United States — California: compliance overview
4 regulations, 19 mapped obligations and 0 data-transfer routes, organised by when they start to bind you and what you have to do.
Regulatory timeline: what comes next
2025-01-01
CCPA monetary thresholds adjusted
California Consumer Privacy Act and the ADMT, risk assessment and cybersecurity audit regulations2025-09-29
SB 53 chaptered
California Transparency in Frontier Artificial Intelligence Act (TFAIA)2025-10-13
AB 853 approved and chaptered (Chapter 674)
California AI Transparency Act (SB 942, as amended by AB 853)2026-01-01not final
The act becomes operative under the general California rule
California Transparency in Frontier Artificial Intelligence Act (TFAIA)2026-01-01
First disclosure deadline
California Generative AI Training Data Transparency Act (AB 2013)2026-01-01
The CCPA Regulations, including the ADMT, risk assessment and cybersecurity audit provisions, take effect
California Consumer Privacy Act and the ADMT, risk assessment and cybersecurity audit regulations2026-08-02
The chapter becomes operative
California AI Transparency Act (SB 942, as amended by AB 853)2027-01-01
Agency annual reports and the definition review mechanism begin
California Transparency in Frontier Artificial Intelligence Act (TFAIA)2027-01-01
Large online platform and GenAI hosting platform duties take effect
California AI Transparency Act (SB 942, as amended by AB 853)2027-01-01
ADMT compliance deadline
California Consumer Privacy Act and the ADMT, risk assessment and cybersecurity audit regulations2028-01-01
Capture device manufacturer duties take effect
California AI Transparency Act (SB 942, as amended by AB 853)2028-04-01
First risk assessment submission and tier-one cybersecurity audit report deadline
California Consumer Privacy Act and the ADMT, risk assessment and cybersecurity audit regulations2029-04-01
Tier-two cybersecurity audit report deadline
California Consumer Privacy Act and the ADMT, risk assessment and cybersecurity audit regulations2030-04-01
Tier-three cybersecurity audit report deadline
California Consumer Privacy Act and the ADMT, risk assessment and cybersecurity audit regulations
Applicable regulations (4)
California Transparency in Frontier Artificial Intelligence Act (TFAIA)
A Chinese foundation-model company falls in scope when it: (1) deploys a frontier model in California, meaning making it available to a third party for use, modification, copying or combination with other software, where training compute exceeds 10 to the power of 26 operations; (2) redeploys a substantially modified version of an existing frontier model, which requires a fresh transparency report; (3) reaches $500,000,000 in annual gross revenues with affiliates and so becomes a large frontier developer owing the published framework and quarterly internal-use summaries; or (4) employs covered employees in California, which requires changes to confidentiality agreements and reporting channels. Making a model available to a third party primarily for developing or evaluating the model is not deployment.
6 obligations · reviewed 2026-09-12
California Generative AI Training Data Transparency Act (AB 2013)
A Chinese generative AI company is caught when it: (1) offers text, image, audio or video generation to California users through a web product, mobile app or app store; (2) supplies a model API to California customers, or delivers a generative system on premises or white-labelled; or (3) substantially modifies a model released on or after 2022-01-01 and makes it publicly available to Californians. Free distribution triggers the duty just as paid distribution does. The practical difficulty is that Chinese companies often lack a complete dataset provenance and copyright-status register, which has to be rebuilt from the training stage onward.
2 obligations · reviewed 2026-09-12
California AI Transparency Act (SB 942, as amended by AB 853)
A Chinese company is caught when it: (1) operates a text-to-image, text-to-video, speech synthesis or digital human product for the California public with more than one million monthly users or visits, requiring a free detection tool with an API and latent disclosures in output; (2) licenses a generative system to third parties by API, on-premises deployment or white label, requiring the contractual disclosure covenant and a 96-hour revocation process; (3) operates a social, short-video, file-sharing, mass messaging or stand-alone search product for California users exceeding two million unique monthly users, which from 2027-01-01 must detect and display provenance data and must not strip provenance data or digital signatures on upload or distribution; or (4) runs an open-model community or weight download site accessible to California residents, which from 2027-01-01 must not make available generative systems that omit disclosures.
5 obligations · reviewed 2026-09-12
California Consumer Privacy Act and the ADMT, risk assessment and cybersecurity audit regulations
A Chinese AI company is caught when: (1) its California consumer-facing product collects personal information and the entity meets the CCPA business threshold, with the annual gross revenue test at $26,625,000 from 2025-01-01; (2) it uses algorithms in significant decisions such as hiring, promotion, termination, credit, housing, education or healthcare, triggering the full risk assessment and ADMT duties; (3) it uses computer vision or behavioural analytics to systematically observe job applicants, students, employees or independent contractors and infer ability, performance, health, preferences, reliability, location or movements, which directly captures workplace monitoring, proctoring and factory behaviour recognition products; (4) it sells or shares California consumer personal information or processes sensitive personal information including biometrics; or (5) it processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding calendar year, triggering the cybersecurity audit.
6 obligations · reviewed 2026-09-12
What you can use right now
What has actually happened here
Sources (7)
- California SB 53 — Transparency in Frontier Artificial Intelligence Act (chaptered text)California Legislative Information (leginfo) · Bus. & Prof. Code §§ 22757.10-22757.16；Labor Code §§ 1107-1107.1 · published 2025-09-29 · retrieved 2026-09-12
- California AB 2013 — Generative Artificial Intelligence: Training Data Transparency (chaptered text)California Legislative Information (leginfo) · Cal. Civil Code §§ 3110-3111（第 3 分部第 4 部分第 15.2 编） · published 2024-09-28 · retrieved 2026-09-12
- California SB 942 — California AI Transparency Act (chaptered text)California Legislative Information (leginfo) · Bus. & Prof. Code §§ 22757-22757.6 · published 2024-09-19 · retrieved 2026-09-12
- California AB 853 — California AI Transparency Act amendments (Chapter 674, chaptered text)California Legislative Information (leginfo) · published 2025-10-13 · retrieved 2026-09-12
- California Privacy Protection Agency — Laws & Regulations indexCalifornia Privacy Protection Agency · retrieved 2026-09-12
- CPPA — Approved text of the CCPA Updates, Cyber, Risk, ADMT and Insurance RegulationsCalifornia Privacy Protection Agency · 11 CCR §§ 7120-7121、7150-7157、7200、7220-7222 · retrieved 2026-09-12
- CPPA — Updated Monetary Thresholds in CCPACalifornia Privacy Protection Agency · published 2024-12-17 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.