How text watermarks work and what EU Article 50 requires

Article 50(2) of the AI Act says providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content shall ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.

2. Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated.

Article 50(2) says providers shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art.

Providers shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical standards.

The European Commission says the Article 50 transparency obligations are applicable from 2 August 2026, and that adherence to its Code of Practice on transparency of AI-generated content is voluntary while the Article 50 requirements are legal obligations.

OpenAI's textGrain technical report says a language model generates text one token at a time, sampling each token (a word or part of a word) from a next-token prediction distribution determined by the preceding text.

A language model generates text one token at a time, sampling each token (a word or part of a word) from a next token prediction (NTP) distribution determined by the preceding text.

The report says watermarking embeds a statistical signal by modifying this sampling using pseudorandom values derived from a secret key and the preceding context.

Watermarking embeds a statistical signal by modifying this sampling using pseudorandom values derived from a secret key and the preceding context

The report says textGrain applies an entropy budget that limits the average loss of sampling entropy to a fraction of the next-token prediction entropy.

An entropy budget limits the average loss of sampling entropy to a fraction ... of the NTP entropy.

The report says the detector requires only the generated text and the secret key, and does not need to know the budget used during generation.

The detector requires only the generated text and the secret key and does not need to know the budget used during generation.

The report says the detector reconstructs the keyed values at each scored position, derives a score from the observed token, and sums the scores to compare with the distribution of that sum for unwatermarked text.

The context window and key reconstruct the cost table and selected column ... The cost for the observed block ... is transformed into the score ... Repeating this procedure at the scored positions yields Y1, ..., Yn. Their sum is compared with its distribution under unwatermarked text to test for a watermark.

The report says a watermark is declared when the sum exceeds the (1 - alpha) quantile of that distribution, so that under its stated assumptions the conditional false positive rate is alpha.

we declare a watermark when Sn exceeds this distribution's (1 - alpha) quantile. The conditional false positive rate is alpha under these assumptions

OpenAI says that at a target false positive rate of 1%, its detector identified watermarks in about 80% of 200-token passages, compared with about 95% of 400-token passages, for content such as psychology, and detection was substantially lower for content such as mathematics.

At a target false positive rate of 1%, our detector identified watermarks in about 80% of 200-token passages, compared with about 95% of 400-token passages, for content such as psychology. Detection rates were substantially lower for content such as mathematics, where there is less flexibility in word choice.

OpenAI says that in an evaluation of 400-token passages, replacing 10% of words with synonyms reduced detection from about 92% to 66%, and replacing 25% of words reduced it to 17%.

In an evaluation of 400-token passages, replacing 10% of words with synonyms reduced detection from about 92% to 66%. Replacing 25% of words reduced it to 17%.

OpenAI says the absence of a detected watermark does not prove human authorship, and that a watermark does not identify the user.

A watermark does not identify the user. ... The absence of a detected watermark does not prove human authorship.