Will EU text watermarks prove AI authorship?
No. OpenAI's new textGrain signal can indicate that eligible text passed through a supported system, but its own tests show detection falls sharply after editing and cannot establish who wrote, owns or verified a passage.
The short version
- What happened
- OpenAI says API customers can opt in globally from 5 October, while eligible ChatGPT and Codex text in the EU will receive the watermark over the following weeks; the API setting remains off by default.
- Who it affects
- Writers and students could be wrongly accused if institutions treat a probabilistic detector as proof rather than one uncertain signal.
- What remains unproven
- Detection results and benchmark comparisons were reported by OpenAI; no independent replication or public detector was available at publication.
Keep in mind
Detection results and benchmark comparisons were reported by OpenAI; no independent replication or public detector was available at publication.
The rollout page does not disclose the number of prompts, generations or repeated runs behind the reported detection percentages.
The disclosed robustness test uses English ELI5 passages and synonym replacement, not a comprehensive sample of languages, genres or real editing workflows.
The technical report states idealised assumptions for false-positive calibration and warns that production keys and finite-precision implementations need empirical checks.
A detected watermark cannot identify a user, quantify human contribution, establish ownership or responsibility, or verify factual accuracy.
Multi-source analysis · 3 linked sources. Primary analysed source date: 5 October 2026. Earliest linked supporting source: 31 July 2026.
Read the full report · 8 min The evidence, methods, implications and limitations
The answer is no: the signal is evidence of processing, not authorship
OpenAI's new textGrain watermark is designed to leave an invisible statistical signal in eligible model output. A detector with the secret key can test whether word choices carry that signal. That can provide evidence that a supported OpenAI system generated or processed part of a passage, but it cannot identify the person behind the text, measure how much a human contributed, prove ownership, establish legal responsibility or verify that the claims are accurate.
That distinction matters because the strongest everyday interpretation — 'the detector proves AI wrote this' — goes beyond the disclosed evidence. OpenAI itself says the absence of a detected watermark does not establish human authorship. A passage may be too short, too constrained, edited, translated, produced by an unsupported model, generated before the rollout or created by another provider. A positive result is similarly narrow: it detects a keyed statistical pattern, not the intent, identity or truthfulness of an author.[1][2]
What is changing for API and EU users
From 5 October, OpenAI says API customers worldwide can opt in to watermarking for selected models. The API option remains off by default. Over the following weeks, the company plans to add the signal to eligible ChatGPT and Codex text output for users in the European Union across all plans. It is not making text watermarking a global consumer default at launch, and it has not published a precise completion date or a public list of every eligible model and response type on the announcement page.
Detector access is also restricted. OpenAI is accepting applications from approved researchers and expert organisations rather than releasing a public checker. The European Commission says Article 50 transparency duties, applicable from 2 August 2026, require provider-side machine-readable marking and detection as far as technically feasible. Its voluntary Code of Practice is one recognised route for demonstrating compliance, but the law and code do not turn an imperfect technical signal into proof about a person or publication.[1][3]
The disclosed evaluation shows both usefulness and fragility
OpenAI tested English responses to questions from the ELI5 dataset, including psychology and mathematics content. At a chosen false-positive target of 1%, the company says its detector found the watermark in about 80% of 200-token psychology passages and about 95% of 400-token passages. Performance was substantially lower for mathematics, where a model has less freedom to vary word choice. The release therefore supports a limited conclusion: longer, flexible prose is easier to mark than short or tightly constrained text.
Editing is the more serious operational weakness. In a 400-token test, replacing 10% of words with synonyms reduced detection from approximately 92% to 66%. Replacing 25% reduced it to 17%. Those are large changes produced by mechanical substitution rather than a complete rewrite. The announcement does not state the total number of prompts, generations or repetitions behind the percentages, nor does it report confidence intervals, language coverage, translation tests or independent replication. They should be treated as vendor evaluation results, not a settled public error rate.[1]
How textGrain works — and what the technical report actually proves
The accompanying 20-page report describes a generation procedure rather than the public deployment study. During each token choice, textGrain uses keyed pseudorandomness to group vocabulary items and slightly alter how a model samples among those groups. An optimal-transport calculation balances two aims: creating dependence on the secret key, which makes detection possible, and limiting the amount of sampling entropy removed, which is intended to preserve output diversity and quality.
The detector reconstructs keyed scores from the observed text and compares their sum with an idealised null distribution. The mathematics gives a conditional false-positive rate under assumptions that unwatermarked text is independent of the key and that pseudorandom values behave as specified across distinct contexts. The authors explicitly warn that a fixed deployed key, finite-precision computation and real applications require empirical calibration. The report does not itself supply the ELI5 field results, real-world misuse testing or an external audit; theoretical calibration and operational reliability are different questions.[2]
Benchmark quality stayed close, but equality is not established
OpenAI also compared watermarked and unwatermarked Astra outputs on eight benchmarks. Scores were close but moved in both directions: DeepSWE v1.1 fell from 72.80% to 71.68%, BrowseComp from 87.92% to 87.35% and GPQA Diamond from 94.44% to 93.94%, while Terminal-Bench Science rose from 56.90% to 60.00% and other tests changed by smaller amounts. The company says it saw no meaningful performance difference.
That table is reassuring as a screening check, but it does not report uncertainty, run counts or paired significance tests. A small average shift on benchmark tasks also cannot answer whether watermarking changes tone, originality, minority-language quality, repeated generations or safety-critical wording in use. The technical report frames the design around a controllable entropy-loss budget; the public evidence needed next is a pre-registered evaluation that connects that design parameter to quality and detection across languages, task types and ordinary editing workflows.[1]
What this means for readers, publishers and institutions
For a reader, a watermark result should be one provenance signal, not a verdict. Schools, employers, publishers and courts risk harming people if they treat detection as proof of misconduct, particularly when the announced target still permits false positives and when altered AI text can escape detection. OpenAI's decision to limit detector access may reduce casual misuse during evaluation, but it also means ordinary users cannot independently check or challenge a result through a public tool at launch.
For publishers and platforms, machine-readable marking may help route content for further review, preserve evidence when visible labels are removed and support EU compliance. It does not replace editorial responsibility, source verification, human disclosure or open metadata. The Commission's rules recognise technical feasibility and content-specific limits; implementation will need procedures for appeals, uncertain results, mixed human-AI text, accessibility and multilingual material rather than a binary machine-versus-human badge.[1][3]
What would change the assessment
Confidence would rise with an independent, multilingual evaluation reporting prompt counts, repeated generations, confidence intervals and results for paraphrasing, translation, summarisation, copy-editing and mixed-source documents. The test should compare textGrain with unwatermarked writing from people and other models at fixed false-positive thresholds, and it should measure subgroup effects for short answers, constrained technical language and assistive writing.
The most important evidence will come after rollout: calibrated error rates under fixed production keys; transparent eligibility and coverage rules; a documented appeal process; independent governance of detector access; and proof that institutions do not use the signal as a standalone accusation. Until then, textGrain is best understood as a promising but fragile provenance layer. It may help show that compatible software touched a passage, but it cannot prove who authored it or whether the text deserves trust.[1][2][3]