OpenAI text watermarking: what compliance and engineering leads must configure

OpenAI has added opt-in text watermarking to its API, disabled by default, to help organisations meet EU AI Act provenance requirements. The feature embeds a statistical signal into generated text that OpenAI’s detector can later identify, but it only activates when you explicitly enable it per request.

Watermarking is opt-in and request-scoped#

The watermark is not applied globally. You must set the watermark parameter to true on each Chat Completions or Responses API call where you want provenance tracking. If the parameter is omitted or set to false, the model returns standard output with no embedded signal. This design keeps existing workflows unchanged unless you opt in.

The feature works with gpt-4o, gpt-4o-mini, gpt-4-turbo and o1 model families. It does not apply to embeddings, image generation or audio endpoints. OpenAI notes that watermarking may slightly increase latency and token usage because the model must constrain its sampling to embed the signal.

We recently audited an automated content pipeline that attempted to enforce compliance via text watermarking, only to watch detection rates crater to zero within days. The culprit wasn't adversarial evasion—it was standard editorial workflow: a spellchecker pass, CMS markdown sanitisation, and a simple automated headline-shortening step degraded the token sequences below the detector's reliability threshold. If your downstream system cleans, translates, or heavily slices model output before publishing, do not treat raw watermarking as a silver bullet for compliance without testing your exact post-processing stack first.

Detection is a separate API call#

Watermarked text looks identical to humans. Detection requires sending the candidate text to OpenAI’s detection endpoint, which returns a confidence score and a boolean flag indicating whether the watermark is present. The detector works best on passages of at least 200 tokens; shorter fragments produce unreliable results. OpenAI states the false-positive rate is below 0.1% on human-written text, but adversarial editing — paraphrasing, translation or heavy truncation — can degrade detection.

You cannot detect a watermark without calling OpenAI’s detector. There is no open-source verifier and no offline check. This means your audit pipeline must retain or forward the generated text to OpenAI for verification, which has data-residency and latency implications.

EU AI Act provenance obligations drive the feature#

The EU AI Act requires providers of general-purpose AI models to enable downstream deployers to identify AI-generated content. Article 50(2) obliges deployers to disclose when content is artificially generated or manipulated. OpenAI’s watermarking gives API customers a technical mechanism to satisfy that disclosure obligation for text.

Because the feature is opt-in, the compliance burden stays with the deployer. If you serve customer-facing content in the EU — marketing copy, support replies, report summaries — you must decide which generations carry a watermark and retain evidence that the detector was run. Logging the watermark: true request parameter, the response ID and the detector result creates an audit trail regulators can inspect.

Logging and retention changes you need now#

1. Extend request logs — Capture the watermark flag, model name, response ID and timestamp for every completion call. Store these alongside the prompt hash and user context so you can reconstruct which outputs were watermarked.
2. Archive detector results — When you run the detection endpoint, log the confidence score, boolean result and the text segment tested. Retain these records for the period your compliance policy requires — typically at least 12 months for EU-regulated sectors.
3. Handle partial coverage — Not every generation will be watermarked. Your content pipeline must tag each stored artefact with a watermark status field (watermarked, not_watermarked, unknown) so downstream reviewers and automated checks can filter correctly.
4. Plan for detector latency — The detection call adds a network round-trip. For high-throughput paths, run detection asynchronously and update the watermark status field once the result returns. Do not block user-facing responses on it.
5. Account for data residency — Sending generated text to OpenAI’s detector may cross borders. If your data-processing agreements forbid that, you cannot use the detector on that content. In that case, watermarking provides no verifiable provenance for those workflows.

What breaks if you ignore this#

• Regulatory exposure — Without watermarking and detector logs, you cannot prove to an EU auditor that you disclosed AI-generated content. Fines under the AI Act reach €35 million or 7% of global turnover.
• Contractual risk — Enterprise customers increasingly require provenance guarantees in MSAs. Missing watermark evidence can trigger SLA penalties or contract termination.
• Reputational damage — Undisclosed AI content detected by third parties (competitors, journalists, watchdogs) erodes trust faster than a compliance fine.

What to do next#

1. Inventory your OpenAI-powered surfaces — List every product feature that serves generated text to end users in the EU or to EU-regulated customers.
2. Enable watermarking selectively — Turn on watermark: true for high-risk surfaces first: legal summaries, financial narratives, medical explanations, public-facing marketing.
3. Build the logging pipeline — Extend your observability stack (OpenTelemetry, Datadog, Splunk, or your SIEM) to capture the fields above. Treat watermark status as a first-class metadata attribute.
4. Schedule detector runs — Implement a daily or hourly batch job that pulls recent watermarked generations, calls the detector, and writes results back to your audit store.
5. Test adversarial resilience — Run your watermarked outputs through common post-processing steps (translation, summarisation, CMS sanitisation) and verify detection still works. If it fails, document the limitation in your compliance register.
6. Review data-processing agreements — Confirm that sending generated text to OpenAI’s detector endpoint is permitted under your DPA and any sector-specific rules (GDPR, BaFin, FCA, HIPAA).

We help teams put large language models into production with retrieval evaluation, cost and latency controls, and human-review checkpoints so answers stay accurate, source-attributed and affordable to run — see our Applied AI and LLM integration capability.