is legal advice, and the situation has moved roughly monthly all year, so check the dates.
What people heard, and what the record says
The rumor is not invented out of nothing. Every piece of it traces back to something that really happened. The problem is that most of those things have since been narrowed, enjoined, or struck down, and the rumor kept the original shape.
What happened in February. Anthropic's usage policy bars two things: fully autonomous weapons and mass domestic surveillance of Americans. The Department of War pushed to have those lifted for its programs. Anthropic refused. On February 27 the company said, "We support all lawful uses of AI for national security aside from the two narrow exceptions above," and, "no amount of intimidation... will change our position."
That day, President Trump directed all federal agencies to "immediately cease" using Anthropic technology, with a six-month phase-out for agencies already running it. Secretary Hegseth announced a supply chain risk designation, the first ever applied to an American company, and directed that contractors doing business with the U.S. military stop doing business with Anthropic.
This is the moment when almost everyone's mental model froze. The headlines that week said the government banned Anthropic, and for about a month that was close enough to true.
What happened after. The designation went out in March under two separate statutes, and that split is the single most important fact for a contractor to understand.
One is 10 U.S.C. § 3252, a DoW authority implemented through DFARS 252.239-7017 and 7018, covering defense procurements involving national security systems. The other is the Federal Acquisition Supply Chain Security Act, 41 U.S.C. § 4713, implemented through FAR 52.204-28, -29 and -30. FASCSA can in principle reach the entire federal government, but as invoked against Anthropic it applies only to DoW contracts.
Anthropic sued on both tracks. Judge Rita Lin in the Northern District of California enjoined the § 3252 designation on March 26. The D.C. Circuit, which reviews FASCSA designations directly, declined to stay that one in April, heard argument May 19, and has not ruled.
On August 27, Judge Lin granted Anthropic summary judgment on the § 3252 track, finding First Amendment retaliation, a due process violation, and arbitrary and capricious agency action. She vacated the designation and the presidential directive, including the broad prohibition on any business with Anthropic whether government-related or not. The quote that traveled: "The empty invocation of national security is not a blank check to punish and retaliate against government critics."
Where it stands today. The FASCSA designation was not before Judge Lin and remains in effect for DoW contracts. On September 2, Commerce Secretary Howard Lutnick told Axios, "We trust Anthropic. They've done what we asked. They're back on the right side." On September 3, Under Secretary of War Emil Michael posted: "Anthropic is still a designated Supply Chain Risk at @DeptofWar and for the Defense Industrial Base." Michael says removal from DoW systems finishes at the end of September; the Air Force Research Laboratory told its contractors to purge Anthropic products by September 1, ahead of a department-wide September 29 date.
So one narrow restriction survives, on one department's contract performance, pending a D.C. Circuit ruling. The sweeping version that lives in people's memory does not.
Why the rumor is sticky
Three real things keep it alive, and it is worth naming them so you can tell them apart from the legal question.
Civilian agencies made their own calls, and several of them dropped Claude. In the spring, nine agencies announced they would stop using it: GSA, State, HHS, Treasury, FHFA, OPM, NASA, the International Trade Administration and the Secret Service. GSA pulled Anthropic from the Multiple Award Schedule and the OneGov program, then restored the MAS listing after the injunction. When your customer removes a tool from its own environment, that is a fact about your customer's environment, not a rule that binds your back office. Other agencies went the other way: the Department of Energy's top IT official said "everybody wants" Claude, and SAM.gov shows the FCC signing Claude delivery orders through Carahsoft in May and July of this year.
Certification forms are arriving that ask far more than the law requires. Mayer Brown documents questionnaires asking whether any deliverable is "powered by or integrated with Anthropic technology," whether subcontractors use it, and whether the company plans to adopt it in the future, many of them invoking the False Statements Act, 18 U.S.C. § 1001. Primes are writing their own language and flowing it down. A subcontractor who receives one of these reasonably concludes that somebody somewhere has banned the tool outright.
And some companies chose blanket avoidance as a business decision. That is a defensible risk posture for a firm whose revenue is mostly DoW, and it is not the same thing as a prohibition. The trouble starts when one company's risk posture gets repeated down the hall as a rule of law.
The watermark, and why it is not what people fear
Now the second half of the tangle. A number of people have quietly connected the watermark to the enforcement question, on the theory that a contracting officer will one day run a document through a scanner and find Claude's fingerprints on it.
That theory misunderstands what the watermark is, what it can reveal, and who can read it.
What it is. An AI text watermark is a statistical pattern hidden in word choice, with no visible label, no hidden character, and no strippable metadata involved. Anthropic's technical explainer describes the mechanism: when a model writes, it constantly picks among several words that would all work equally well, and that pick is normally random. With watermarking, "instead of using an arbitrary random number generator to pick the next word, watermarking uses the key and a few words that come before to settle what word the model should pick." Their analogy is a Monopoly game where players roll digits of pi instead of dice. The moves look random at the table; anyone who knows the trick can verify afterward.
The method is Google DeepMind's SynthID-Text, which Gemini has used since 2024 and which Anthropic adopted for Claude. It only works where there is a genuine choice, which means factual passages carry less of it and code carries almost none. Anthropic says code "has generally less watermarking than some other forms of text," and that when Claude lightly edits a human draft there may be too few Claude-made choices to detect anything.
For generated files rather than text, Claude attaches a signed provenance note using the C2PA Content Credentials standard, the same one used by camera manufacturers and Adobe, on PNG, JPG and SVG output.
Coverage is broad and there is no opt-out: the API, the Claude apps, Claude Code, Claude Cowork and Claude Tag, worldwide, including access through AWS Bedrock, Google Cloud and Microsoft Foundry. One timing caveat: marking is on by default only for models launched on or after August 2, 2026, with older models being retrofitted over the coming months.
Why it exists. Article 50 of the EU AI Act took effect August 2, 2026. Anthropic, Google, OpenAI and roughly 190 other organizations signed the EU Code of Practice on Transparency of AI-Generated Content in July, committing to machine-readable marking and detection tooling. Anthropic applied it globally rather than only in Europe because it does not yet have "a durable way to scope it by region." Nothing in the public record connects the watermark to the Department of War dispute.
What it can reveal. This is where the fear collapses. Anthropic's statement is specific: "The watermarking applies to Claude and its outputs. It doesn't identify anything to do with individual users. There's nothing in the watermark, or its key, that would allow anyone to recover any information about the user, their organization, or their chats with Claude."
A positive result establishes "the likelihood that Claude was involved in writing the text," and cannot "distinguish 'Claude wrote this' from 'Claude heavily edited this.'" A negative result establishes very little, since per the help center, "lack of a detected mark doesn't mean the content wasn't AI-generated."
So the mark answers one question, whether Claude was probably involved somewhere in a passage, and stays silent on which company, which person, which contract, and which date.
Who can read it. There is no public Claude text detector. Reading the text watermark requires Anthropic's secret key, so it happens only through Anthropic, and the detection API is in private preview for the categories EU law obliges the company to serve: regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, EU civil society groups, and enterprises verifying their own compliance. Everyone else can register interest.
File provenance is the exception, because C2PA credentials are signed metadata anyone can inspect. Anthropic's free Claude Content Checker takes an image, video or audio file and reports whether a credential is present, processing in your browser. The vendor-neutral Content Credentials Verify does the same for any C2PA file.
The practical upshot for a contractor: no contracting officer can run your proposal through a tool and learn it came from Claude. What can create exposure is not detection. It is a signature on a certification that your own records do not support.
Can the watermark be gamed?
Yes, and everyone involved says so.
Anthropic's own guidance: "Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will." Independent work goes further. A September 2026 paper, Watermarks Without Verification, found that paraphrase attacks substantially reduce detectability, that "the watermark does not survive translation," and that detection on code "remains near chance." Its broader complaint is that no vendor has published matched outputs or scored detectors, so "neither the objections nor the assurances can currently be verified."
C2PA metadata is weaker still, disappearing through re-saves, screenshots, format conversion, and platform uploads that rewrite metadata. A stripping tool was circulating within days of the rollout.
I mention this not as a technique but because it clarifies what the watermark is for. A mark that paraphrasing defeats is a transparency signal for people acting in good faith, not a control that catches people who are not.
What the other providers do
Google has had SynthID-Text in Gemini since 2024 and marks images, audio and video with the same family. Its SynthID Detector portal is waitlisted, journalists and researchers first, and reads marks from Google's generators plus partners including OpenAI images, Nvidia, Kakao and ElevenLabs.
OpenAI built a text watermark in 2024 and chose not to ship it, citing weakness against translation and rival-model laundering, and concern that it "could disproportionately affect some groups, including non-native English speakers who use AI as a writing aid." It does apply C2PA credentials and SynthID marks to generated images and audio, with a public verification tool for those.
Meta labels AI content across Facebook, Instagram and Threads using C2PA and IPTC metadata plus its own marks, noting that "not all AI-generated media can be detected, and some signals can be removed."
Across vendors, images and audio are increasingly marked and checkable; text is marked by Google and Anthropic only; and nobody offers public text detection.
If your compliance plan is "switch to a model that does not watermark," understand what that buys you. The DoW restriction runs to the vendor relationship and to what you certify, not to whether the output can be detected. Swapping tools to become undetectable while certifying something untrue solves nothing.
Contractors who do not work with the Department of War
No clause applies. FASCSA "can apply government-wide, but as invoked against Anthropic, it currently applies only to DoW contracts." Federal News Network reports the same: commercial work and civilian agency contracts are unaffected. As one contracts attorney put it there, "you're not supposed to be using anthropic in performance of Department of War, Department of Defense contracts," and that is the extent of it.
What may still apply is your customer's own policy. A civilian agency that removed Claude from its environment can reasonably expect you not to bring it into that environment. Read the contract, ask the contracting officer in writing, and do not volunteer certifications nobody requested.
Companies with no government work
Nothing here touches them. Goodwin's alert is flat about it: "neither statute provides a mechanism for the Trump administration to prevent the use of Claude or any other Anthropic AI tool by a company for its own internal use." Anthropic told customers their access "is completely unaffected" outside DoW contracts, and Dario Amodei stated the designation "applies only to the use of Claude by customers as a direct part of contracts with the Department of War, not all use of Claude by customers who have such contracts."
The watermark applies to everyone, as a transparency measure that identifies no one.
Activity by activity: what is in bounds
The operative language in FAR 52.204-30 is use of a designated product "as part of the performance" of a covered contract, with obligations to make reasonable inquiry, monitor, and report covered use to the contracting officer within three business days. Nobody has published an authoritative taxonomy, so the honest approach is the three buckets that A&O Shearman and Mayer Brown both use: direct contract performance, business systems that support federal work, and commercial-only use.
Writing proposals with AI. In bounds, including for DoW opportunities. A proposal is pre-award business development, not performance of a contract that does not yet exist, and it falls squarely inside the internal use that Goodwin says no statute reaches. The live risk is not the drafting. It is the certification form that asks whether your company uses Anthropic anywhere, under penalty of 18 U.S.C. § 1001. Answer that one accurately.
Taking meeting notes with AI. In bounds for internal meetings. Treat notes from a DoW program meeting as performance if they become a deliverable or land in a DoW system, and use a different tool. Where controlled information is in the room, your data handling rules govern before the vendor question does.
Writing code with AI. The government told Judge Lin's court that § 3252 would not bar a DoW contractor from using Claude Code under a general license as a tool to write software. A&O Shearman warns the broader FASCSA framework "could capture such uses." Assume out of bounds for DoW deliverable code until a contracting officer says otherwise in writing. In bounds for civilian and commercial code. The watermark is close to irrelevant here, since code carries almost no mark; the certification is not.
Testing software with AI. Same analysis as code. Test plans and scripts for a DoW deliverable are performance. QA on a civilian agency site is unrestricted by any current clause.
Penetration testing with AI. Two gates, and they are independent. First, Anthropic's Usage Policy prohibits using Claude to "discover or exploit vulnerabilities in systems, networks, or applications without authorization of the system owner," which makes authorized, scoped, written-consent testing permissible and everything else not. The policy also notes Anthropic "may enter into contracts with certain governmental customers that tailor use restrictions to that customer's public mission and legal authorities." Second, if the target or the engagement sits under a DoW contract, FASCSA applies no matter how well authorized the test is. In bounds commercially and for civilian agencies; out of bounds on DoW work.
How to check whether something was produced by AI
For files, upload to the Claude Content Checker at claude.com/check-files, or to Content Credentials Verify for any vendor. A credential present means the file passed through a signing tool. A credential absent means almost nothing.
For text, there is no public Claude detector. Commercial classifiers like Pangram, GPTZero and Turnitin read writing patterns rather than watermarks, and they produce both false positives and false negatives; do not build a personnel or compliance decision on one. Watermark-based detection for Claude text runs only through Anthropic's private preview, and Google's SynthID Detector is waitlisted.
If the question is whether your own deliverables contain AI-generated text, an inventory of who used which tool on which work will serve you far better than any detector will.
What to do this quarter
Tell your team the actual rule, in one sentence, before the rumor sets: Claude is fine for proposals, internal work, commercial work and civilian agency work, and stays out of Department of War contract performance until the D.C. Circuit says otherwise.
One caveat: If your customer tells you not to use Claude or Anthropic topics, ask why. Make sure they are not making decisions based on fear and rumors. Ensure their directive is based on an official policy statement, not hearsay or hyperbole.
Then do the unglamorous part. Take an inventory of Claude's use across the three buckets, contract by contract, and write it down. Check your DoW contracts for DFARS 252.239-7018 and FAR 52.204-29 and -30, because those clauses define your obligation and press coverage does not. Answer certification requests at the scope of the specific contract and legal basis cited, and ask the sender to identify both when they have not. Decline to certify a company-wide absence of Anthropic products you have not actually verified. If removal is required somewhere, document the cost and schedule impact and preserve your right to an equitable adjustment. Watch the D.C. Circuit and watch September 29.
The watermark, in the end, is a footnote to all of this. It tells an authorized party that Claude was probably involved in a passage of text, and it carries nothing about who was at the keyboard. The thing that can actually hurt a contractor is a signature on a form that the inventory does not support. As one contract attorney told the Federal News Network, "honesty is always the best policy when you're dealing with the federal government."
25 Sep 2026 Update
A federal appeals court ruled on Friday, September 25, 2026, that the Pentagon can legally blacklist and designate artificial intelligence company Anthropic as a national security supply chain risk.
Background of the Dispute
- The Conflict: Negotiations broke down between the Department of Defense and Anthropic after the AI startup refused to remove safety guardrails that blocked its Claude AI models from being used for fully autonomous lethal weapons or mass domestic surveillance.
- The Ultimatum: Defense Secretary Pete Hegseth gave Anthropic CEO Dario Amodei a deadline in February 2026 to allow unrestricted military use, which the company declined.
- The Ban: President Donald Trump directed federal agencies to stop using Anthropic's technology, and Hegseth labeled the firm a supply chain risk, barring military contractors from doing business with the company.
Legal Battle and Appeals Court Ruling
- The Decision: In a 2-1 decision, the U.S. Court of Appeals for the D.C. Circuit upheld the Pentagon's blacklisting, with Judge Gregory Katsas writing that the Department of Defense had "ample support" to worry that Anthropic's safety restrictions and potential model refusals could compromise military readiness or cause operations to fail.
- Dissent and Parallel Rulings: Judge Karen LeCraft Henderson dissented in the D.C. Circuit case, arguing the law doesn't treat upfront safety enforcements as a valid supply-chain risk. Meanwhile, a separate federal judge in San Francisco previously struck down a parallel designation and blocked the government-wide ban, noting evidence of unlawful retaliation for Anthropic's public criticism.
- Current Status: Anthropic stated it respectfully disagrees with the D.C. Circuit panel's ruling and is weighing its legal options, including a potential review by the full appeals court.
Sources
- Anthropic, How Claude's text watermarking works, August 14, 2026
- Claude Help Center, How Claude marks AI-generated content
- TechCrunch, Anthropic shares more details about how Claude's new watermarks will work, August 15, 2026
- Anthropic, Statement on the comments from Secretary of War Pete Hegseth, February 27, 2026
- Anthropic, Where things stand with the Department of War, March 5, 2026
- Defense One, Trump directs government to "immediately cease" using Anthropic technology, February 2026
- Mayer Brown, DoW's Anthropic Ban Goes Live: A Confusing Patchwork of Certification Demands for Contractors, July 2026
- A&O Shearman, DoW and Anthropic showdown continues, March 2026
- Goodwin, Is Claude a Supply Chain Risk? What Federal Contractors Need to Know, March 2026
- Wiley, Developments in Anthropic Challenges to Department of War Supply Chain Risk Designation, April 6, 2026
- Nextgov/FCW, Judge rules Anthropic supply chain risk designation was "illegal and baseless", August 28, 2026
- National Law Review, National Security Is "Not a Blank Check", September 3, 2026
- Axios, Top Pentagon official reaffirms Anthropic blacklist despite Lutnick comments, September 3, 2026
- Breaking Defense, Air Force pushing contractors to purge Anthropic by Sept. 1, July 2026
- Federal News Network, Contractors trying to comply with the Pentagon's Anthropic restrictions are running into an unexpected problem, August 2026
- Center for Democracy and Technology, What the Pentagon-Anthropic Dispute Means for Civilian Agencies, May 12, 2026
- FedScoop, Anthropic faces different government responses as Pentagon battle continues, September 4, 2026
- Morrison Foerster, Organizations Sign EU Code of Practice on AI Transparency, September 9, 2026
- arXiv, Watermarks Without Verification: AI Text Watermarking After the EU AI Act, September 2026
- Google, SynthID Detector
- Layer3 Labs, Does ChatGPT have a watermark?, August 2026
- EyeSift, AI watermark detection 2026: C2PA vs SynthID vs metadata, June 2026
- Anthropic, Usage Policy
- iTech Post, Anthropic's Claude Content Checker Tool Is Now Available, September 2, 2026
- CNN, Federal appeals court rules Pentagon’s blacklist of Anthropic was legal, September 25, 2025
- CNBC, U.S. appeals court upholds Pentagon designation of Anthropic as supply chain risk, September 25, 2025