OpenAI textGrain: The EU-Only Watermark and Your 4 Choices

OpenAI is adding an invisible watermark to every word ChatGPT and Codex generate inside the European Union, and it left the feature off by default everywhere else, including the API. The mark is called textGrain. It rolls out over the coming weeks to eligible users on all plans in the EU, while API developers anywhere in the world get an opt-in switch for select models that ships turned off.

This is not a symbol inserted into the text. The model quietly shapes its own word choices so a detector holding a secret key can recognize the pattern, and the pattern rides along when a user copies and pastes. OpenAI published the math on October 5, 2026, in a technical report written with researchers from the University of Pennsylvania and Yale.

Watermarking just stopped being a research topic. It is now a regional setting on your text pipeline, and if your product generates text for EU users you have four choices. Picking none of them is still a choice.

The last time an invisible watermark shipped, coders found workarounds within hours, a history we covered in Encrypted Prompt Injection Bypasses Guardrails. That does not change the decision. It raises the stakes on it.

HOW TEXTGRAIN ACTUALLY WORKS

At the token level a language model produces a probability distribution over the next word. textGrain couples that sampling to keyed randomness, solving an optimal transport problem with costs based on Gumbel random variables and a KL penalty. The KL divergence from independence equals the reduction in conditional entropy, which is why the paper calls the method entropy-calibrated. In plain terms, the model steers its next-token distribution toward a bias a key holder can test for.

The mechanism explains both of its properties. Because the mark lives in word choice, it survives copy and paste, and it needs no metadata or container format to travel. Because it needs the secret key, only the issuer can verify it.

Structured output is where the mark runs out of room, and that matters more than anything else on this page for anyone shipping agents. Agentic workflows run on JSON schemas, YAML, and precise function calls, and those formats are rigid by definition. A tool call has one correct shape, its keys are fixed, and its punctuation is not negotiable. The watermark lives in low-stakes choices where several words would work equally well, so a schema with no room for synonyms has no room for a signal. The mark does not just weaken during structured agent execution, it largely disappears, because the entropy the method needs is not there to spend. Worse, any attempt to force it would mean bending syntax to satisfy a detector, which is the one place you never want a probability nudge. Your function-calling layer is effectively unwatermarkable, and it is also the layer where a corrupted byte breaks the whole run.

OpenAI reports no meaningful change in model performance with the watermark on, and it benchmarked watermarked against unwatermarked output. It also published the failure modes. Editing erodes the signal, and in one test replacing 10 percent of words with synonyms dropped detection from about 92 percent to 66 percent. Short passages, math answers, and translated text are harder to detect, because those are exactly the places where the model has fewer low-stakes word choices to spend.

The newbie line is this: it is not Content-ID for paragraphs. It is a probability fingerprint, and it is fragile by design.

WHY IT IS REGIONAL AND WHY THAT IS THE WHOLE STORY

The driver is the EU AI Act. The Article 50 transparency obligations took effect on August 2, 2026, and they require providers of generative systems to mark output in a machine-readable way. Roughly 190 organizations signed the European Commission's Code of Practice on Transparency of AI-Generated Content in July, with OpenAI, Anthropic, Google, Meta, and Microsoft among them. Breaches carry penalties up to 15 million euros or 3 percent of global annual turnover.

Anthropic moved first. On August 14 it disclosed that every Claude model released after August 2 embeds a SynthID-Text based watermark in all generated text, enabled by default with no user opt-out, and applied worldwide because the company had not yet built a way to scope the mark by region. Google has run SynthID-Text inside Gemini since 2024, and testing on roughly 20 million live responses showed a 0.01 percentage point difference in likes. OpenAI says textGrain matched or exceeded SynthID for text in its own testing, and it shipped something its rivals did not: a regional switch.

That is the real story. The two leading US labs both watermark in Europe, and they arrived there through opposite tradeoffs. Anthropic watermarks everywhere because it could not localize the mark. OpenAI localized it and therefore only marks the EU. Either way, the same model now emits marked text in Dublin and unmarked text in Dallas.

Regional marking gets harder once you put agents in a loop, and this is the part most teams have not thought through. An EU-based planner emits watermarked text into a scratchpad, a memory store, or a vector database. A sub-agent then reads that context back, summarizes it, and re-prompts on top of it. Every one of those steps is an edit, and you already know what editing does to the signal. The mark does not survive a multi-agent round trip intact. It degrades, drifts, or disappears entirely, and no single hop in the chain is doing anything wrong. The signal is being laundered by ordinary state management. So if your compliance story rests on the assumption that marked input stays marked through your orchestration layer, that assumption is wrong, and you will find out at the worst possible moment.

For an engineer, that means compliance is a per-region code path. Your stack has to know where the user is, what the vendor is doing with that user's traffic, and which regime it is operating under. If your architecture assumes one global model behavior, the EU just falsified that assumption.

THE 4-CHOICE WATERMARK STACK

If your product generates user-facing text, you have exactly four postures, and each one has a cost. Name yours and you can defend it.

• DETECT. You run watermark checks on inbound content, resumes, submissions, support tickets, to flag machine text. The cost is access. OpenAI is handing detector keys only to approved researchers and expert organizations, and it says detection is not guaranteed. In practice you are left with third-party detectors of uncertain accuracy, and a false positive on a job applicant is a lawsuit waiting to happen.
• STRIP. You paraphrase or rewrite generated text before it leaves your product. The cost is twofold. You may degrade output quality, and you are actively defeating a disclosure system regulators just mandated. The mark is a statistical artifact of word choice, so rewriting is precisely the attack OpenAI's own report documents. Flag the ethics and the exposure plainly, because a regulator reading your release notes will.
• PRESERVE. You pass watermarked text through untouched and keep provenance metadata alongside it. The cost is near zero, and it is the only posture that gets stronger as more labs switch watermarks on. Your pipeline records the model, the version, the date, and the watermark status, and downstream consumers can trust that record because you did not tamper with the artifact.
• IGNORE. You do nothing. The cost is that you inherit whatever rule the next regulator writes. The EU AI Act path shows those rules arrive with dates attached.

That is the framework. Detect, strip, preserve, ignore. Pick one per emission point, not one for the whole company.

WHAT WATERMARKS DO NOT DO

OpenAI is unusually clear about the limits. textGrain does not verify accuracy. It does not establish ownership. It does not measure human contribution. It does not prove human authorship. It only signals that the text likely came from the model, and it does not identify the user who generated it. It also gives you nothing usable on the structured output that agentic systems run on, because a JSON payload has no low-stakes word choices to mark in the first place.

That list should end an entire product category. Anyone building a plagiarism workflow or a fraud detector on top of this mark is building on a signal the issuer already disclaimed. A missing watermark does not prove human authorship either, because the text may be too short, too heavily edited, or produced by a competitor's model. The absence of a mark is not evidence of a human.

The mark answers one question: was an OpenAI model probably involved at some point. Every other meaning you want it to carry is inference you own.

WHAT TO DO TODAY

• Inventory every place your product emits generated text, and note which of the four postures each one uses today. Most teams will find four different accidental answers.
• If you serve EU users, confirm with your model vendor whether your traffic is watermarked and whether API opt-in is on or off. The default is off. Check it, do not assume it.
• Add a provenance field to your content pipeline now, before you need it: model, version, date, watermark status.
• Do not buy a third-party detector and call it compliance. OpenAI says detection is not guaranteed, and the workaround history in Encrypted Prompt Injection Bypasses Guardrails says the same, as does our earlier Note The Detection Delusion.
• Watch the API opt-in. When the off-by-default flips, and it will, the regional setting becomes your setting.

THE UNCOMFORTABLE QUESTION

On September 30, Google DeepMind announced SynthID Bio, watermarking for AI-designed proteins. The team hid signatures in amino acid sequences and in predicted 3D structures, and in wet-lab testing reported in Nature the watermarked binders still bound VEGF-A, PD-L1, and the receptor-binding domain of the SARS-CoV-2 spike protein. The mark survived synthesis into a physical molecule, which is a stricter provenance problem than any paragraph. The paper is honest about the limits too: resequencing a design with an unmarked sequence tool removes the sequence watermark, and standard structural relaxation destroys the structure watermark.

The same week the mark landed on your text pipeline as a region toggle, it also landed inside a molecule. If provenance is becoming part of the substrate everywhere else, why is your text pipeline still the one place that prefers not to know?