ChatGPT watermark easy to erase. What does that mean for companies writing with AI?

In the coming weeks, OpenAI will enable watermarking of texts from ChatGPT and Codex by default in the European Union. According to the company's own tests, it is enough to rewrite one fifth of a text for the detector to stop recognizing it in most cases.

OpenAI has announced that in the coming weeks it will begin automatically marking texts generated by ChatGPT and the Codex developer tool for users in the European Union. The change applies to all subscription plans. Outside the EU, the feature will be available but disabled by default.

The company is not doing this on its own initiative. Since August 2, Article 50 of the EU AI Act has been in force. It requires AI-generated content to be machine-detectable. This is not about putting “generated by AI” under every paragraph, but about a signal that software can read. We checked whether such a mark can really distinguish machine-written text from human-written text and what it means for companies that use AI to write offers, posts, and job ads.

How textGrain works, the mark hidden in word choice

OpenAI's system is called textGrain. It is the company's proprietary solution, and its operation was described in a published technical paper. It does not add hidden characters, spaces, or metadata to the text, because those disappear with ordinary copying and pasting.

The mark is created at the stage of choosing successive words. At each next word (token), the language model calculates which words may appear. textGrain divides them into two groups based on a secret key and the preceding fragment of text. It then slightly favors words from the preferred group, as long as this does not harm meaning or fluency. A human will not notice the difference. A detector that knows the key, however, sees a statistical excess of words from one group.

The detector will not be public. OpenAI will provide it to a limited number of researchers and organizations, and others will be able to apply for access. The company explains this by the limitations of the technology itself. It also prefers not to make it easier to build tools that automatically remove the mark.

The company's own tests show how fragile this mark is

In the best-case scenario from OpenAI's tests, the detector recognizes marked text in 92 percent of cases. That is a decent result, but not certainty. Editing performs worse. According to the same tests, changing 10 percent of the text reduces detection effectiveness by almost 30 percent, and changing 20 percent of the text by almost 75 percent.

Effectiveness also drops with short passages and translated texts. It is also clearly lower where the model has little freedom in word choice, for example in mathematical texts. Ordinary editing, changing sentence order, or replacing synonyms is enough to blur the pattern. A text run through another model with a request to rewrite it “in its own words” loses the mark completely. Ars Technica assesses that these are results similar to earlier, similar marking systems.

The conclusion is simple: the lack of a mark proves nothing. The text may have been created in another model, shortened, translated, or revised by a human. The detector will therefore mainly find texts from people who did not bother to change them.

The mark says something about AI involvement, not authorship

OpenAI itself warns that detection can produce both false alarms and misses. In its statement, the company also describes what the mark does not measure at all:

This caveat has practical significance. An author who used ChatGPT only to polish style or translate their own text may get the same signal as someone who pasted a ready-made answer. When Anthropic introduced similar marking in the Claude model in August, users on industry forums protested for exactly this reason. Their argument: they provide the context, structure, and substantive decisions, while the model is a tool like a text editor.

The scope also differs. Anthropic enabled marking globally. OpenAI is doing it by default only where required by law, and in the API (the programming interface through which companies connect models to their own tools) it leaves the feature turned off with an option to enable it. Companies using models through their own integrations will therefore decide for themselves whether their content will carry the mark.

What this means for marketing, sales, and HR

The watermark is the model provider's obligation, meaning OpenAI's. A company that publishes content created with AI assistance has separate obligations under the AI Act as a user of the system. These apply, among other things, to texts published for the purpose of informing the public about matters of public interest. According to analyses by law firms including Orrick, Mishcon de Reya, and Herbert Smith Freehills Kramer, the disclosure obligation does not apply if the text has undergone reliable human editing and a specific person or entity assumes editorial responsibility for the publication. The same analyses, citing European Commission guidelines, indicate that ordinary spelling, grammar, or formatting corrections do not fall within the scope of Article 50.

The regulation has reach beyond the Union: it also covers companies outside the EU if the output of their system reaches users in the Union. Violations of transparency obligations can result in fines of up to 15 million euros or 3 percent of global annual turnover, whichever amount is higher.

For teams that use AI every day, it is therefore more sensible to rely on their own process than on a watermark. In practice, this means:

• writing down what kinds of content the team uses AI for and who approves them,
• documenting human editing: who reviewed the text, according to what rules, and who is responsible for it,
• giving up AI detectors as evidence in recruitment or employee assessment,
• checking whether marking should be enabled in API integrations.

Whether a specific publication requires marking depends on its nature and context. If in doubt, it is worth consulting a lawyer familiar with the AI Act, because some interpretations are only now taking shape.

Does it work? As a statistical tool yes, as evidence no

textGrain is meant to satisfy the letter of the law: text from ChatGPT in the EU will be marked in a way that machines can read. It will not, however, determine who wrote a text that someone has even slightly rewritten. The industry treats watermarks as one of the elements of tracking content provenance, alongside C2PA metadata (a standard that records information about the origin of files) used mainly in images and video. None of these methods is airtight.

For companies, the editorial conclusion is practical. A watermark does not relieve them of responsibility for published content and will not replace internal rules for working with AI. It is safer to have a documented editing process than to count on a detector settling something one day.