OpenAI starts marking AI text step by step, *and what Article 50 actually says*

A watermark is like a postmark, except it isn't

When you post a letter, the postmark tells you it went through the system on a certain day. A text watermark is less helpful: it whispers that the text might have come from a generative model, but it won't tell you which one, or when, or who pressed the button. Change a few words and the whisper fades. It's a flag, not a receipt.

OpenAI announced in January 2025 that it has started marking AI-generated text ^[2]. The rollout is phased and begins with free users of ChatGPT. The watermark survives light paraphrasing and translation, but OpenAI's own documentation says it can be removed if someone tries hard enough. The idea is to make casual misuse harder, not to make the origin provable.

That matters, because Article 50 of the AI Act asks for something more durable. Providers of general-purpose generative AI must ensure their systems mark output in a machine-readable format that is effective, interoperable, robust and reliable ^[1]. The rule applies from 2 August 2026. Fail to comply and you risk a fine of up to €15 million or 3 per cent of worldwide turnover, whichever is higher, though for small and medium enterprises the lower amount applies ^[1].

What the rule actually says

Article 50 has two main parts. Article 50.2 is for providers: mark the output so machines can detect it ^[1]. Article 50.4 is for deployers, the people who use the tools: if you create a deepfake or publish AI text to inform the public on matters of public interest, tell people ^[1].

The provider's job is technical marking. The deployer's job is disclosure when the content could mislead. A deepfake, under Article 3(60), is content that resembles real people, objects, places or events and would incorrectly appear authentic ^[1]. If you use AI to make such content, you must disclose it unless it's obviously artistic, creative, satirical or fictional, in which case a suitable acknowledgement somewhere in the work is enough, as long as it doesn't spoil the experience ^[1].

For AI-generated text published to inform the public, you must disclose it unless a person has reviewed it and someone has editorial responsibility ^[1]. So a press release written by AI and checked by a human doesn't need a label. A blog post generated and published without review does.

The two duties don't replace each other. A watermark satisfies the provider's obligation but doesn't let the deployer off the hook if they're the one showing a deepfake to an audience.

What a watermark can and can't do

OpenAI's watermark works by nudging word choices in statistically detectable directions as the model generates text ^[2]. A detector can later scan the text and say whether it looks like it came from a model using that pattern. The method survives translation into another language and light rewrites. It doesn't survive heavy editing, deliberate removal or a determined attempt to fool it, and OpenAI says so in its own explanation ^[2].

That's a feature, not a bug, from a research perspective. Perfect watermarks don't exist, and insisting on one might push the problem underground. A soft signal helps platforms and moderators spot synthetic text at scale without stopping every legitimate use.

But for the person who has to prove something later—say, which version of a chatbot answer a customer saw, or what an AI agent wrote in a contract—a watermark that can be stripped or paraphrased away doesn't help much. Courts and supervisors deal in evidence, and a stripped watermark is no watermark at all.

Why marking is only the start

Article 50 doesn't say how to prove what a system generated, or when, or for whom. It says to mark the output. If that mark reaches the end user intact, it does its job. If it doesn't, there's no second line of defence in the rule.

That's where a record matters. Say a customer disputes what a chatbot promised six months ago. The watermark might still be there, or it might have been edited out along the way. Either way, it won't tell you which conversation it came from or what the original answer said. A sealed record of the answer—saved when the chatbot sent it, with a fingerprint that changes if a single character changes—gives you something to check against.

The same goes for campaigns, reports and model outputs. A watermark flags content as synthetic. A sealed record shows what that content was, and when it existed in that form.

A digital witness for generated content

Here, the thing to seal is a record of what was generated, when and by which system. The content stays in your systems; only a fingerprint goes to WitniumChain through the REST API, the SDK or the MCP server, and you get a witness ID back. To check, anyone you share the record with calculates the fingerprint again and compares it with the sealed one. If they match, the record hasn't changed. Change a single character and it won't.

Sealing at generation gives you a second line. If the watermark is stripped or someone questions what was in the original, you have a record you can show, and they can check it without having to trust you. The first 2,000 witnesses a month are free, and the content never leaves your systems.

The witness doesn't replace the Article 50 marking duty. It complements it: the watermark travels with the content, and the witness lets you prove what you generated.

How it would work

1. Your system generates content and sends a fingerprint of it, together with metadata like the model version and timestamp, to WitniumChain.
2. You get a witness ID back and store it with the record.
3. When someone questions the content, you share the record and the witness ID. They calculate the fingerprint again and check it matches the sealed one.

What this means for you

If you provide a generative AI system that reaches the EU market, Article 50.2 applies from 2 August 2026 ^[1]. You need a technical way to mark output. OpenAI's phased rollout shows one approach, and the company is clear that it's a work in progress ^[2].

If you use AI tools to create content—ads, posts, reports, images, video—Article 50.4 applies to you as a deployer ^[1]. Ask yourself:

• Does the content resemble real people, places or events in a way that could mislead? If yes, it's a deepfake and you must disclose it.
• Are you publishing AI-generated text to inform the public? If yes, disclose it unless a person reviewed it and someone has editorial responsibility.
• Could you show what your AI generated, if the output is questioned later and the watermark has been edited out?

That last question isn't in Article 50, but it's the one that comes up in disputes.

What to watch

The AI Office is expected to publish guidance on what counts as effective, robust and interoperable marking under Article 50.2, though no date has been set. Providers will watch that closely, because meeting the standard without over-engineering it is the practical challenge.

For deployers, the line between artistic work and misleading deepfake will be tested in practice. Satire is protected, but it still has to be recognisable as satire, and that's a judgement someone will have to defend.

The 2 August 2026 date is fixed. Providers and deployers both have work to do before then.