OpenAI will watermark ChatGPT text in the EU. The mark proves less than most companies will assume.

OpenAI will put an invisible watermark in text written by ChatGPT and Codex for users in the European Union. The company announced on 5 October that the mark will roll out over the coming weeks on all plans in the EU, in response to the EU AI Act’s rules on machine-readable marking of AI-generated content. Outside the EU it stays off by default: API customers anywhere can switch it on for selected models, and OpenAI says cloud partners that resell its models will get the option soon.

It is a reversal. In 2024 OpenAI shelved a text watermark it had already built, after a survey found almost 30% of users would use ChatGPT less if it were added, Search Engine Journal recalls. European law is what changed the calculation.

How OpenAI’s textGrain watermark works

The method, which OpenAI calls textGrain, nudges which words the model picks using a secret key. A reader sees ordinary text. A detector holding the key can spot the statistical pattern, and the pattern survives copy and paste. TechCrunch reports that OpenAI wrote the technical report with researchers from the University of Pennsylvania and Yale, and OpenAI says it will open-source the technique.

OpenAI claims the mark costs nothing in quality. Its benchmark table shows its latest frontier model, Astra, scoring 94.44% on the GPQA Diamond science test without the watermark and 93.94% with it, which is within normal noise.

The detector is the part most businesses will notice by its absence. Only approved researchers and expert organisations can apply to use it, case by case. OpenAI’s reason is plain: it is worried about missed watermarks and false positives. Its free tool for checking images and audio stays public; text gets no equivalent.

What OpenAI’s own numbers say about reliability

The watermark works well on untouched text and badly on edited text, and OpenAI publishes the figures itself. At a 1% false positive rate, the detector caught about 80% of 200-token passages and about 95% of 400-token passages on psychology content. Mathematics scored much lower, because there are fewer ways to word an equation.

Editing is where it falls apart. On 400-token passages, replacing 10% of the words with synonyms cut detection from about 92% to 66%. Replacing a quarter of the words left 17%. Both TechCrunch and Search Engine Journal report the same test.

An ordinary edit of a ChatGPT draft changes one word in ten without trying. So the watermark will mostly catch text pasted straight out of the chat window, which is the case where you least need a detector.

OpenAI is also unusually clear about what a positive result does not show. A watermark does not measure how much a person contributed, does not identify the user or the prompt, and does not show whether the text is accurate. A missing watermark “does not prove human authorship”, in OpenAI’s words.

Why the EU forced the issue and Anthropic went further

Article 50 of the AI Act requires providers of systems that generate text, images, audio or video to mark the output in a machine-readable, detectable way. The transparency rules started applying on 2 August, a date that did not move when Brussels delayed the high-risk rules, as covered in the AI Act’s August deadline post. Systems already on the market before August have until 2 December 2026 to meet the marking duty, and detection tools have to work across vendors from 2 February 2027, according to a Paul, Weiss summary of the Commission’s final guidance. Fines reach €15 million or 3% of global turnover, whichever is higher. The same article covers deepfakes, the problem at the centre of Europe’s case against Grok.

The Commission’s voluntary code of practice on AI-generated content fills in the details. About 190 organisations had signed it by the end of July, OpenAI among them. For text the code accepts a single marking technique, since plain text cannot carry metadata, and exempts passages under roughly 150 words.

Anthropic got there first and went wider. In August it said it would watermark Claude output worldwide, across its apps, its API and the versions sold through AWS, Google Cloud and Microsoft, because it had no reliable way to limit the mark to one region. OpenAI chose the opposite route: Europe only, with everyone else opting in. Two of the biggest model providers now give the same European customer two different answers to the same question.

That split has a practical consequence. A company with staff in Copenhagen and Toronto on the same ChatGPT plan will produce marked text in one office and unmarked text in the other. Anyone who reads “watermarked” as “written by AI” will draw the wrong conclusion about both.

What the watermark means for European businesses

Most companies are deployers under the AI Act, not providers, so the marking duty sits with OpenAI and Anthropic. Your own obligations are narrower. Under Article 50(4), a deployer that publishes AI-generated text to inform the public on matters of public interest has to disclose it, unless a responsible person has reviewed the text and taken editorial responsibility. The Commission’s guidance sets a high bar for that exception: the reviewer must be competent, a rubber stamp does not count, and the code expects a documented workflow.

That makes the review process the thing to get right, more than the watermark. A watermark can be stripped by an editor in five minutes. A record showing who checked a text, against which sources, and who signed it off is what holds up if Digitaliseringsstyrelsen, Denmark’s coordinating authority for the AI Act, or a customer asks how a piece was produced.

The bigger risk is internal. Expect HR departments, universities and procurement teams to want detectors and to treat a hit as proof. OpenAI’s own figures say a hit shows that text passed through ChatGPT at some point, and a miss shows almost nothing. A policy that disciplines staff or rejects a bid on that basis is built on a test the vendor says it should not be used for.

What to check before December

Find out which of your AI tools will mark output, and where. ChatGPT and Codex will in the EU; Claude does everywhere; the API is opt-in for OpenAI models; tools built on top of these models inherit whatever the vendor and its cloud partner do. Ask suppliers in writing, because the answer changes with region and plan.

If you publish AI-assisted text on public matters, such as reports, newsletters or customer guidance, write down the human review step now: who reviews, what they check, and where the record is kept. That is your route to the Article 50(4) exception.

If anyone in the company proposes using AI detectors to judge employees, applicants or suppliers, stop it until the policy says what a positive and a negative result can and cannot show. The vendors have already said it in writing.

And for anyone building products on OpenAI’s API for European customers, look at whether your system counts as a provider under Article 50. If it generates text for users, the December deadline may be yours as well, and switching on the opt-in watermark could be the cheapest part of the answer. The same agent features covered in OpenAI’s Dots launch will produce a lot of that text without a person in the loop.