OpenAI just switched on an invisible ChatGPT watermark for people using the app in the European Union. It hides inside the word choices themselves, so copy and paste won’t shake it loose. If you write anything with AI, a few of your assumptions just expired.
Why OpenAI is doing this now
Blame regulation, not product strategy. The EU AI Act’s transparency rules took effect on August 2, and they require AI companies to mark generated text in a machine-readable way. OpenAI answered on October 5 with a blog post on its approach to EU text provenance rules, plus a technical report for its method, called textGrain, written with researchers from the University of Pennsylvania and Yale.
The rollout is already in motion. Over the coming weeks, eligible ChatGPT and Codex users in the EU get the watermark automatically, on every plan, free or paid. Anthropic did something similar with Claude about two months ago, except it went worldwide and caught plenty of backlash for it. Google, Meta, Microsoft, and OpenAI have all committed to the EU’s code of practice on AI-generated content, so this was never going to stay a one-company story.
Here’s the part I find genuinely interesting. OpenAI built a text watermark years ago and shelved it. The Wall Street Journal reported back in 2024 that the company hesitated partly because users might jump ship to rivals without watermarks. Regulation ended that debate.
How the ChatGPT watermark actually works
Forget the idea of a hidden symbol buried in the text. There’s no character, no metadata tag, nothing you could highlight and delete.
It’s a pattern in word choice, not a hidden stamp
Text generation works like this: at every word, the model picks from a handful of options that all fit. “Quick”, “fast”, and “speedy” can all be reasonable. What textGrain does is use a secret key to nudge those picks in a consistent direction, over and over, across the whole passage.
Any single choice looks completely normal. But add up hundreds of those small nudges and a statistical pattern appears in the text. A detector holding the same secret key re-derives which options the model was steered toward, counts the hits, and compares that rate against pure chance. A big gap means the passage almost certainly came from a watermarked model.
Because the signal IS the text, it travels with the words. Paste it into a doc, an email, or a CMS and the pattern goes with it. OpenAI also says the watermark doesn’t identify the user, and that its benchmarks showed no meaningful quality change with watermarking on. The company plans to release textGrain as open source, which is a detail worth remembering.
How well detection actually works
This is where the fine print gets honest. OpenAI published its own test numbers, and they tell you exactly when the detector works and when it falls apart. A token is roughly three quarters of a word, so 400 tokens is about a 300-word passage.
| Scenario | Detection rate |
|---|---|
| 400-token passage, unedited | about 92 to 95% |
| 200-token passage, unedited | about 80% |
| 400 tokens, 10% of words swapped for synonyms | about 66% |
| 400 tokens, 25% of words swapped for synonyms | about 17% |
Some content types barely carry a signal at all. Math answers, code, boilerplate, and translated text give the model little room to steer word choice, so detection drops hard there. Short texts are weak too, because statistical confidence needs words to work with.
And who gets to run the detector? Not you, not yet. Applications opened on October 5, but access starts with approved researchers and expert organizations. OpenAI says it wants help evaluating reliability before wider release. A watermark without a public detector is a promise, not a tool, and OpenAI seems aware of that gap.
What the ChatGPT watermark can’t do
The limitations list from OpenAI is the most useful part of the whole announcement. Read it twice.
The watermark can’t prove who wrote something. No detection does not mean human authorship, because the text might be too short, too heavily edited, or produced by another company’s model entirely. It can’t measure how much a human contributed. It can’t establish ownership or verify accuracy. And it can’t identify which user generated the text.
In OpenAI’s own words, a watermark can indicate that an OpenAI system generated or processed part of a passage, but not how much human judgment, editing, or creativity went into it.
Honestly, that last part is the real story. Teachers, editors, and HR departments love the idea of an AI detector as a verdict machine. This was never going to be one. As a result, anyone planning to treat a detection score as proof is going to have a bad time, and probably a legal one.
What happens outside the EU
Nothing, for now. OpenAI explicitly said it is not making watermarking a global default at launch. If you’re in the US, your ChatGPT output carries no watermark today.
Two exceptions worth knowing. First, API developers anywhere in the world can already switch watermarking on for select models. It’s off by default, but the switch exists. Second, OpenAI is working with cloud partners so enterprise traffic running through their services can carry the watermark too.
Should US users expect the ChatGPT watermark eventually? Look at the pattern. Anthropic watermarked Claude worldwide and survived the backlash. Meanwhile, the EU AI Act applies to any provider serving EU users, and the Americans all signed the same code of practice. I wouldn’t bet against a wider rollout once the EU rollout shakes out.
Why this matters if you write with AI
If you freelance or run content for clients, this lands on your desk eventually. European clients will start receiving watermarked drafts whether they asked for them or not, and disclosure expectations around AI use keep tightening. Amazon already requires sellers to label AI-generated people in product images, and that policy hit before anyone had a watermark to point at. The direction of travel is obvious.
There’s a practical upside hiding here too. The text is watermarked, not poisoned. Detection relies on a key OpenAI controls, gates behind researchers, and openly documents as fragile under editing. We already watched Claude’s watermarks get bypassed within weeks of launch. So if your workflow involves a real human editing pass, your output is genuinely yours in a way that matters, and it reads that way too. If your workflow is raw AI dump, that’s the pattern this tech was built to catch, and honestly that content usually deserves the scrutiny.
Style matters more than ever, in both directions. Generic AI phrasing gets flagged by humans long before any detector runs, which is why we keep a list of the AI slop phrases that make writing sound like a bot.
What to do right now
Three things, in order.
First, EU users: expect the watermark to show up automatically over the coming weeks. There’s no public opt-out for ChatGPT users so far, so plan around it instead of fighting it.
Second, check where your clients and readers are. If you publish for an EU audience through ChatGPT or Codex, assume your drafts are watermarked and behave accordingly, which mostly means keeping a genuine human pass in your process.
Third, lower your trust in detectors across the board. The numbers above show detection failing on a third of lightly edited text and nearly all heavily edited text. Any tool or person claiming certainty is overselling.
The bottom line
The ChatGPT watermark is real, it’s rolling out in the EU, and it’s weaker than the headlines suggest. Keep a human in your writing loop, stay skeptical of anyone selling detection certainty, and watch what OpenAI does with the open source release. That last piece could matter more than the announcement itself.
