OpenAI Turns On Text Watermarking in the EU, but Keeps the Detector Locked Down

OpenAI says it will begin adding an invisible watermark to text generated by ChatGPT and Codex for users in the European Union over the coming weeks, its first production answer to the EU AI Act's requirement that machine-generated text be identifiable by machine. The company is simultaneously making watermarking an opt-in, off-by-default feature in its API globally, and restricting the matching detector to approved researchers and expert organizations. The most useful part of the announcement is not the launch itself but the candor about how easily the signal breaks.

What is actually shipping

OpenAI describes a three-part rollout. Starting the day of the announcement, API customers anywhere in the world can opt in to watermarked output for a set of models the company calls "select"; it did not name them. Watermarking stays off by default in the API, which means developers building on OpenAI models will carry no provenance signal unless they deliberately turn it on. Over the following weeks, eligible ChatGPT and Codex text output will be watermarked for EU users across all plans — and, OpenAI stresses, only in the EU. The company says it is not making watermarking a global default at launch, framing the regional scope as a way to learn from real-world use.

The third piece is detection. Researchers and expert organizations can apply for access starting now, granted case by case in line with the EU's Code of Practice. The tool reports only whether it finds an OpenAI watermark, and OpenAI says it does not identify the user or surface prompts or conversations. There is no public detector, and the company is explicit about why: the risk of false positives and missed watermarks is too high to put the tool in general circulation.

That is a meaningful contrast with OpenAI's image and audio provenance, which stays publicly accessible through its verify web tool and Content Provenance API. Text, the company argues, is simply a harder substrate — it can be rewritten, translated, or trimmed in ways a JPEG usually is not.

The numbers OpenAI chose to publish

The underlying method, called textGrain, embeds a statistical signal in the model's word choices; the detector looks for that signal in a passage. OpenAI says a technical report is available and will be expanded, and that it plans to release the technology in open source so others can build on it. It also claims textGrain matched or beat the other approaches it tested, including SynthID for text — a comparison run internally, with no third-party verification offered.

The fragility data is more instructive than the horse race. At a target false positive rate of 1%, OpenAI reports detecting the watermark in roughly 80% of 200-token passages and about 95% of 400-token passages for content such as psychology questions drawn from the ELI5 dataset. For mathematics — where the model has far less freedom in how it phrases things — detection was substantially lower, though the company did not publish a figure in the text.

Editing hurts more. In 400-token passages, swapping 10% of words for synonyms cut detection from about 92% to 66%. Swapping 25% dropped it to 17%. In other words, a light pass through a paraphrasing tool, or a student rewriting every fourth word, is enough to defeat the signal most of the time. OpenAI did not publish results for translation, though it says it is studying that.

Taken together, the numbers imply a system that works best on exactly the content least likely to be contested — long, discursive, unedited prose — and worst on short answers, code-adjacent or formulaic text, and anything a motivated user has touched.

The quality question

One standard objection to watermarking is that constraining a model's token choices degrades its output. OpenAI publishes a benchmark table for Astra, described as its latest frontier model, comparing watermarked and unwatermarked runs: 49.57 versus 49.76 on the Artificial Analysis Intelligence Index, 34.09% versus 34.86% on AutomationBench, 72.80% versus 71.68% on DeepSWE v1.1, 53.90% versus 56.06% on Terminal-Bench 4.0, 56.90% versus 60.00% on Terminal-Bench Science 0.1, 87.92% versus 87.35% on BrowseComp, 64.27% versus 64.60% on HealthBench Professional, and 94.44% versus 93.94% on GPQA Diamond. OpenAI's conclusion is that it sees no meaningful performance difference.

That reading is plausible — the deltas go in both directions, which is what you would expect from run-to-run variance rather than systematic degradation. But the company did not disclose the number of runs, confidence intervals, or whether the same sampling settings were used, and several watermarked scores are several points higher, which should make any reader cautious about treating the table as precise. Notably, the benchmarks are capability tests, not writing-quality or style evaluations, so they do not speak to whether watermarked prose reads differently.

What the company says a watermark cannot do

OpenAI devotes a long section to disclaimers, and they are worth repeating because they cut against how detection tools tend to get used in practice. A watermark, the company says, does not measure how much of a passage a human wrote, does not establish ownership or legal responsibility, does not identify the user, account, or prompt, and does not say anything about whether the text is accurate. Crucially, the absence of a watermark does not prove human authorship: the text may be too short, edited, or translated, may come from an unsupported model, may predate the rollout, or may come from a different vendor entirely.

That last point is the structural limit of any single-vendor scheme. A per-provider watermark can only ever answer "did this specific company's system touch this text," and only for models and time windows that the company chose to cover. Universal AI-text detection is not on offer here, and OpenAI does not claim otherwise.

The company positions text watermarking inside a layered provenance stack: C2PA Content Credentials on supported images, invisible SynthID watermarks in supported images and audio, and public verification tooling for both — paired with policy enforcement, abuse detection, and investigations.

The trade-offs worth naming

Three tensions sit under this announcement. First, regulatory fragmentation: EU users get a default-on watermark that users elsewhere do not, which produces a measurable gap in coverage and raises the question of whether OpenAI will globalize the default or wait for other jurisdictions to compel it. Second, the API's off-by-default posture means a large share of OpenAI-generated text in the wild — everything flowing through third-party products — remains unmarked unless each developer opts in. OpenAI frames this as letting customers match their own transparency obligations; it also conveniently avoids breaking downstream applications. Third, open-sourcing the technology invites scrutiny and ecosystem adoption, but publishing details of how a statistical watermark is embedded has historically made it easier to strip. OpenAI does not address that tension in the post, and it did not say what, if anything, will remain private.

For product teams, the practical takeaway is narrow: if you operate in the EU and your users generate text through OpenAI models, provenance is about to become a property of your output whether or not you planned for it, and there is no public tool to check what it says.

What to watch

• Whether OpenAI expands detector access beyond vetted researchers, and on what evidence threshold — a public detector with a 17% catch rate on lightly edited text would be actively harmful in education and hiring contexts.
• The scope of the open-source release: full embedding method, detector, or model-specific keys, and what that implies for watermark removal.
• Whether the API default flips from off to on, globally or in additional jurisdictions, and whether cloud partners reselling OpenAI models expose the same control.
• Independent replication of the claim that textGrain matches or exceeds SynthID for text, which currently rests on OpenAI's own evaluations.
• Translation robustness, which OpenAI flags as an open problem but did not quantify — a likely weak point for a word-choice-based signal.
• Whether EU regulators treat a watermark this brittle as satisfying the AI Act's machine-readability requirement, or push for stronger guarantees.