OpenAI Rolls Out EU Text Watermarking With Limited Detector

Short answer: OpenAI launched text watermarking (textGrain) October 5 for EU AI Act compliance. API users can opt in; EU ChatGPT and Codex users get it automatically. Detector access is restricted to approved researchers due to reliability limits: editing 10% of words cuts detection rates, and performance varies by content. Benchmarks show no performance impact. Watermarks don't prove authorship, ownership, or accuracy. Image and audio verification tools remain public.

OpenAI EU AI Act text watermarking launch

OpenAI kicked off text watermarking on October 5 to satisfy the EU's AI Act, rolling it out in phases while keeping the actual detection tools under wraps for now. They're calling it a cautious move, driven as much by the tech's current limits as by regulatory boxes that need ticking. Starting immediately, API customers anywhere can flip the switch on select models, though it stays off unless you turn it on. Over the next few weeks, eligible ChatGPT and Codex users in the EU will get invisible watermarks applied automatically; everyone else stays on the default setting, which is off.

How textGrain watermarking works

The system, dubbed textGrain, tweaks the statistical patterns in word choice to plant a signal a detector can spot later. OpenAI dropped a technical report on the method and plans to open-source it. In their internal tests, textGrain held its own against rivals like Google's SynthID for text. But the company was upfront: strong scores in a lab don't mean reliable detection in the wild. At a one percent false-positive target, the detector caught watermarks in about eighty percent of 200-token passages and ninety-five percent of 400-token passages for psychology content. For math, where word choice is tighter, detection rates tanked.

Editing is another headache. Swapping just ten percent of words for synonyms in a 400-token chunk dropped detection from roughly ninety-two percent down to sixty-six percent. Push that to a twenty-five percent replacement rate and you're looking at seventeen percent. Those weaknesses are exactly why detector access is restricted to approved researchers and expert orgs who can help vet reliability and responsible use. Applications opened the same day as the announcement. The tool only reports whether an OpenAI watermark exists-no user IDs, no prompts, no conversation details. OpenAI said they won't release it publicly at launch because the risk of missed watermarks and false positives is too high.

Watermark performance impact and limitations

Benchmark testing on their latest frontier model, Astra, showed no meaningful performance hit. They ran it across eight benchmarks-Artificial Analysis Intelligence Index, AutomationBench, DeepSWE, GPQA Diamond, and a few others-and scores just wobbled within tight margins. Some benchmarks ticked up slightly with watermarking on, others dipped slightly. Net result: a wash.

OpenAI was careful to spell out what a watermark *doesn't* do. It doesn't measure human input, establish ownership or legal liability, ID the user, fact-check anything, or prove human authorship when it's missing. Text might be too short, heavily edited, translated, come from an unsupported model, pre-date the feature, or originate from a competitor's system. They describe their broader provenance play as layered: C2PA-compliant Content Credentials for images, invisible SynthID watermarks for images and audio, plus public verification tools at openai.com/verify and via the Content Provenance API. Those image and audio tools stay public; text detection stays locked down.

Phased rollout ChatGPT Codex regional

The regional rollout for ChatGPT and Codex buys them time to learn from real-world use before even thinking about a global default. They're also working with cloud partners to extend watermarking to OpenAI model outputs accessed through those services in the coming weeks. OpenAI said they expect to revisit every piece of this approach as the tech, standards, and evidence evolve.

Frequently asked questions

When did OpenAI launch text watermarking and what triggered it?

OpenAI launched text watermarking on October 5 to comply with the EU's AI Act. The rollout is phased, starting with API customers who can opt in immediately, followed by automatic watermarking for eligible ChatGPT and Codex users in the EU over the coming weeks.

How does OpenAI's textGrain watermarking work and how effective is it?

textGrain embeds a statistical signal by tweaking word-choice patterns. In internal tests, at a 1% false-positive rate, it detected watermarks in ~80% of 200-token and ~95% of 400-token psychology passages, but detection dropped sharply for math content and when 10-25% of words were replaced with synonyms.

Who can use the watermark detector and why isn't it public?

Only approved researchers and expert organizations can access the detector via an application process opened October 5. OpenAI withheld public release because missed watermarks and false positives remain too risky; the tool only reports whether an OpenAI watermark exists, without user IDs or conversation details.

Does watermarking degrade model performance?

Benchmark testing on OpenAI's frontier model Astra across eight benchmarks-including Artificial Analysis Intelligence Index, GPQA Diamond, and DeepSWE-showed no meaningful performance impact. Scores fluctuated within tight margins, with some benchmarks ticking up slightly and others dipping slightly, netting a wash.

What does a text watermark not prove or do?

A watermark does not measure human input, establish ownership or legal liability, identify the user, fact-check content, or prove human authorship. It can be absent if text is too short, heavily edited, translated, from an unsupported or competitor model, or pre-dates the feature.

Source: OpenAI

OpenAI Rolls Out EU Text Watermarking With Limited Detector Access