OpenAI watermarks text, by default only where the law requires it

The announcement came on 5 October 2026, and the framework is Article 50 of the AI Act, EU Regulation 2024/1689, which since 2 August 2026 has required providers of generative AI to mark synthetic content in a machine-readable format. OpenAI wrote on its Developer Community that it will embed an invisible watermark in text produced by ChatGPT and Codex, arriving in the coming weeks for eligible users on all plans — and only in the European Union. On the API the choice runs the other way: customers anywhere in the world can turn it on right away for some models, but the feature is off by default and, according to the company, will not become a global default at launch. Until now watermarks had mostly concerned images and video; text is more hostile ground, because rewriting or translating is enough to weaken the signal, and in some cases to erase it.

The technique is called textGrain, and it adds no hidden characters, invisible spaces or odd punctuation: according to the help centre and the technical report, it statistically shifts the choice of tokens while the model generates. That report, dated 5 October, carries nine names — five from OpenAI (Arzav Jain, Florent Joly, Mike Lam, Qingquan Song, and Weijie Su as corresponding author) and four academics from the University of Pennsylvania (Xiang Li, Qi Long) and Yale (Garrett Wen, Xiaohong Chen). The method applies optimal transport to blocks of the vocabulary and introduces a 'budget' that caps how much sampling randomness can be given up to obtain the signal: a declared trade-off, not a side effect discovered afterwards. Checking a text requires only the text and the secret key, but the report also notes that the theoretical false-positive rate holds under idealised assumptions, and that a fixed key in production calls for empirical calibration checks (section 3.2).

The numbers show how fragile the signal is, and they come with a caveat: I couldn't check them against OpenAI's original post, only through the outlets that report them. On 400-token passages the watermark is detected in about 92% of cases, according to OpenAI figures cited by 9to5Mac and ActuIA; replacing 10% of the words with synonyms brings that down to 66%, and replacing 25% brings it to 17%. ActuIA adds that the measurements use a 1% false-positive threshold, that 200-token passages reach about 80% and mathematical content about 60%; across the 24 official EU languages, detection ranges from 42.2% for Romanian to 69.0% for Spanish. I couldn't find the figure for Italian. OpenAI states the limits plainly — short texts, domains with little lexical freedom, translations and extensive paraphrasing all lower detectability — and makes clear that the watermark does not identify the user, does not measure human contribution, does not establish ownership and does not say whether the text is accurate. 'The absence of a detected watermark does not prove human authorship,' the announcement reads.

At first the detector will go only to 'approved researchers and expert organizations', and applications are open; ActuIA names Cornell, ETH Zurich and the Slovak institute KInIT among the first partners. The company justifies keeping it closed with precisely those technical limits: 'These limitations contribute to our decision to provide initial detector access only to approved researchers and expert organizations.' It has also said it plans to release textGrain as open source, without saying when. We don't know which API models are covered, nor the activation date in the EU, nor the criteria for detector access; and there are no independent assessments of its effectiveness yet.

What stays with me is the geography of the choice. The same text, written by the same model, will carry a signal if the person writing is in the European Union and won't carry one anywhere else: the provenance of content becomes a function of jurisdiction, not a property of the content. It's a legitimate reading of an obligation that applies within one territory, and on the API the whole world can turn it on if it wants to. But anyone who receives a text without a watermark will still know nothing — and with detection at 42% in Romanian (ActuIA's figure, at a 1% false-positive threshold) and a signal that drops to 17% once a quarter of the words are swapped for synonyms, even those who hold the key will know less than the word 'watermark' leads you to hope.

— Olya