OpenAI announced that it will begin embedding an invisible watermark in eligible text generated by ChatGPT and Codex in the European Union. According to a post on the company’s blog, implementation will begin in the coming weeks in response to transparency requirements under European artificial intelligence legislation.
The initiative is intended to help identify the involvement of the company’s systems in producing content. OpenAI emphasizes, however, that the technology has limitations: the watermark does not identify the user, verify whether information is accurate, or determine who is responsible for the text.
The absence of a detected watermark also does not prove that content was written by a person.
Implementation Will Be Phased In
According to OpenAI, the European Union’s AI Act requires providers of generative AI systems to make text produced by their systems identifiable by automated tools.
Generative AI refers to technologies capable of producing text, images, audio and code in response to instructions. Machine-readable identification allows software to look for signals within content even when those signals are not visible to the reader.
The company said API customers worldwide will be able to opt into text watermarking for selected models. An API is an interface that allows OpenAI’s models to be integrated into other applications and services. In the API environment, watermarking will remain disabled by default.
For ChatGPT and Codex, the rollout will cover eligible text generated in the European Union. The measure therefore does not mean that every text produced by the company’s systems will carry the identifier.
OpenAI has also opened applications for access to the detector. Initially, the tool will be available only to approved researchers and specialized organizations, which will be able to contribute to evaluating its reliability and responsible uses.
The restriction applies to text detection. Verification tools for images and audio, including OpenAI Verify and the Content Provenance API, will remain publicly available, subject to the access conditions of each service.
How the Invisible Watermark Works
The technology, called textGrain, embeds a statistical signal into the word choices made by the model.
Instead of inserting a visible label or symbol, the system establishes a pattern in the words it selects. The detector analyzes that pattern to assess whether a passage contains an OpenAI watermark.
The company said its technical paper will be updated with additional details in the coming weeks. It also plans to make the technology open source, allowing individuals and organizations to study how it works and develop solutions based on it.
OpenAI acknowledges that text watermarking and detection remain early-stage technologies. According to the company, both their limitations and broader discussions about benefits and responsible uses support a gradual rollout.
False Positives and False Negatives: What Are the Risks?
The detector can make two types of errors.
A false positive occurs when the tool indicates that a watermark is present in text that does not actually contain the signal. In other words, the content is incorrectly identified.
A false negative occurs when a watermark is present but the detector fails to identify it.
These errors illustrate why detection results need to be interpreted within the technology’s limitations. A positive result does not replace an investigation into the origin of the content, while a negative result does not rule out the involvement of artificial intelligence.
Shorter Text Is More Difficult to Identify
The shorter the text, the fewer elements the detector has available to identify the pattern.
In an evaluation involving content such as psychology-related material, the tool detected watermarks in approximately 80% of 200-token passages and about 95% of 400-token passages. The test used a target false-positive rate of 1%.
Tokens are units of text processed by an AI model. They can correspond to entire words, parts of words or punctuation marks. As a result, a passage containing 200 tokens does not necessarily contain 200 words.
A target false-positive rate of 1% means the test was configured to produce approximately one incorrect identification for every 100 unwatermarked passages. It does not mean that every positive result has a 99% probability of being correct.
The percentages disclosed represent the conditions of the company’s evaluations and do not guarantee the same performance across all types of content.
Content With Less Linguistic Variation Provides Fewer Signals
OpenAI said detection was substantially lower for content such as mathematics, where there is less flexibility in word choice.
An explanation of behavior, for example, can often be expressed in several different ways. A mathematical formula or answer, by contrast, may require specific terms and sequences.
Because the watermark depends on choices made by the model during generation, this reduced linguistic flexibility makes it more difficult to embed and subsequently identify the signal.
Editing Text Can Weaken the Watermark
Editing can also reduce detection performance.
In another evaluation involving 400-token passages, replacing 10% of the words with synonyms reduced the detection rate from approximately 92% to 66%. When 25% of the words were replaced, the rate fell to 17%.
In practice, changing the vocabulary can disrupt part of the statistical pattern the detector is designed to find. A text may therefore still originate from an AI system while presenting signals that are more difficult to recognize.
According to the company, these limitations contributed to its decision to initially restrict detector access to researchers and specialized organizations.
What the Watermark Does Not Reveal
The identifier provides a limited signal about the involvement of OpenAI systems in a piece of content. On its own, it cannot establish how the text was created or used.
Human contribution: The watermark may indicate that one of the company’s systems generated or processed part of a passage, but it does not measure the amount of human creativity, judgment or editing involved.
Ownership and responsibility: The signal does not determine who owns the text, whether its use was lawful, whether there was an obligation to disclose the use of AI, or who is responsible for the content.
User identity: The watermark does not link the text to a specific person, organization, account, prompt or conversation.
Accuracy of information: Detection does not indicate whether the content is true, misleading, harmful or presented in the correct context.
Human authorship: The absence of a detected watermark does not prove that a person wrote the text. The content may be too short, may have been edited or translated, may have originated from an unsupported model, or may have been generated before watermarking was implemented. It could also have been generated by another company’s technology.
Content Provenance Is Part of Broader Measures Against Misleading Material
OpenAI also links provenance signals to its work on election safeguards. According to the company, these tools can help people and platforms assess potentially misleading AI-generated content, including deepfakes — synthetic material designed to simulate a person’s image or voice.
The company says it combines provenance identification with usage policies, abuse-detection systems, reporting mechanisms, investigations and enforcement measures.
OpenAI also says it works with researchers, technical standards organizations, platforms and civil society groups to improve the usefulness of these technologies.
Source: OpenAI publication on text watermarking, based on the material provided for this report. Additional information comes from materials referenced by the company, including OpenAI Verify, the Content Provenance API, its Help Center guidance on provenance signals and its 2026 election safeguards. Test results and implementation plans are attributed to OpenAI.
