Watermarks don't prevent copying, they just prove you tried

OpenAI is adding an invisible, machine-readable watermark to ChatGPT text in the European Union, a move that looks like consumer protection but functions as regulatory compliance theater. The watermark — called textGrain — serves no user and prevents nothing. Both OpenAI and EU regulators will treat its existence as evidence the law is working.

The AI Act requires that high-risk AI systems include some mechanism to flag AI-generated content. Watermarking satisfies that requirement on paper. Anthropic added one in August for identical reasons. What neither company nor the regulators advertising these rollouts will discuss openly is that invisible watermarks are a solved problem for anyone motivated to remove them.

This is not new. In 1998, the Digital Millennium Copyright Act required anti-circumvention protections on copyrighted digital media. Every major tech company dutifully added them. Within months, a Norwegian teenager cracked DVD encryption and posted the code online. The response was instructive: the RIAA sued, lawmakers stayed quiet, studios announced the requirement had been met. Everyone moved forward knowing the protections were theater. The watermark on a DVD didn't actually stop copying. It signaled that studios had complied.

TextGrain will follow that exact trajectory. Security researchers have already published methods to strip watermarks from language model outputs. OpenAI's own research shows detection accuracy drops sharply on paraphrased text. But the regulatory machinery doesn't care. The feature exists not to stop misuse but to prove OpenAI tried to stop it. When a researcher releases a bypass tool in six months, and one will. OpenAI will have already satisfied the law. The EU will have already declared compliance achieved. The watermark's actual function, whether anyone can detect it or relies on it, becomes irrelevant.

What's instructive for anyone building systems that touch regulation is this: compliance theater works because regulators measure intent, not outcome. A watermark nobody can verify and everyone can strip still counts as fulfilling a requirement. The law asked for a system to flag AI text. It got one. Whether that system actually works is a question regulators stopped asking in 1998.