Regulon.AI — CA-SB-942 · CA SB 942 (AI Transparency Act)

Summary

AB 853 amends the California AI Transparency Act, delaying its operative date to August 2, 2026. Beginning January 1, 2027, it requires large online platforms to detect standards-compliant provenance data in distributed content, disclose AI-generated or capture-device provenance information to users, allow inspection of system provenance data, and refrain from stripping provenance data or digital signatures. It also prohibits GenAI hosting platforms from knowingly making available GenAI systems that fail to embed required latent disclosures. Beginning January 1, 2028, capture device manufacturers must provide users the option to embed latent provenance disclosures in captured content, with such disclosures enabled by default. Violations are enforceable by the Attorney General, city attorneys, or county counsel at $5,000 per violation per day.

Enforcement & Penalties

Enforcement Authority

Civil penalty actions filed by the Attorney General, a city attorney, or a county counsel. No private right of action.

Penalties

$5,000 civil penalty per violation; each day in violation is a discrete violation. Prevailing plaintiff entitled to reasonable attorney's costs and fees. For third-party licensee violations of § 22757.3(c)(3), injunctive relief and reasonable attorney's fees and costs are also available.

Who Is Covered

"Covered provider" means a person that creates, codes, or otherwise produces a generative artificial intelligence system that has over 1,000,000 monthly visitors or users and is publicly accessible within the geographic boundaries of the state.

"Capture device manufacturer" means a person who produces a capture device for sale in the state. "Capture device manufacturer" does not include a person exclusively engaged in the assembly of a capture device.

What Is Covered

"Generative artificial intelligence system" or "GenAI system" means an artificial intelligence that can generate derived synthetic content, including text, images, video, and audio, that emulates the structure and characteristics of the system's training data.

"Large online platform" means a public-facing social media platform, file-sharing platform, mass messaging platform, or stand-alone search engine that distributes content to users who did not create or collaborate in creating the content that exceeded 2,000,000 unique monthly users during the preceding 12 months. "Large online platform" does not include either of the following: (A) A broadband internet access service, as defined in Section 3100 of the Civil Code. (B) A telecommunications service, as defined in Section 153 of Title 47 of the United States Code.

"GenAI hosting platform" means an internet website or application that makes available for download the source code or model weights a generative artificial intelligence system by a resident of the state, regardless of whether the terms of that use include compensation.

"Capture device" means a device that can record photographs, audio, or video content, including, but not limited to, video and still photography cameras, mobile phones with built-in cameras or microphones, and voice recorders.

"Mass messaging platform" means a direct messaging platform that allows users to distribute content to more than 100 users simultaneously.

Compliance Obligations 5 obligations · click obligation ID to open requirement page

T-02 AI Content Labeling & Provenance · T-02.4 T-02.5 · Deployer · Social MediaFoundation ModelSearchCommunicationsContent Generation

Bus. & Prof. Code § 22757.3.1(a)(1)-(2)

Plain Language

Large online platforms (social media, file-sharing, mass messaging platforms, and stand-alone search engines with 2M+ unique monthly users) must scan content distributed on their platform to detect any provenance data that conforms to widely adopted standards-body specifications. Where system provenance data is found indicating AI generation, substantial AI alteration, or capture-device origin, the platform must provide a user interface that clearly and conspicuously discloses: whether provenance data exists, the name of the GenAI system or capture device that created or altered the content, and whether digital signatures are available. This is a detect-and-display obligation — the platform need only surface provenance signals that are already embedded in content using recognized standards.

Statutory Text

(a) A large online platform shall do all of the following: (1) Detect whether any provenance data that is compliant with widely adopted specifications adopted by an established standards-setting body is embedded into or attached to content distributed on the large online platform. (2) (A) Provide a user interface to disclose the availability of system provenance data that reliably indicates that the content was generated or substantially altered by a GenAI system or captured by a capture device. (B) The user interface required by this paragraph shall make clearly and conspicuously available to users information sufficient to identify the content's authenticity, origin, or history of modification, including, but not limited to, all of the following: (i) Whether provenance data is available. (ii) The name of the GenAI system or capture device that created or substantially altered the content, if applicable. (iii) Whether any digital signatures are available.

T-02 AI Content Labeling & Provenance · T-02.5 · Deployer · Social MediaFoundation ModelSearchCommunicationsContent Generation

Bus. & Prof. Code § 22757.3.1(a)(3)

Plain Language

Beyond detecting and disclosing provenance data, large online platforms must allow users to inspect the full system provenance data in an easily accessible way. The platform may satisfy this through any of three methods: (1) inline display through its own UI, (2) enabling the user to download the content with provenance data attached, or (3) providing a link to the provenance data on a website or app (the platform's own or a third party's). Platforms have flexibility in which method to use but must offer at least one.

Statutory Text

(a) A large online platform shall do all of the following: ... (3) Allow a user to inspect all available system provenance data that is compliant with widely adopted specifications adopted by an established standards-setting body in an easily accessible manner by any of the following means: (A) Directly through the large online platform's user interface pursuant to paragraph (2). (B) Allow the user to download a version of the content with its attached system provenance data. (C) Provide a link to the content's system provenance data displayed on an internet website or in another application provided either by the large online platform or a third party.

T-02 AI Content Labeling & Provenance · T-02.6 · Deployer · Social MediaFoundation ModelSearchCommunicationsContent Generation

Bus. & Prof. Code § 22757.3.1(b)

Plain Language

Large online platforms must not knowingly strip standards-compliant system provenance data or digital signatures from content that is uploaded to or distributed on the platform, to the extent this is technically feasible. This is a preservation duty — the platform need not add provenance data, but it must not remove what is already there. The 'knowingly' and 'technically feasible' qualifiers provide a safe harbor for incidental or unavoidable data loss during normal processing, but deliberate removal of recognized provenance signals is prohibited.

Statutory Text

(b) A large online platform shall not, to the extent technically feasible, knowingly strip any system provenance data or digital signature that is compliant with widely adopted specifications adopted by an established standards-setting body from content uploaded or distributed on the large online platform.

T-02 AI Content Labeling & Provenance · T-02.2 T-02.3 · Manufacturer · Recording Device

Bus. & Prof. Code § 22757.3.3(a)-(b)

Plain Language

Beginning January 1, 2028, manufacturers of cameras, phones, voice recorders, and similar capture devices must — for any device first produced for sale in California on or after that date — (1) give users the option to embed latent (machine-readable, not human-visible) provenance disclosures in captured content, conveying the manufacturer name, device name and version, and creation/alteration timestamp; and (2) enable this disclosure feature by default. Both obligations are subject to two safety valves: technical feasibility and compliance with widely adopted standards-body specifications. Assembly-only firms are excluded from the manufacturer definition. This is a notable extension of AI provenance law into hardware, aimed at creating an authenticity baseline for non-AI-generated content.

Statutory Text

(a) A capture device manufacturer shall, with respect to any capture device the capture device manufacturer first produced for sale in the state on or after January 1, 2028, do both of the following: (1) Provide a user with the option to include a latent disclosure in content captured by the capture device that conveys all of the following information: (A) The name of the capture device manufacturer. (B) The name and version number of the capture device that created or altered the content. (C) The time and date of the content's creation or alteration. (2) Embed latent disclosures in content captured by the device by default. (b) A capture device manufacturer shall comply with this section only to the extent technically feasible and compliant with widely adopted specifications adopted by an established standards-setting body.

T-02 AI Content Labeling & Provenance · T-02.2 T-02.3 · Distributor · Model HostingContent Generation

Bus. & Prof. Code § 22757.3.2(a)

Plain Language

Platforms that host GenAI systems for download (source code or model weights) must not knowingly make available any GenAI system that fails to include the latent provenance disclosures required by § 22757.3 (the existing covered-provider disclosure obligations). This effectively extends enforcement upstream: hosting platforms become gatekeepers that must verify their hosted GenAI systems embed proper provenance data before distribution. The 'knowingly' standard provides a scienter requirement — hosting platforms are not strictly liable for every non-compliant system but must not distribute them with actual knowledge of non-compliance.

Statutory Text

(a) A GenAI system hosting platform shall not knowingly make available a GenAI system that does not place disclosures pursuant to Section 22757.3.