The Hidden Signature Coming to ChatGPT, and Why It Matters

On 6 October 2026, OpenAI opened an invisible signature program for text generated by ChatGPT and Codex in the European Union. It is expected to reach eligible users on all plans over the coming weeks. OpenAI says it does not currently intend to apply the same setting to users elsewhere.

This is not a cosmetic feature. It is the answer to transparency provisions in the EU AI Act that took effect on 2 August 2026, which require providers of AI-generated material to make that material identifiable by other systems.

The question that actually matters: are we building a way to tell human text from machine text, or a way to burn in a mark that can be removed?

Two different problems sharing one name

The word "watermark" implies something visible, like a line at the bottom of a document. What OpenAI is building is different: the mark is inserted into word patterns, so it is invisible to the eye but readable by a machine.

The first problem is detection. A detector takes text claimed to be AI generated and computes whether the mark is present. If it is, the text probably came from a model. That sounds simple, and it is better than nothing.

The second problem is removal. A mark embedded in language patterns can be lost. Copy and paste often destroys it. Re-typing a paragraph into another app shifts the word context far enough that the mark disappears while the text still reads identically to a human.

Those two problems cannot be solved by the same technique. A mark that survives copy and paste is easier to detect. A mark that is hard to detect is easier to lose.

Why regulation pushed this into the mainstream now

Marking AI text is not new. Through 2023 there were watermark experiments inserting patterns into a model's word choices, and very few survived copy and paste or paraphrasing.

What changed is regulatory pressure. EU AI Act transparency provisions supply a legal reason to ship a technically fragile method. When the requirement is "must be identifiable", the test is not whether the mark survives attacks, it is whether the detector works.

OpenAI's reasoning is simple: shipping a fragile method now is easier than engineering a durable one now.

Why detector access is restricted

This is the detail most often missed, and it is the most important one. OpenAI is not opening its detector to the public. Access goes first to approved researchers and specialist organisations.

The reason appears in their own published note: there are weaknesses in the technology, and those weaknesses are why the detector is being held back. A detector that misjudges, released to the public, gets treated as a verdict when all it offers is an estimate.

The company says the process does not reveal who produced the text. What gets marked is "this came from a model", not "this came from this person". That boundary matters for privacy, and it also limits how the evidence can be used.

OpenAI also reports that turning the watermark on had no meaningful effect on model performance in its testing. That is a claim from an interested party, so it should be read as a claim rather than a third-party verified result.

Claude, ChatGPT, and a difference with no technical reason

Anthropic went further. It has said it will watermark text generated by Claude globally, a decision that drew criticism from users who argued AI systems are being treated as the author despite substantial human input.

The policy split leaves a question unanswered: why does one company apply this globally while the other limits it to the EU? If the method is genuinely good, the technical case is the same everywhere.

The likely answer is not technical. Different jurisdictions have different processing obligations, and the term compliance makes more sense than the term method quality.

When the rules bind, and how heavy they are

The EU AI Act entered into force on 1 August 2024, and its obligations phase in. Prohibitions on high risk practices applied from February 2025. Transparency duties for generated content only bind from 2 August 2026, which is what OpenAI is responding to.

The penalties are not symbolic. For most transparency breaches the ceiling is 15 million euro or 3 percent of global annual turnover, whichever is higher. That is small next to the revenue of a large lab, and far larger than what many people expected when they assumed text marking was a consumer-level concern.

The complication is that the rule is geographic. OpenAI makes watermarking available through the API for selected models worldwide, but developers have to switch it on themselves. The method is therefore available everywhere while its adoption is not. Text marked inside the EU can lose that mark the moment it passes through an application that does not carry the requirement.

How the mark actually works

The mechanism is not one technology but a family of schemes with several variants. The principle is the same: the model is given rules for choosing words in a particular statistical way at particular positions in a sentence. Those rules need a key the detector knows. Without a key, the pattern that shows up in ordinary text is coincidence, and the detector becomes useless.

The simplest variant inserts a pattern across words of certain frequencies, so generated text carries a statistical tendency ordinary writing does not. More subtle variants distribute the signal across many positions at once, so deleting one section is not enough to remove it.

The trade-off here cannot be avoided. Rules too thin make the mark vanish under editing. Rules too heavy break the rules of language itself, and the model starts producing sentences that read strangely. Every method sits between those two limits, and none escapes them without cost.

Numbers that have not been published

OpenAI has not published a detection rate, a false positive rate, or what share of text stays marked after a copy and paste. Those three figures decide whether the method is useful, and none of them is public.

What can be said honestly: the company's claim that the watermark does not degrade model performance is a claim, not a third-party verified result. A method that has never been tested in the open will come under the same pressure as any other proprietary product.

Analysis: what marking actually changes

Three consequences can be projected, and all of them are already visible in how the method works.

First, text detection moves from being a credibility tool into infrastructure. Detectors currently used mostly by publishers and large platforms will be used by parties in academic and legal investigation, where the cost of a false positive is far higher than it is on social media.

Second, compliance cost lands in API pricing. Turning a watermark on means extra computation during text generation, and for a model already running close to its limits that cost is not zero. Developers whose applications need EU compliance get it without any change in behaviour, and the majority who do not care will never notice.

Third, and most likely to be missed, watermarking creates a new category of evidence that has no rules yet. If a text is marked as coming from a model, is that grounds for rejecting it? In discussions about plagiarism and thesis submission, that question has no settled legal answer in any jurisdiction.

Why AI text detection will never be finished

One thing needs stating plainly: no mark can prove where a text came from. Forensic evidence has advantages text detection does not have, physical fingerprints and DNA. Text has none of that.

What marking can do is raise the probability of detection on text no human has modified. That is useful for platforms that need bulk filtering, and useless for proving that one specific document was AI generated.

That distinction between the two uses gets lost in public argument. When someone shows that a detector is wrong, what is actually being refuted is the ability to detect text that has been changed. When someone shows that a detector found their case, what is being claimed is something considerably stronger.

What to watch

Three things. First, whether OpenAI's method survives copy and paste. Anyone who can get text out of ChatGPT can test that. Second, whether the restricted detector is eventually opened, and under what protocol. Third, whether Google, Meta and Microsoft actually run the voluntary code of practice on AI-generated content, or merely appear on a list.

What is already clear: watermarking moved from an academic experiment to a compliance requirement. The period in which "this text might be AI" could only be judged by feel is over.