California AI Transparency Act (SB 942, as amended by AB 853)

A covered provider must make available, at no cost, an AI detection tool that lets a user assess whether image, video or audio content, or a combination, was created or altered by that provider generative AI system; outputs any system provenance data detected; does not output personal provenance data; is publicly accessible, subject only to reasonable limits to address demonstrable risks to the security or integrity of the system; allows upload of content or a URL; and supports an API so the tool can be invoked without visiting the provider website. The provider must collect and act on user feedback about the tool efficacy, and must not collect or retain personal information from tool users (except contact details of users who opt in to being contacted, used only to improve the tool), must not retain submitted content longer than necessary, and must not retain personal provenance data from submitted content.

Applies when

A covered provider is a person that creates, codes or otherwise produces a generative AI system with more than 1,000,000 monthly visitors or users that is publicly accessible within California. Chinese image, video or audio generation products that are available in California at that scale must provide the detection tool and its API.

Applies from: 2026-08-02

Evidence to retain

• · Detection tool product documentation and API documentation
• · Monthly user or visitor metrics and methodology used for the threshold test
• · User feedback collection records and the resulting improvement iterations
• · Data retention and deletion policy for the tool with evidence of enforcement

Estimated first-time effort: 20–60 person-days (estimate, not a commitment)

A covered provider must include a latent disclosure in AI-generated image, video or audio content created by its system. To the extent technically feasible and reasonable the disclosure must convey, directly or through a link to a permanent website, the provider name, the name and version number of the system that created or altered the content, the time and date of creation or alteration, and a unique identifier. It must be detectable by the provider detection tool, consistent with widely accepted industry standards, and permanent or extraordinarily difficult to remove to the extent technically feasible. The provider must also offer the user the option to include a manifest disclosure that identifies the content as AI-generated, is clear, conspicuous, appropriate for the medium and understandable to a reasonable person, and is likewise permanent or extraordinarily difficult to remove.

Applies when

As above, applying to every covered provider serving the California public.

Applies from: 2026-08-02

Evidence to retain

• · Technical design for latent disclosures identifying the industry provenance standard used
• · Sample disclosure payloads and end-to-end verification against the detection tool
• · Product interface for the manifest disclosure and records of user choices
• · Robustness test report evidencing removal difficulty

Estimated first-time effort: 20–50 person-days (estimate, not a commitment)

If a covered provider licenses its generative AI system to a third party, it must require by contract that the licensee maintain the capability to include the latent disclosure in content the system creates or alters. If the provider knows that a licensee modified the system so that it can no longer do so, the provider must revoke the licence within 96 hours of discovery, and the licensee must cease using the system after revocation.

Applies when

Chinese companies that deliver generative AI systems to third parties through model APIs, on-premises deployments or white-label arrangements.

Deadline: Revoke within 96 hours of discovering that a licensee disabled the disclosure capability

Applies from: 2026-08-02

Evidence to retain

• · Licence template and executed agreements containing the disclosure-capability covenant
• · Licensee monitoring mechanism and discovery records
• · Revocation decision and proof of delivery within 96 hours
• · Verification that use ceased after revocation

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)

From 2027-01-01 a large online platform must detect whether provenance data compliant with widely adopted specifications from an established standards-setting body is embedded in or attached to content it distributes; provide a user interface disclosing the availability of system provenance data reliably indicating that the content was generated or substantially altered by a GenAI system or captured by a capture device, making clearly and conspicuously available information sufficient to identify authenticity, origin and modification history, including at least whether provenance data is available, the name of the GenAI system or capture device, and whether digital signatures are available; and allow users to inspect all available compliant system provenance data through the interface, by downloading a version with the data attached, or via a link to a provenance display page. The platform must not, to the extent technically feasible, knowingly strip compliant system provenance data or digital signatures from uploaded or distributed content. A large online platform is a public-facing social media, file-sharing, mass messaging platform or stand-alone search engine exceeding 2,000,000 unique monthly users during the preceding 12 months, excluding broadband internet access service and telecommunications service.

Applies when

Chinese social, short-video, content distribution or search products operating in California at that user scale.

Applies from: 2027-01-01

Evidence to retain

• · Technical design and test report for the provenance detection pipeline
• · User interface designs and production screenshots
• · Engineering controls and regression tests preventing stripping of provenance data
• · Unique monthly user metrics and methodology used for the threshold test

Estimated first-time effort: 25–70 person-days (estimate, not a commitment)

From 2027-01-01 a GenAI hosting platform must not knowingly make available a GenAI system that does not place disclosures under section 22757.3. A GenAI hosting platform is an internet website or application that makes available for download the source code or model weights of a generative AI system by a California resident, regardless of compensation, which brings open-weight distribution channels and model marketplaces directly within scope.

Applies when

Chinese companies operating open-model communities, model marketplaces or weight download sites accessible to California residents.

Applies from: 2027-01-01

Evidence to retain

• · Listing review workflow and records verifying disclosure capability
• · Platform rules and developer agreement clauses imposing the disclosure requirement
• · Records of takedowns or refusals to list
• · Description of sampling and re-review mechanisms

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)