OpenAI Watermarks ChatGPT Text in the EU, and Leaves the API Switched Off

AI 요약

• ChatGPT and Codex output in the EU now carries an invisible text watermark.
• The API ships with it off, so you turn it on in org settings yourself.
• Replacing 25% of the words with synonyms drops detection to 17%.

OpenAI published its text watermarking technique, textGrain, on October 5, 2026. The mechanism: as the model picks each next token, a tiny bias derived from a secret key is folded into that choice. Nothing is visible to a reader. Only a detector holding the same key can measure whether that pattern shows up more often than chance would explain. Because it does not insert hidden characters or zero-width spaces, the mark survives a copy and paste into another application.

Rollout splits in two. In the EU, ChatGPT and Codex output gets watermarked automatically over the coming weeks, on every plan. The API is the opposite: the default is off, and customers anywhere in the world have to turn it on in settings themselves.

Where the switch is, and why it exists now

Until now OpenAI's provenance signals only covered images and audio. Text was missing from the May 2026 bundle of C2PA signing and SynthID watermarking, and this fills that gap.

If you are on the API, there are two places to turn it on. The org-wide default lives under Data controls in organization settings, in a tab called Text provenance. To override it per project, open the same tab in project settings. Switch on Allow text watermarking, pick your models, save. No per-request parameter, no per-response annotation: OpenAI injects the signal at generation time. Only some models appear in the list today, with legacy models to be added over the coming weeks. Three models near deprecation are excluded outright: gpt-image-1, gpt-image-1.5, and sora-2.

Two dates explain the timing. Article 50(2) of the EU AI Act requires providers of generative AI to mark output in a machine-readable form, and it has applied since August 2, 2026. Systems already on the market before that got a four-month extension under the Digital Omnibus (Regulation 2026/1744), and that deadline is December 2, 2026.

That is where the marking obligation moves from OpenAI onto the developer. If you take an OpenAI model and ship text to EU users through your own product, the watermark OpenAI injects into ChatGPT has nothing to do with your output. Marking the text you receive over the API is your job, whether you do it by flipping this setting or some other way.

How much it actually catches

OpenAI published detection numbers, and the failure cases are sharper than the successes. All figures are at a 1% false positive rate. On discursive writing where the model has room to choose phrasing, such as psychology, the detector catches roughly 95% at 400 tokens and roughly 80% at 200 tokens. For text with few valid wordings, such as mathematics, OpenAI wrote only that detection is "considerably lower" and showed the number in a chart alone.

Editing breaks it. Replace 10% of the words in a 400-token passage with synonyms and detection falls from 92% to 66%. Replace 25% and 17% is left. Translation or a full rewrite erases the signal entirely. OpenAI states plainly that the absence of a watermark is not evidence a human wrote the text: short text, edited text, translated text, text generated before watermarking shipped, and text from another vendor's tool all produce the same negative result.

Performance is also uneven across languages. OpenAI built 500 English prompts, translated them into the other 23 official EU languages, and measured each. Spanish came out highest at 69.0% and Romanian lowest at 42.2%. Not one of the 24 languages cleared 70%. OpenAI then used a watermark strength parameter to lift the languages that sat below 60%; the lighter blue in the chart below is that gain.

Output quality is the smaller worry. OpenAI compared watermarking on and off across eight benchmarks using Astra, its latest frontier model: DeepSWE v1.1 moved from 72.80% to 71.68%, while Terminal-Bench 4.0 moved from 53.90% to 56.06%. OpenAI describes differences of that size as the run-to-run noise any repeated evaluation produces, and says the latency impact is negligible.

Code and short answers are exempt to begin with

Codex appearing in the announcement does not mean the code your agent writes gets stamped. The EU Code of Practice exempts two things: outputs under 200 tokens (roughly 150 English words) and code snippets.

Even without the exemption, code carries the signal poorly. This watermark can only ride along where the model has several valid ways to write the same thing. The OpenAI Help Center explains that code is hard because there are fewer plausible candidates for the next token than in ordinary prose. Answers to math problems, and requests to reproduce user-supplied text verbatim, leave almost no signal for the same reason.

If you build products, output length is the first thing to count. If the responses your service sends to EU users mostly sit below 200 tokens, flipping the setting produces none of the marking the Code of Practice asks for. In that case you need a visible AI-generated disclosure instead. OpenAI's own documentation says a machine-readable signal does not replace a visible label or banner.

Turning it on does not let you check your own text

Enabling the watermark does not get you a detector. The two are fully separate. Detector applications opened on October 5, and eligibility is limited to academic and research institutions studying text provenance, detection reliability, and how people interpret provenance results. Current partners are John Thickstun at Cornell, Martin Vechev at ETH Zürich, and researchers at KInIT in Slovakia.

The excluded uses are more telling. Commercial fraud prevention, authentication and verification, reselling provenance analysis as a service, and checking whether students used AI on assignments are all out of scope. The constituency most eager for a detector is education, and that is the first one shut out. Given a detection rate that falls to 17% under 25% word substitution, at a 1% false positive rate, that is a defensible call. It also means the range of things this mark can do today is narrow.

Images and audio work differently. There, openai.com/verify and the Content Provenance API are open to anyone and checks are free. Text is the only modality behind a review process.

Anthropic did the same thing on August 14 but applied it worldwide from the start, citing the absence of a reliable way to scope it by region. OpenAI put it where the EU requires it and left the rest to customer choice. OpenAI says it plans to open source textGrain, without giving a date.

What this means outside the EU

If you use ChatGPT or Codex from Singapore, Japan, Australia, the United States, or anywhere else outside the EU, nothing is being stamped on your output. Automatic application is EU-only. The API setting carries no regional restriction at all, so an organization registered anywhere can switch it on today.

Which transparency regime binds you depends on where your users are, and in APAC the two poles are far apart. Singapore has no statutory watermarking mandate: the Model AI Governance Framework for Generative AI, published by IMDA and the AI Verify Foundation in May 2024, lists content provenance as one of its dimensions and encourages digital watermarking and cryptographic provenance, but it is voluntary guidance rather than binding law, and it says outright that technical measures alone are unlikely to be sufficient. China sits at the other end. The Cyberspace Administration of China's labelling measures, in force since September 1, 2025 alongside the mandatory national standard GB 45438-2025, require both a visible label and an implicit label embedded in the content file's metadata. textGrain writes nothing into metadata by design, which is exactly what makes it survive a copy and paste, so it does not on its own answer that second requirement. OpenAI's own documentation declines to interpret any of this for you and says each customer's legal obligations are a matter for their own counsel.

If you run a product that sends text to EU users, the faster move is to count the median output token length across a week of response logs before you open Text provenance at all. If most responses run past 200 tokens, one setting buys you room on the December 2 deadline. If they fall below it, flipping the switch produces none of the marking the Code of Practice asks for, and designing a visible disclosure comes first. One query tells you which side you are on.