ChatGPT is getting an invisible watermark. Do not mistake it for proof.
OpenAI is about to start invisibly watermarking ChatGPT and Codex text in the EU. It is a useful signal, but even OpenAI says it cannot prove who wrote something, how much a human did, or whether it is true.
OpenAI is about to start watermarking ChatGPT, and you will never see it. From this month, text generated by ChatGPT and Codex in the European Union will carry an invisible mark called textGrain. It does not add hidden characters, strange symbols or odd spacing.
It subtly shifts the statistical pattern of the words the model chooses, so a detector can later look for that fingerprint. On the surface it sounds like the answer to a question schools, publishers, businesses and governments have wrestled with for years. Was this written by AI?
There is a catch. Even OpenAI is warning people not to treat the watermark as proof of as much as they might assume. That distinction is the whole story.
What OpenAI is actually doing
OpenAI announced the change on 5 October, as part of its response to the transparency requirements in the EU AI Act. Over the coming weeks, eligible text generated through ChatGPT and Codex in the EU will begin carrying the invisible textGrain watermark. API customers elsewhere can opt in for supported models, but OpenAI is keeping it switched off by default outside the EU for now.
Rather than adding anything you could see, textGrain influences the model's choices between possible words as it generates an answer. Across a long enough passage, those choices form a statistical pattern that OpenAI's detector can look for. OpenAI says its internal testing found the approach matched or beat other methods it tried, including Google's SynthID for text.
That sounds impressive, but the more interesting part is what OpenAI says it cannot do.
A watermark is a signal, not a verdict
OpenAI has gone to some lengths to explain the limits. A detected watermark can show that an OpenAI system generated or processed some of the text. It cannot tell you who used the AI, who actually wrote the finished piece, how much a human contributed, who owns the words, or whether the information is even accurate.
It also cannot tell you whether someone edited the content afterwards. And a missing watermark does not prove a human wrote it. The text might be too short to carry the pattern.
It might predate watermarking, or come from a model that does not use the system. It might have been edited enough to weaken the signal. Or the detector might simply get it wrong.
OpenAI accepts that both false positives and false negatives are possible. That is why the detector is not being released publicly at launch. Access will start with approved researchers and expert organisations while the technology is tested in the real world.
Why the binary question is the wrong one
Whenever a new detection tool appears, there is a pull to turn a probability into a judgement. Watermark detected, AI wrote it. No watermark, a human wrote it. Reality is messier than that.
A student uses ChatGPT for an outline, researches independently, rewrites every section and submits their own essay. What does AI-written mean there? Someone writes an article, asks AI to sharpen three paragraphs, then edits the result again. Who wrote it? A business uses one agent to research, another to draft, and a person to fact-check and substantially rewrite.
A provenance signal can tell you something about the tools involved. It cannot tell you who deserves the authorship.
AI-generated and AI-authored are not the same thing
This distinction only grows as AI gets embedded in ordinary software. The first years of generative AI trained us to think in two boxes: human or AI. Increasingly the honest answer is both.
People use AI to research, organise, challenge, improve, analyse and edit, and agents now handle individual steps inside much larger pieces of work. Flattening all of that into one label, AI generated, can hide more than it reveals. What we actually need is better information about provenance: where something came from, which systems were involved, and what we can legitimately conclude.
That is a harder problem than spotting a pattern in some text.
Evidence has boundaries
There is a wider lesson here, and it reaches well beyond watermarking. AI systems produce an enormous number of signals: logs, confidence scores, success messages, verification results, provenance data, agent status reports. The question is never simply whether you have evidence. It is what that evidence actually proves.
If an agent reports that a task completed successfully, that proves the agent reported success. It does not prove the customer received the email, the record updated correctly, or the payment reached the right account. In the same way, detecting a watermark proves something specific about a provenance signal in a piece of text.
It does not answer every question about authorship, ownership or truth. Good AI governance depends on respecting those boundaries.
A careful launch, and why it matters
It is worth noticing how cautiously OpenAI has done this. No public detector inviting everyone to police each other's writing. No claim of perfect accuracy. No rush to make watermarking the global default. And an explicit list of what the technology cannot establish. That is the right instinct.
Text provenance could become an important part of the AI ecosystem, especially as generated content gets harder to tell apart from human work by eye. But provenance tools turn dangerous the moment a useful signal is treated as infallible proof. A watermark can tell us something. It cannot tell us everything.
As AI becomes part of normal work, understanding that difference may matter more than detecting the watermark at all.
Where to go next
- The AI agent observability problem The same lesson in operations: did the thing actually happen, or did the agent just say so?
- AI agents are misbehaving at scale. Now the industry is building the brakes. Why an instruction and an enforced boundary are not the same thing.
- AI Agent Security The full framework for identity, authority, verification and containment.
Trying to work out what AI evidence actually proves inside your business? That is exactly the kind of thing we help with.
Book a quick chat →Related: AI agents are misbehaving at scale. Now the industry is building the brakes..
Common questions
Does an OpenAI watermark prove who wrote something?
No. A detected textGrain watermark is evidence that an OpenAI system generated or processed some of the text. It cannot tell you who used the AI, who wrote the finished piece, how much a human contributed, who owns the words, or whether the content is accurate.
Does the absence of a watermark mean a human wrote it?
No. A watermark can be missing because the text is too short, predates watermarking, came from a model that does not use the system, was edited enough to weaken the signal, or because the detector simply got it wrong. OpenAI accepts that both false positives and false negatives are possible.
Can I use this to detect AI writing today?
Not directly. OpenAI is not releasing the detector publicly at launch. Access starts with approved researchers and expert organisations while the technology is evaluated in real-world conditions.