OpenAI starts watermarking ChatGPT and Codex text in the EU

OpenAI began rolling out an invisible, machine-readable watermark to text generated by ChatGPT and Codex in the European Union, the company said in a blog post. The rollout will reach eligible users on all plans across the EU over the coming weeks, and OpenAI said it is not making text watermarking a global default at launch. The move applies only to users in the EU at first.theverge.com

The change exists to satisfy Article 50 of the EU AI Act, which mandates that providers of generative AI systems make text outputs identifiable in a machine-readable way. The transparency rules took effect on August 2, and pre-existing entities have until December 2 to comply. That deadline covers OpenAI, Anthropic, Microsoft, Google and Meta, among others. Anthropic announced similar watermarking for Claude in August, applying it worldwide.

Why the EU rule forced the change

The system, called textGrain, adds an invisible statistical signal to the model's word choices. A detector looks for that signal to assess whether a passage contains an OpenAI watermark. Because the pattern lives in the words themselves, it travels with the text when it is copied and pasted. OpenAI published a technical report co-written with researchers from the University of Pennsylvania and Yale, describing how a secret key sorts next-word predictions.

OpenAI said textGrain "matched or exceeded" other approaches like Google DeepMind's SynthID for text, which is also the basis for Anthropic's watermarking. The company said it saw no meaningful change in model performance with watermarking switched on, though its own benchmark table showed watermarked outputs scoring slightly higher on several measures, including 49.76 points versus 49.57 on the Artificial Analysis Intelligence Index.

Detection is fragile. In an evaluation of 400-token passages, replacing 10% of words with synonyms reduced detection from about 92% to 66%, and replacing 25% of words reduced it to 17%. Short passages are harder to detect, at around an 80 percent success rate, and content such as mathematics is difficult because word choice offers less flexibility. Translated text is also harder to detect.

How the watermark works

OpenAI acknowledged the watermark can produce both false negatives and false positives, and said textGrain "does not guarantee reliable detection." Because of the risk of missed watermarks and false positives, the detector will not be publicly available at launch. Approved researchers and expert organisations can apply for access starting today, granted case by case under the Code of Practice, and the tool reports only whether it detects an OpenAI watermark.

OpenAI set limits on what a watermark can prove. It said a watermark does not verify accuracy, determine who owns the text, measure how much a human contributed, or prove human authorship. The absence of a detected watermark, the company added, does not prove human authorship either, since text could be too short, too heavily edited, or generated by another company's AI.

Where detection breaks down

For API customers, watermarking is opt-in and off by default. Starting today, developers anywhere in the world can turn it on for select models, deciding how watermarking fits their transparency obligations. OpenAI is also working with cloud partners to make watermarking available for OpenAI model outputs accessed through their services in the coming weeks. The company plans to open source textGrain.

Some users objected when Anthropic announced its own watermarking. Claude users argued they had supplied "the instructions, context, decisions" while Claude was just "the tool."

OpenAI said it expects to revisit its approach as technology, standards and evidence evolve, and will keep studying how well watermarks survive editing and translation and whether they can more meaningfully distinguish AI assistance from AI authorship. The EU deadline for pre-existing generative AI providers to comply with Article 50 falls on December 2.