Text is a terrible place to hide a signature.
That is the technical problem OpenAI has decided to take on. On October 5, 2026, the company said it would begin adding an invisible watermark to eligible text generated by ChatGPT and Codex in the European Union, rolling out over the coming weeks. The trigger is the EU AI Act. Article 50, which requires machine-readable marking of AI-generated content, has applied since August 2, 2026, and systems already on the market have until December 2 to comply.
For API customers, the feature stays off by default. Developers anywhere in the world can opt in for select models. That asymmetry is the most interesting part of the announcement, and I want to spend most of this piece on why.
Why text watermarking is structurally hard
Watermarking an image means perturbing pixels that nobody inspects individually. You have thousands of redundant dimensions to hide in. Text has none of that slack. Every token is read, every token carries meaning, and the only place to hide a signal is in the choice between tokens that a model considered roughly equally good.
The published approaches in the research literature work along those lines. A key derived from recent context partitions the vocabulary, and sampling is nudged toward one partition. Do that across enough tokens and a verifier holding the key can measure a statistical skew that is implausible under unwatermarked text. OpenAI has not published the specifics of its scheme, so treat that as background on the problem class rather than a description of their implementation.
The consequences of that design fall out quickly:
- Length matters. Statistical signals need samples. A long essay carries a detectable skew. A two-line reply, a commit message, a JSON field, probably does not.
- Entropy matters more. The signal lives in sampling freedom. Where the model has only one reasonable next token, there is nothing to encode. Low-entropy output is nearly invisible to this class of technique.
- Editing degrades it. Paraphrasing, translation, or routing text through a second model attacks the exact thing being measured.
Codex is the hard case
Including Codex in the EU rollout is the detail that caught my attention, because code is the worst substrate for this family of methods. Syntax constrains the next token hard. Identifiers must match their declarations. Formatters rewrite whitespace. Linters rewrite style. A code block passes through more normalization between generation and storage than almost any other text artifact. Whatever survives that pipeline is doing so under conditions the academic benchmarks rarely model.
What the API default tells us
If watermarking were free, it would be on everywhere. It is off by default in the API, which means someone weighed a cost. Reporting on the announcement includes a partial OpenAI statement that across the benchmarks used to assess Astra, its latest frontier model, the company does not see meaningful performance differences. The quote circulating is truncated, so I will not over-read it. What I will say is that aggregate benchmark parity and per-request behavior are different claims. Any sampling-level intervention changes the output distribution. Benchmarks average that away. A developer running structured extraction with a strict schema, or a deterministic build step, lives at the tail where averages do not help.
There is also a plumbing argument. API output is an intermediate value. It gets concatenated, templated, re-embedded, cached, and fed to the next model in the chain. A provenance mark attached to text that is never shown to a human is overhead without a reader. Defaulting it off respects that.
The part that matters for agent architecture
The regional split means the same model family now behaves differently depending on where the request lands. For anyone building multi-agent systems, that is a new variable in the stack. Output from an EU-served ChatGPT or Codex session may carry a mark. The same prompt against the API, outside the EU, with the flag off, will not. Reproducibility across regions is no longer something you can assume.
And in a pipeline, provenance does not compose. When agent A drafts, agent B critiques, and agent C rewrites, the final artifact is a blend. A watermark detectable in A’s draft may be diluted below threshold by the time C is done. What the EU AI Act asks for is a property of a document. What agent systems produce is a sequence of transformations where authorship is distributed across models, tools, and humans.
This rollout is a reasonable compliance move and a genuine engineering effort. It is not a provenance solution for agentic software. Those remain two separate problems, and only one of them has a December deadline.
🕒 Published: