.jpg){kind=link}
ChatGPT Text in the EU Will Carry a Hidden Watermark to Meet AI Act Requirements
On 5 October 2026, OpenAI announced that it will begin adding an invisible watermark, called textGrain, to eligible text from ChatGPT and Codex in the EU "over the coming weeks." The watermark will be switched on by default only for users in the EU, while enterprise customers globally can opt in via the API. The company's own test numbers show that detection breaks down under even light editing — and that the technology works poorly for short and mathematical text.
What textGrain Is, and How It Works
According to OpenAI, textGrain embeds an invisible statistical signature in the very word choices the model makes. A separate detector can then look for the signature and answer with a yes/no response on whether a text contains an OpenAI watermark (Anadolu Ajansı).
The technology does not insert hidden characters, invisible spaces, or odd punctuation — the signal sits in the phrasing of the text, OpenAI's FAQ states, as reproduced by BeInCrypto (Yahoo Tech/BeInCrypto). The company also says the watermark does not store data about the user or the original prompt, but functions purely as a binary signal for the detector (Daily Jagran).
This is a different approach from metadata or explicit labeling: the text looks and behaves the same to the reader, but the statistics of its word choices deviate, according to the company, from what an unmarked model would have chosen.
The rationale is regulation. The EU's AI Act requires providers of generative AI systems to make AI-generated text identifiable in a machine-readable format (Anadolu Ajansı).
Who Gets the Watermark — and Who Gets the Detector
The rollout is deliberately regional. The watermark is switched on by default for users in the EU, while it remains off by default elsewhere. Enterprise customers around the world who use OpenAI's API can opt in, but it is voluntary (PCMag).
The detector is not public. OpenAI is opening applications for access, but is initially restricting it to approved researchers and expert organizations (Anadolu Ajansı). Ordinary users therefore cannot check a text against the watermark themselves.
Here OpenAI differs from its competitor. Anthropic rolled out similar text watermarking for Claude globally in August, also citing the AI Act, and explained at the time that the company "doesn't yet have a durable way to scope it by region." OpenAI argues the opposite: "A regional approach gives us room to learn from real-world use and feedback," the company said, according to PCMag (PCMag).
The Detector's Own Numbers: Weaker Than the Name Suggests
Perhaps the most revealing part of the announcement is OpenAI's own test data, which shows how fragile the detection signal is.
After one set of reporting, the detector identified roughly 66% of unedited responses of around 150 words, and roughly 92% at around 300 words (Yahoo Tech/BeInCrypto). Another rendering of the numbers from the same testing reports roughly 80% for 200-token passages and roughly 95% for 400-token passages at a 1% false-positive rate, measured on psychology-related text (TechRepublic, Goodreturns). The two renderings may reflect different token lengths, thresholds, or text domains, and the figures cannot be fully reconciled on the basis of what is available. Common to both is the main pattern: the longer the text, the better the detection.
The pattern reverses under editing. In texts of 300 words, replacing every tenth word with a synonym cut detection from 92% to 66%. Substituting every fourth word dropped it to around 17% (Yahoo Tech/BeInCrypto). In other words, a simple rephrasing — anything from manual editing to a quick pass through another model — can in practice remove the signal.
The company itself warns about this, calling text watermarking and detection early technologies with significant limitations. Detection was also markedly weaker for mathematics, where there are few ways to express the same information, and for translated text (Daily Jagran).
What Is Excluded — and What a Detection Actually Means
Under EU guidance, as reported by TechRepublic, code snippets and responses under roughly 200 tokens — about 150 English words — are excluded from the text-watermarking expectations. The reason is mechanical: in code, there are fewer acceptable next-token choices, which limits how much textGrain can alter the output without breaking it (TechRepublic).
At the same time, OpenAI emphasizes what a watermark finding does not say. It gives no indication of how much a human contributed to the text, says nothing about who owns it, does not identify the user who produced it, and is no indication of how accurate the output is (The Independent via MSN). And conversely: the absence of a watermark does not prove a text was written by a human — a short, edited, or translated AI text will typically slip through.
The Quality Claim — a Company's Own Statement
OpenAI claims the watermarking does not degrade output quality. "On the benchmarks we use to evaluate Astra, our newest frontier model, we don't see meaningful performance differences with and without watermarking," the company said, according to PCMag, additionally pointing to data in which watermarked text reportedly performed better than unmarked text on some evaluations (PCMag, The Independent via MSN). These are the company's own claims; the naming and version of the model have not been independently confirmed, and independent verification is not available.
What Remains
Several questions are open. It has not been specified exactly which ChatGPT responses count as "eligible" for watermarking, beyond OpenAI's own phrasing, or how precisely the rollout "over the coming weeks" will proceed. Extension to global default settings has not been confirmed — and OpenAI's rationale for the regional approach suggests the company itself is treating this as an experiment (Daily Jagran).
The big unanswered question is what the watermarks are worth in practice. The law requires machine-readable identifiability; the technology, by OpenAI's own numbers, delivers a signal that is strongest precisely in the cases — long, unedited, continuous texts — where the recipient often needs it least. For shorter, edited, or technical text, the uncertainty is large, and the detector is for now reserved for a small circle of approved researchers.