ChatGPT Text Watermarking Explained: EU Mandate, Detection and Removal Realities

OpenAI began embedding invisible watermarks in text outputs from ChatGPT and Codex in the EU starting October 2026. This isn't a visible marker, but a statistical pattern hidden between the lines. For EU users, it's on by default; for the rest of the world, it's off by default. This shift around text provenance verification is redefining the transparency boundaries of AI-generated content.

Does ChatGPT Now Watermark Text?

According to OpenAI's October 5, 2026 announcement, text watermarking rolls out first in the EU, in three parts:

EU versions of ChatGPT and Codex. All eligible users on paid plans automatically receive watermarking within a few weeks. Codex, OpenAI's coding tool, is included as well.

Global API optional opt-in. Developers can enable watermarking for selected models in their own applications; it's off by default.

Detection tools available only to a select few. OpenAI built a detector, but only accepts applications from research institutions and expert organizations, reviewed case by case.

OpenAI made clear that text watermarking won't become a global default in the short term. ChatGPT text outside the EU currently carries no watermark.

Some details remain opaque: OpenAI hasn't disclosed a specific launch date, hasn't defined the criteria for "eligible users," and hasn't explained how it determines user location. The only toggle mentioned in its help pages is for API customers.

How textGrain Watermarking Works

The core of this technology is called textGrain, a statistical steering method based on a secret key.

Language models generate tokens (words or word fragments) one at a time. At each step, there are multiple candidate tokens, and the model picks among them partly at random. textGrain uses a key to intervene in this random selection process extremely subtly. When text is long enough, these tiny shifts accumulate into a measurable pattern. A detector holding the same key can then determine whether a piece of text matches the pattern beyond the range of coincidence.

OpenAI emphasized what the watermark is not:

• It doesn't insert any hidden characters, invisible spaces, or abnormal punctuation into text
• It isn't linked to user identity, accounts, prompts, or conversation records
• It can't prove how much a human wrote, who owns the text, or whether it's accurate

On model capability, OpenAI benchmarked with the Astra model. On DeepSWE v1.1, it scored 72.80% without watermarking and 71.68% with it; on Terminal-Bench 4.0, 53.90% and 56.06% respectively. OpenAI considers these fluctuations to be normal noise from test runs.

The technology was developed in collaboration with researchers from the University of Pennsylvania and Yale University on a technical report, which OpenAI plans to open-source.

The token generation mechanism of language models is key to understanding watermarking. A model doesn't write a whole sentence at once; it predicts the next token step by step. At each position, the model computes a probability distribution over all candidate tokens in the vocabulary, then samples according to that distribution. This sampling process itself carries randomness (usually controlled by the temperature parameter), so the same prompt may generate different text. textGrain exploits this randomness: it uses a secret key known only to OpenAI to apply an extremely weak bias to candidate tokens during sampling. The key determines the direction of the bias, but has nearly zero semantic impact on the final text. The bias of a single token is invisible, but after hundreds or thousands of tokens accumulate, it forms a statistically detectable signature. A detector holding the same key can compute whether a text's token sequence appears with an anomalously high probability under that key. The academic name for this method is "key-based pseudorandom watermarking," in the same lineage as the green-list scheme proposed by Kirchenbauer et al. in 2023.

EU AI Act Article 50 Compliance Requirements

EU AI Act Article 50 is the root reason watermarking is currently limited to the EU. This provision requires AI systems that generate text, images, audio, or video to mark outputs in a machine-readable format so software can detect traces of artificial generation.

Key deadlines and penalties:

• Article 50 applies from August 2, 2026
• Systems already on the market must meet the marking requirements by December 2, 2026
• Fines for violations up to €15 million or 3% of global annual turnover

Major AI companies demonstrate compliance through a voluntary EU Code of Practice. Published on June 10, 2026, it had been signed by roughly 190 organizations by the end of July, including Anthropic, Google, Meta, Microsoft, and OpenAI. The code requires invisible watermarks embedded in text, except for short texts under 200 tokens (about 150 words in English).

Notably, OpenAI was cautious before the regulation took effect. In an August 4, 2024 update, OpenAI said it had developed text watermarking methods but was still weighing the risks, including how easily they could be bypassed.

The EU AI Act is the world's first regulation to systematically classify AI risk, formally adopted in 2024 and taking effect in phases. It categorizes AI systems into four levels: unacceptable, high, limited, and minimal risk. Article 50 falls under the transparency chapter and targets "limited risk" systems, mainly AI that directly interacts with humans or generates content. Its core logic is: users have the right to know they're talking to a machine or reading machine-generated content, so systems must disclose in a machine-readable way. Here "machine-readable" doesn't mean a human-visible disclaimer, but a technical marker software can automatically recognize—watermarks, metadata, and cryptographic signatures all qualify. Article 50 also covers chatbot disclosure, deepfake marking, and emotion recognition system notification obligations. The fine ceiling of €15 million or 3% of global annual turnover, whichever is higher, mirrors GDPR's penalty structure, but targets providers and deployers of AI systems rather than data controllers.

Can ChatGPT Watermarks Be Detected and Removed?

On detection, ordinary users have no tools available. OpenAI hasn't publicly released a detector, and its public verification page only checks images and audio, not text. Third-party detection tools like Pangram analyze text style rather than reading an embedded signal—the latter requires OpenAI's key.

Even with detection access, results are uncertain. At a 1% false positive rate, OpenAI's detector catches about 80% of watermarked 200-token psychology texts and about 95% at 400 tokens. Math texts show noticeably lower detection because word choice is less free. Across tests in 24 official EU languages, detection rates ranged from 42.2% in Romanian to 69.0% in Spanish. OpenAI says it can strengthen watermarking for weak languages and has already adjusted for languages below 60%.

On removal, rewriting is an effective method. Copy-pasting won't remove a watermark because the pattern is embedded in the wording itself. OpenAI's tests on 400-token texts showed:

• Unedited text: about 92% detected
• Replacing 10% of words with synonyms: detection drops to 66%
• Replacing 25% of words: detection only 17%

Extensive rewriting or translation can make watermarks undetectable. But three caveats: style-based detectors don't rely on watermarks; watermarks can't replace legally required explicit labels; and companies signing the EU Code commit not to provide tools specifically designed to evade marking.

False positive rate and detection rate are the two core metrics for evaluating watermark detectors, and they typically trade off against each other. False positive rate is the probability of incorrectly flagging human-written text as AI-generated; detection rate is the probability of correctly identifying watermarked text. If a detector lowers its threshold, it more easily identifies watermarked text but also more easily wrongs human authors. OpenAI's reported 80% detection rate is achieved under a 1% false positive constraint, meaning about 1 in 100 human texts would be misjudged. This level is especially fragile on short texts: 200-token psychology texts are detected only 80% of the time, while 400 tokens can reach 95%, because the watermark signal accumulates with length. Math texts are detected even less because formula and number token choices have almost no freedom, making watermarks hard to embed. Multilingual differences stem from varying lexical diversity and tokenization efficiency across languages; in weak languages candidate tokens are more concentrated, leaving less room for key intervention.

Why Code Watermarking Is the Weakest

Although Codex falls within the watermarking announcement, code is the scenario where watermarking works worst. OpenAI's help page notes that because there are fewer reasonable next-token choices in code, watermarking is harder than in ordinary prose.

EU rules also make concessions here. OpenAI says the EU Code of Practice doesn't require watermarking code snippets or outputs under 200 tokens. The European Commission's FAQ also lists source code among output types outside marking obligations.

Anthropic described the same limitation for Claude: code that must be precise has almost no room for watermarking, while freely chosen parts like code comments can carry watermarks. OpenAI's page doesn't specify which parts of Codex answers carry watermarks.

Prompt injection is an attack method against AI systems where attackers embed malicious instructions in the input to override or bypass a system's original behavior rules. In Lasso Security's research scenario, an attacker could craft prompts to induce a watermarked model to change how it responds to subsequent harmful requests—for example, making the model more likely to output violating content or ignore safety filters. The mechanism isn't fully understood; one explanation is that the watermark's key bias interferes with the model's internal attention patterns used for safety judgment, probabilistically weakening safety checks. That study only tested Google's open-source SynthID-Text with six open-source models, not OpenAI's textGrain or Anthropic's scheme. But the conclusion carries broad cautionary value: watermarking, as a global intervention in the generation process, may produce unintended side effects, and developers should run behavioral regression tests on their own models and Agent workflows before enabling it.

Practical Impact on Students, Writers, and Developers

Students. Schools and universities currently can't use OpenAI's text detector to check assignments, because academic integrity use isn't within the access program. Anthropic is different, listing educational institutions among eligible parties for Claude's detection preview.

Writers and publishers. Watermarks don't solve copyright attribution. Article 50 has specific rules for "deployers": if publishing AI-generated text of public interest to the public in a professional role, disclosure is required, unless it's been human-reviewed and someone takes editorial responsibility. Purely personal, non-professional use falls outside the AI Act's scope.

Developers. Watermarking is off by default in the API. Organization defaults are at Organization settings → Data controls → Text provenance; project-level overrides are at Project Settings → Text provenance, where you enable "Allow text watermarking" and select models. Enabling it doesn't mean gaining detector access.

There's a security finding worth noting. According to an Ars Technica report on September 17, 2026, research by a Lasso Security researcher found that Google's open-source SynthID-Text changes how six open-source models respond to harmful requests in prompt injection scenarios. The study didn't test Claude or OpenAI's textGrain, but recommends developers test how models and AI Agents behave once watermarking is enabled.

Comparing ChatGPT, Claude, and Gemini Watermarking

All three watermark text in some form, but differ in scope and detection access:

ChatGPT (OpenAI). Proprietary textGrain, on by default only in the EU, optional via API. Detector limited to approved researchers and expert organizations.

Claude (Anthropic). Uses a variant of Google DeepMind's SynthID-Text, released in 2024. Anthropic announced its scheme on August 14, 2026, and since there's currently no reliable way to restrict by region, watermarking applies globally. It covers supported models in the Claude app, API, and Claude Code, with older models being added gradually. The detection API is in private preview for eligible organizations including regulators, media, fact-checkers, and researchers.

Gemini (Google). Google says SynthID watermarks text in the Gemini app and web experience. On October 7, 2026, Google opened the SynthID Detector for images, video, and audio to everyone, but that announcement didn't mention text.

On editing impact, Anthropic says "light editing may not fully remove the watermark," while a complete rewrite will. OpenAI says textGrain matches or exceeds SynthID in its own tests. The two detectors only recognize their own company's watermarks; no single tool detects all three companies' text.

Key Upcoming Milestones

• EU rollout period (from October 2026). Watermarking reaches eligible users within weeks, with no exact date. OpenAI plans to update the technical report and extend watermarking to cloud partners.
• December 2, 2026. AI systems already on the market must meet Article 50 marking requirements as the grace period ends. Anthropic says it's still adding watermarking to older Claude models.
• February 2, 2027. Companies signing the EU Code commit to establishing interoperability solutions by this date, so different companies' watermark detectors can work together. One approach mentioned in the code is public markers telling checkers which company's detector to use. OpenAI also says it plans to expand detector access and open-source textGrain, but hasn't given a timeline.