There is nothing to see in the change OpenAI made to its chatbot on Sunday. No hidden character, no invisible space, no odd punctuation mark. The signal the company is now hiding in its text sits in the wording itself: a faint statistical bias in which word the model chooses next, one that only a detector holding a secret key can pick out. OpenAI calls the system textGrain, and it is now being applied to text from ChatGPT and Codex for users inside the European Union.
The company announced the shift on October 5, describing it as its answer to transparency rules that became enforceable across the bloc on August 2. Article 50 of the EU’s AI Act requires providers of generative systems to make AI-generated content detectable in a machine-readable way. Rather than add a visible label or hidden characters, OpenAI nudges the model’s word choices as it writes, leaving a pattern that travels with the text when it is copied, pasted, or shared.
The rollout is narrower than the headline suggests. Inside the EU, the watermark reaches eligible ChatGPT and Codex users on all plans over the coming weeks. Outside the bloc, nothing changes by default. Developers using the API anywhere in the world can switch the feature on for select models, but it remains off unless a customer turns it on. OpenAI said it is not making text watermarking a global default at launch, choosing instead to watch how the EU rollout behaves before deciding whether to extend it.
That restraint sets OpenAI apart from Anthropic, its closest rival. Anthropic said two months earlier that it would watermark Claude text worldwide, applying its own version of Google DeepMind’s SynthID-Text by default. The two companies have converged on the same architecture, an invisible statistical signal paired with a gated detector, but they start from opposite positions. OpenAI’s switch is off; Anthropic’s is on.
The limits of the technology are severe, and OpenAI has been unusually explicit about them. Its own tests found the detector flagged about 80 percent of 200-token passages and about 95 percent of 400-token passages on material such as psychology, at a target false-positive rate of 1 percent. Editing erodes the signal quickly. In a 400-token test, replacing one word in ten with a synonym cut detection from about 92 percent to 66 percent; replacing one in four drove it down to 17 percent. Translation can remove the signal entirely, the company said.
Text needed its own treatment because it is so easy to alter. OpenAI already embeds watermarks in images and audio, pairing SynthID marks with C2PA metadata that describes where a file came from. A picture can carry its history in a signed record. A sentence cannot: it can be rewritten, translated, or trimmed in seconds, which is why the company turned to a signal buried in word choice rather than in any visible mark. The weakness is the mirror image of the method. Because the watermark lives in the phrasing, any substantial rewrite weakens it, and short or tightly constrained passages leave the detector with too little to work with.
OpenAI was equally candid about what the mark does not prove. A missing watermark means nothing on its own: the text may be too short, too heavily edited, translated, produced by another company’s tool, or written before the feature existed. A detected mark does not identify the user, reveal the prompt, or say whether the words are true. Provenance, the company stressed, is not fact-checking.
The detector itself is the part most people will never get to use. OpenAI opened applications on October 5 to approved researchers and expert organizations, citing the risk of missed watermarks and false positives as its reason for keeping the tool off the public web at launch. Images and audio are treated differently: anyone can already upload those to a public verification tool. For text, the measuring instrument is gated.
The stakes behind the gate are legal. Under Article 50, non-compliance carries penalties of 15 million euros or 3 percent of worldwide annual turnover, whichever is higher. The EU has effectively exported a technical standard: a switch that exists because Brussels required it is now available to API customers in every jurisdiction. OpenAI’s technical report describing textGrain was co-written with researchers from the University of Pennsylvania and Yale, and the company has said it plans to release the technology as open source.
For the regulators who pressed for transparency, the open question is what a gated detector leaves them. A watermark that only a vetted handful can check is a promise more than a proof. Journalists, moderators, and auditors who would most want to verify a passage cannot, at least not yet. OpenAI said it will widen access once the results can be interpreted responsibly. Until then, the fingerprint is real but hard to read, and the people most likely to need it are still waiting in the queue.
