OpenAI's textGrain Puts Invisible Watermarks in EU ChatGPT Text
OpenAI announced textGrain on 5 October 2026, an invisible text watermark for model-generated text. API customers worldwide can opt in to it from today, and it stays off by default in the API. Over the coming weeks, eligible ChatGPT and Codex text output in the European Union will carry the watermark across all plans. Detector access opens by application.
That is a small product note with a large commercial consequence. For the first time, ordinary chatbot text leaving a mainstream assistant carries a machine-readable signal about where it came from, and the trigger is European law rather than user demand.
What OpenAI shipped on 5 October 2026
OpenAI set out a phased approach in its post on its approach to EU text provenance rules. The company says the EU AI Act requires generative AI providers to make generated text identifiable in a machine-readable way, and that its rollout reflects both that requirement and the limits of the technology.
Three things are happening, on three different clocks:
- API opt-in, today, globally: API customers around the world can opt in to text watermarking for select models from 5 October 2026. It remains off by default.
- EU ChatGPT and Codex, coming weeks: OpenAI will add an invisible watermark to eligible ChatGPT and Codex text output across all plans in the European Union only. It is not a global default at launch.
- Cloud partners, coming weeks: OpenAI says it is working with cloud partners to make watermarking available for OpenAI model outputs accessed through their services.
Detector access opens today by application, granted case by case to approved researchers and expert organisations in accordance with the EU Code of Practice. No pricing is stated for any part of this.
How does textGrain actually work?
textGrain, the watermark
textGrain is OpenAI's text watermarking technology, and it adds an invisible statistical signal to the model's word choices. Nothing is appended to the text and nothing is visible to a reader. The signal lives in the pattern of words the model picks.
The detector
OpenAI's detector looks for that signal and assesses whether a passage contains an OpenAI watermark. The tool reports only whether it detects an OpenAI watermark. It does not identify the user, the account, the prompt or the conversation. It is not publicly available at launch.
Open source and the technical report
OpenAI says it plans to make the technology available in open source so others can build on it, and that its textGrain technical report will be updated with additional details in the coming weeks. In OpenAI's evaluations, textGrain matched or exceeded other approaches it tested, including SynthID for text.
Where does detection break down?
The published numbers are the most useful part of the announcement, because they tell you how much weight a detection result can carry.
At a target false positive rate of 1%, OpenAI's detector identified watermarks in about 80% of 200-token passages, compared with about 95% of 400-token passages, for content such as psychology. Detection rates were substantially lower for content such as mathematics, where there is less flexibility in word choice.
Editing weakens the signal fast. In an evaluation of 400-token passages, replacing 10% of words with synonyms reduced detection from about 92% to 66%. Replacing 25% of words reduced it to 17%.
Read that second figure again if you commission copy from an agency. A light human edit pass, the kind most teams already run, cuts detection by roughly a third. A heavier rewrite all but removes it.
Watermarking does not appear to cost output quality
Across the benchmarks OpenAI uses to assess Astra, its latest frontier model, the company reports no meaningful performance differences with and without watermarking.
| Benchmark | Unwatermarked (Astra, max) | Watermarked (Astra, max) |
|---|---|---|
| Artificial Analysis Intelligence Index | 49.57 points | 49.76 points |
| AutomationBench | 34.09% | 34.86% |
| DeepSWE v1.1 | 72.80% | 71.68% |
| Terminal-Bench 4.0 | 53.90% | 56.06% |
| Terminal-Bench Science 0.1 | 56.90% | 60.00% |
| BrowseComp | 87.92% | 87.35% |
| HealthBench Professional | 64.27% | 64.60% |
| GPQA Diamond | 94.44% | 93.94% |
GPQA Diamond moves from 94.44% unwatermarked to 93.94% watermarked. Terminal-Bench 4.0 moves from 53.90% to 56.06%. On OpenAI's own numbers, the quality objection to switching watermarking on in the API does not hold. If you want the wider context on Astra's economics, see our note on how Astra halved Parallel's research time and cost.
Why the EU gets this first, and what the image precedent tells you
OpenAI already ships public provenance tooling for other media. Its openai.com/verify web tool and its Content Provenance API remain publicly accessible to organisations that want to check whether an image or audio file came from one of its systems. Text is the exception: the detector is gated.
That gap is the story. With images, anyone in your team can check a file today. With text, you cannot check anything yourself unless you are an approved researcher or expert organisation. You will be told that provenance exists without being given the means to read it.
The regional split matters too. OpenAI says the EU-only default gives it room to learn from real-world use and feedback. The practical effect is that European law now sets the product specification, and the rest of the world receives it later, if at all.
What this changes for CMOs, growth leaders and agencies
In plain English: text produced by ChatGPT and Codex for your EU users will soon be detectable as machine-generated by anyone OpenAI approves, and you can choose to make your own API-generated text detectable everywhere, starting now.
- Agency deliverables: if your agency drafts in the EU ChatGPT interface, the output will carry an invisible watermark by default within weeks. Your contracts probably say nothing about this. Ask what tools they use, in which region, and whether output is edited after generation.
- Your own API stack: opt-in watermarking is a deliberate choice you now have to make for product copy, support replies, programmatic pages and in-app text. Off by default means doing nothing is also a decision, and one you will have to defend.
- Disclosure in EU markets: the EU AI Act's machine-readable text requirement is what prompted this change. Deciding how you disclose AI-assisted output is now a marketing operations question, not a legal afterthought.
- Measurement and audit: watermarking gives you a route to audit which content in your estate was machine-generated, provided you keep the generation logs that the watermark cannot give you.
- Risk from agentic workflows: if agents are drafting and publishing on your behalf, provenance needs to be set at the pipeline level. Our piece on always-on agents landing on business plans covers why that governance layer is now urgent.
From my observation of how in-house teams handle this, the first failure point is not policy, it is procurement. Nobody asks the agency which interface the draft came from.
What a missing watermark does not prove
OpenAI is unusually direct about the limits, and marketing leaders should repeat these limits internally before anyone starts policing writers.
A watermark does not measure human contribution. It does not establish ownership, lawfulness or responsibility. It does not identify the user. It does not verify accuracy. And the absence of a detected watermark does not prove human authorship, because the text may be too short, edited, translated, from an unsupported model, generated before watermarking, or produced by another company's tools.
The reverse risk is real too. A 1% target false positive rate sounds small until you run it across thousands of passages in a content audit. Accusing a writer on a single detection result is a disciplinary problem waiting to happen.
The counter-view: why this may matter less than it looks
A reasonable reading says this changes very little. Detection collapses to 17% after a 25% synonym swap, the detector is restricted to vetted bodies, and the EU-only default means most global content is untouched at launch. On those facts, textGrain is a compliance artefact, not an enforcement tool.
My read is that the direction of travel is what counts. Provenance signals rarely get weaker, open-sourcing the technology widens who can detect, and cloud partner availability puts watermarking inside enterprise stacks within weeks. Build the disclosure habit now, while nobody can check you.
What to do about textGrain this week
- Decide, in writing, whether API text watermarking is on or off for each production workload. Record the reason.
- Email your agencies and freelancers. Ask which assistants they use, in which region, and whether EU-generated drafts are involved.
- Draft a one-page AI disclosure standard for EU-facing content, covering what you label, where, and in what wording.
- Ban detection results as evidence in any contractor or employee dispute until your policy says otherwise.
- Check whether your organisation qualifies to apply for detector access, and decide if that is worth pursuing.
This textGrain briefing was published 5 October 2026 and last updated 5 October 2026.
