Three months after the EU AI Act's Article 50 began to bite, OpenAI finally published its compliance plan on October 5: a proprietary text watermarking technology called textGrain. It will be enabled by default for ChatGPT and Codex users in the European Union, while global API customers will have to opt in manually. At the same time, the watermark detector will be open only to invited researchers and expert organisations, not to the general public. This is OpenAI's first attempt at taking text provenance to the "factory" level, and it follows Anthropic's August announcement that it would adopt Google DeepMind's SynthID-Text.
What textGrain actually does
According to OpenAI's official blog, textGrain injects an invisible statistical signal into the model's word-choice process during generation, so that the produced text carries a fingerprint the detector can recognise but readers cannot see. The detector only needs a sufficiently long passage to judge, at a probability well above chance, whether OpenAI's models generated the text. OpenAI frames the technology as a content-provenance tool, not as a verdict on truth, ownership, or user identity. Notably, the company says it plans to release the technology as open source so the broader community can build on it.
Detection performance: looks good on paper, less so in the wild
OpenAI shared its own evaluation data in the blog post. At a 1% target false-positive rate, the detector identifies watermarks in about 80% of 200-token psychology passages, climbing to about 95% at 400 tokens. For mathematics, where the space of valid word choices is much tighter, detection drops substantially. OpenAI's own chart makes this gap explicit.
The numbers get uglier once editing enters the picture. Replacing 10% of words with synonyms in a 400-token watermarked passage dragged the detection rate from about 92% down to 66%. Replace 25% of the words and only 17% survive. In other words, light paraphrasing is enough to erode the signal quickly. That matches what independent researchers reported two months ago when they cracked Anthropic's watermark hours after launch: text watermarks hold under a "verbatim redistribution" assumption, but fall apart once humans start rewriting, which is exactly what happens on most platforms.
Impact on model quality: essentially zero
OpenAI also ran its Astra frontier model through a paired benchmark suite, watermarked versus not. The deltas sit comfortably inside the noise band: Artificial Analysis Intelligence Index 49.57 vs 49.76, AutomationBench 34.09% vs 34.86%, DeepSWE v1.1 72.80% vs 71.68%, Terminal-Bench 4.0 53.90% vs 56.06%, BrowseComp 87.92% vs 87.35%, GPQA Diamond 94.44% vs 93.94%. In other words, the watermark mechanism costs almost nothing in generation quality. The engineering implication matters more than the raw numbers: textGrain is cheap on the inference path. It works inside the sampling step rather than after the fact, which is what makes a global rollout plausible.
What the watermark does not tell you
Unlike much of the hype around detection, OpenAI's post draws explicit lines. The watermark does not measure human contribution. It does not establish ownership or responsibility. It does not identify the user, account, prompt, or conversation. It does not verify whether the text is true, misleading, or harmful. And the absence of a detected watermark does not prove human authorship, since short passages, edits, translations, unsupported models, or pre-watermark outputs all read as "no watermark". That active boundary-drawing is important in a regulatory context. If platforms later use detector results to label content directly, OpenAI has already placed the disclaimer in the documentation.
Why the EU first, not the world
OpenAI picked the "EU default on + global API opt-in + detector limited to researchers" path rather than a global default. The reasons hide in the Article 50 enforcement calendar. Other jurisdictions have no equivalent "machine-readable" mandate yet, so a global default would create compliance friction and commercial friction alike, especially for API customers who worry about watermark signals weakening the exclusivity of their content. Meanwhile, restricting the detector to research institutions lets OpenAI accumulate real-world samples and iterate, without exposing itself to the public backlash that detection errors would generate.
The watermarking arms race, moving from pixels to tokens
In hindsight, the difficulty of text watermarking is fundamentally different from image watermarking. Images are a perceptually redundant modality: a few perturbed pixels don't break the visual. Text is a discrete-symbol modality: any word substitution changes meaning. OpenAI's choice to inject the statistical signal at the sampling stage, rather than rewrite after the fact, is itself an acknowledgement that text watermarking has to happen at generation time. But that also means the technology cannot protect open-source models, privately fine-tuned models, or any downstream application that consumes the OpenAI API and re-ranks tokens itself. The real coverage footprint of textGrain is probably much smaller than the marketing.
More importantly, OpenAI says it will work with cloud partners to extend watermarking through their distribution channels. That is an explicit signal: compliance-driven watermark deployment is moving from "the model vendor alone" toward "the model plus the cloud platforms on both ends". The next test will not be whether the detector works, but whether platforms are willing to use detector results as a content-distribution decision, and whether users are willing to pay the cost of being labelled "AI-generated".