ChatGPT text gets an invisible watermark in the EU
OpenAI is giving text from ChatGPT and Codex in the EU a hidden mark, so software can tell that AI wrote it. It is how OpenAI aims to meet the transparency rules of the AI Act.
What happened
OpenAI is giving text from ChatGPT and Codex in the European Union an invisible watermark. Software can use it to tell that a text came from OpenAI; readers will not notice a thing.
OpenAI announced it on 5 October. The watermark is rolling out over the coming weeks on all plans, in the EU only. Developers who use OpenAI’s models in their own software can switch it on for some of the models, anywhere in the world, but by default it is off there. It is a response to the AI Act: since 2 August, AI providers have had to mark what their systems produce so that software can recognise it as coming from AI.
The watermark, called textGrain, sits in the choice of words. Using a secret key, the model nudges hundreds of small choices in a particular direction; together they form a pattern that a detector with the same key can pick up. Because it lives in the words themselves, it survives copying. According to OpenAI, it reveals nothing about who the user is and makes no noticeable difference to quality. OpenAI developed the method with researchers from the University of Pennsylvania and Yale.
It is not watertight, as OpenAI says itself. Short passages, maths answers and translated text are hard to detect. Replace one word in ten with a synonym and detection in OpenAI’s own test falls from about 92% to 66%. And a missing watermark does not prove a human wrote the text: it may be too short, heavily edited or from another AI. For now the detector is only available to approved researchers and expert organisations.
A watermark can show that an OpenAI system generated or processed part of a passage, but not how much human judgement, editing or creativity went into it.
OpenAI on what the watermark does and does not tell you, via TechCrunch, in short
The background
How a watermark in text works
A language model picks each next word from a list of likely options. With a watermark, a secret key makes the model favour certain options slightly more often, whenever several words fit equally well. One such choice means nothing; hundreds together form a pattern.
Google was the first to do this at scale. It made SynthID-Text open source in October 2024, after a test on some 20 million Gemini answers in which users noticed no difference in quality. The weak spots were already the same: rewritten and translated text, and factual questions with only one right answer, where there is little room to choose.
OpenAI held it back before
In 2024 The Wall Street Journal reported that OpenAI already had a watermark that was 99.9% effective given enough text, but had not introduced it. In a survey, almost 30% of users said they would then use ChatGPT less, and OpenAI feared it would stigmatise the use of AI by people writing in a second language.
Anthropic went further in August 2026: all of Claude’s text gets a watermark, worldwide, because Anthropic says it has no reliable way to limit it by region. It builds on Google’s approach. Images from Claude get a signed label with provenance data.
What the law actually asks
Article 50 of the AI Act has applied since 2 August 2026. Providers must mark what their AI produces so that a machine can recognise it. A chatbot must say it is an AI. And anyone publishing AI text on matters of public interest must say so, unless a human has reviewed the text and takes responsibility for it. In June the Commission published a voluntary code of practice that asks providers to layer their marking, such as a watermark plus metadata, because no single technique is enough on its own.
Our analysis
The watermark helps with volume, not with judging a single text
OpenAI’s figures show what the watermark is good for. Allowing a 1% chance of a false alarm, the detector caught 80% of 200-word AI texts, according to OpenAI. One per cent sounds small, but out of a thousand texts that people wrote themselves, it means ten wrongly flagged. A good reason to keep the detector closed, as OpenAI is doing. Anyone hoping for an AI check on job applications or student essays will not get one.
It is easy to avoid, too. By default the mark only sits on ChatGPT and Codex text in the EU, not on text from other models, and replacing a quarter of the words brings detection down to 17%, according to OpenAI’s figures. The watermark mostly catches text from people who are not trying to hide anything. Where it does help is volume: thousands of phishing emails or fake reviews from the same source leave a strong trail together. The Dutch tech expert Bert Hubert also told the broadcaster NOS that fraud is where the watermark helps most.
What the coverage misses: through the API, the connection software uses to reach OpenAI’s models, the watermark is off by default. Our reading: if you use that API to build an AI service of your own for customers, you may count as a provider under the law yourself, and then the marking is your job. OpenAI’s watermark does not sort that out for you.
What stands out
- Length and subject both count For 400-word texts on a subject such as psychology, the detector caught 95%, according to OpenAI. For maths it was far lower, because there is less room to choose.
- The mark stops at the EU border Outside the EU, ChatGPT text carries no watermark. Anthropic chose the whole world instead, because it had no reliable way to choose by region.
- In the API it is off by default Developers can switch the watermark on for some models, but by default it is off. If you build an AI service yourself, the choice is yours.
- It sat on the shelf for two years OpenAI already had a working watermark in 2024 but did not introduce it, partly for fear that users would switch. Almost 30% said they would then use ChatGPT less.
What it means for you
AI text is becoming recognisable, but a watermark does not tell the whole story of who wrote something.
- No watermark is no proof Short, translated or edited text is hard to recognise, and text from another AI carries no mark. So never treat a detector’s verdict as evidence against someone.
- Customers must know they are dealing with AI Watermarks aside, the AI Act requires people to know when they are dealing with an AI system, such as a chatbot or an AI receptionist.
- Sometimes you say so yourself Even without a watermark, you sometimes have to label AI text as AI yourself, such as a text on matters of public interest that nobody has reviewed.
Where we come in · Advisory
We build openness about AI into our advice
When we work out with you where AI can take work off your hands, we also look at where you need to say that AI is behind it. That way your customers know where they stand.
Do your customers know when they are dealing with AI?
Tell us where you use AI. We’ll think it through with you and always reply within one working day.
