OpenAI Will Invisibly Watermark ChatGPT and Codex Text -- But Only for Users in the EU

OpenAI said on Oct. 5 it will start invisibly watermarking the text ChatGPT and Codex generate for users in the European Union, rolling the change out over the coming weeks across every plan tier. API developers anywhere in the world can turn the same feature on today, but it ships off by default outside the EU rollout -- a narrower, slower posture than the one Anthropic took two months earlier, when it switched on an equivalent watermark for every Claude user globally, with no way to opt out.

The method, which OpenAI calls textGrain, doesn't attach a visible mark or a hidden character string. It works by subtly reshaping which words the model reaches for at each step -- a statistical pattern invisible to a reader but recoverable by a detector holding the right key. Because the signal lives in the word choices themselves rather than in metadata, it survives copy-paste, reformatting and moving text between documents. OpenAI co-authored the underlying technical report with researchers at the University of Pennsylvania and Yale.

OpenAI's own testing shows how fragile that signal is once a human -- or another AI -- starts editing. On an unedited passage of around 400 tokens, the detector catches the watermark roughly 92% of the time. Replace just one word in ten with a synonym, and detection falls to 66%. Replace one in four, and it falls to 17%. Short answers, math questions and translated text detect worse still, because there are fewer word-choice options for the pattern to hide inside.

Those figures are also tuned to a specific false-positive target, which is its own trade-off: OpenAI's report sets detection to flag at most 1% of human-written text as watermarked, and at that bar, shorter passages suffer the most -- a roughly 200-token response scored around 80% detection in testing, against roughly 95% for a 400-token one. A detector tuned to catch more watermarked text would also start flagging more text no AI ever touched, which is the real reason OpenAI can't just turn the sensitivity up to compensate for editing.

OpenAI is explicit about the limits of what a positive match actually means: a detected watermark shows that an OpenAI system generated or processed part of a passage, not that a human contributed nothing to it. Running an email you wrote yourself through ChatGPT for a grammar pass can leave the same signature as asking it to write the email from scratch -- the mark measures contact with the system, not authorship.

The trigger is the same one that pushed Anthropic to act in August: Article 50 of the EU AI Act, whose transparency rules took effect Aug. 2, 2026 and require providers of general-purpose AI systems to mark synthetic content in a machine-detectable way. Anthropic answered that deadline by flipping its watermark on everywhere Claude is offered, for every user, with no opt-out. OpenAI chose the narrower path: EU default-on, API opt-in everywhere else, off unless a developer flips the switch.

Put plainly, the two approaches answer the same regulatory question with different bets about what a reader is owed. Anthropic's bet is that transparency shouldn't depend on where someone is logged in from, even if that means marking plenty of text no regulator required it to mark. OpenAI's bet is that a feature this easy to defeat with light editing isn't worth forcing on every user by default -- meet the legal floor precisely where the law applies, and let anyone else opt in. Neither bet makes the underlying tool more durable: a quarter of synonyms swapped out beats either company's watermark just the same.

This isn't a capability OpenAI just built. Reporting dating back to 2024 described an accurate ChatGPT text detector the company had sat on for roughly two years without releasing it, and a Wall Street Journal survey cited in that reporting found 69% of ChatGPT users feared a watermark would be unreliable and cause false accusations, while 30% said they would switch to a rival AI product if one shipped. An OpenAI spokesperson at the time called the company's posture a deliberate approach, citing "important risks we're weighing... including susceptibility to circumvention by bad actors and the potential to disproportionately impact groups like non-English speakers." The EU AI Act's deadline, not a change of mind about those risks, is what finally moved the decision.

What happens next is mostly unannounced. OpenAI hasn't said whether the EU default will ever extend to other jurisdictions, or when -- or whether -- public detector access will widen beyond the current approved-research list. Both questions matter more than the detection-rate numbers already published, because a watermark that only a small vetted group can check is a transparency measure the public still has to take on faith.

The absence of a detected watermark does not prove human authorship.