Regulon.AI — IL-SB-3263 · IL SB 3263 (AI Provenance Data Act)

Summary

Establishes the Artificial Intelligence Provenance Data Act, requiring covered AI tool providers (those with over 1 million monthly users that generate or edit audio, video, or image content) to embed machine-readable provenance labels in AI-generated content and to make a free provenance label reading tool publicly available. Large online platforms (exceeding 2 million monthly users) must detect, disclose, and preserve provenance labels on distributed content and may not strip standards-compliant provenance data. Capture device manufacturers must embed provenance labels by default in devices first produced for sale in Illinois on or after the effective date. Third-party licensees must contractually maintain provenance labeling capability, and hosting platforms may not knowingly distribute AI lacking provenance labeling. Enforced by the Attorney General with civil penalties up to $5,000 per violation.

Enforcement & Penalties

Enforcement Authority

The Attorney General may bring a civil action to enforce the Act and to collect civil penalties or seek injunctive relief. Third-party licensees that violate Section 25(c) may also be subject to a civil action for injunctive relief, though the statute does not specify who may bring that action. No private right of action is expressly created for individuals.

Penalties

Civil penalty not to exceed $5,000 per violation for covered AI tool providers, large online platforms, and capture device manufacturers. Third-party licensees that violate Section 25(c) may be subject to injunctive relief. In actions brought by the Attorney General, the prevailing party may be awarded reasonable attorney's fees and costs.

Who Is Covered

"Covered artificial intelligence tool provider" means a person or entity that creates, codes, or otherwise produces artificial intelligence that: (i) has over 1,000,000 monthly visitors world-wide or users on average over the preceding 12-month period; (ii) is publicly accessible in this State; and (iii) generates, manipulates, or otherwise edits audio, video, or image content.

"Large online platform" means a public-facing social media platform, content sharing platform, messaging platform, advertising network, stand-alone search engine, or web browser that distributes content to users who did not create or collaborate in creating the content and that exceeded 2,000,000 unique monthly users during the preceding 12 months.

"Capture device manufacturer" means a person who produces a capture device for sale in this State. "Capture device manufacturer" does not include a person exclusively engaged in the assembly of a capture device from components produced by others.

What Is Covered

"Capture device" means any device that can record photographic, audio, or video content, including, but not limited to, video and still photography cameras, mobile phones with built-in cameras or microphones, and voice recorders.

"Provenance label" means a disclosure that is embedded in image, video, or audio content in a manner that is machine-readable.

"Provenance label reading tool" means a software program, application, or other mechanism that reads a provenance label and allows a person to determine whether an image, video, or audio content was created or altered by a specific artificial intelligence provided by a covered artificial intelligence tool provider.

Compliance Obligations 7 obligations · click obligation ID to open requirement page

T-02 AI Content Labeling & Provenance · T-02.2 · Developer · Content Generation

Section 10(f)

Plain Language

Covered AI tool providers must embed a machine-readable provenance label in every image, video, or audio content instance their AI generates. The label must be readable by the provider's provenance label reading tool, must be permanent or extraordinarily difficult to remove (to the extent technically feasible), and must convey the provider's name, the AI system name and version, timestamp of creation or alteration, and a unique content identifier. This is an automatic embedding requirement — it applies to every content instance, not just content that users choose to label.

Statutory Text

(f) A covered artificial intelligence tool provider shall include a provenance label in any image, video, or audio content instance created by its artificial intelligence. A provenance label required under this subsection shall: (1) be readable by the provenance label reading tool required by this Section; (2) be, to the extent technically feasible, permanent or extraordinarily difficult to remove; (3) convey, to the extent technically feasible, either directly or through a link to a permanent website, the following system provenance data: (A) the name of the covered artificial intelligence tool provider; (B) the name and version number of the artificial intelligence that created or altered the content; (C) the time and date of the content's creation or alteration; and (D) a unique identifier of the content.

T-02 AI Content Labeling & Provenance · T-02.7 · Developer · Content Generation

Section 10(a)-(e)

Plain Language

Covered AI tool providers must offer a free, publicly accessible provenance label reading tool via a conspicuous link on their website and mobile app. The tool must accept content uploads or URLs and must also be accessible via API for programmatic submissions. It must include a user feedback mechanism, and the provider must use that feedback to improve the tool. The provider may not collect or retain personal information from users of the tool (except voluntarily provided feedback contact info), may not output personal provenance data detected in content, and may not retain submitted content longer than necessary to comply with the Act. This effectively requires a public detection tool — similar to but more prescriptive than a verification API.

Statutory Text

(a) A covered artificial intelligence tool provider shall make available, at no cost to a person, a provenance label reading tool. The provenance label reading tool shall be made publicly accessible through a conspicuous link on the covered artificial intelligence tool provider's website and any corresponding mobile application. The provenance label reading tool shall allow a person to: (1) upload an image, video, text, or audio content; or (2) provide a uniform resource locator that links to an image, video, text, or audio content. (b) The provenance label reading tool shall support access by an application programming interface that allows a person to programmatically submit content for assessment without accessing the covered artificial intelligence tool provider's website. (c) The provenance label reading tool shall provide a mechanism for a person to submit feedback regarding the tool's efficacy. A covered artificial intelligence tool provider shall consider and use this feedback to improve the provenance label reading tool. (d) A covered artificial intelligence tool provider shall not collect or retain any personal information from a person who uses the provenance label reading tool, except that it may retain contact information voluntarily provided by a person who submits feedback in accordance with subsection (c). The provenance label reading tool shall not output any personal provenance data detected in the content. (e) A covered artificial intelligence tool provider shall not retain any content submitted to the provenance label reading tool for longer than is necessary to comply with this Act.

T-02 AI Content Labeling & Provenance · T-02.4 T-02.5 · Deployer · Content GenerationSocial Media

Section 15(a)

Plain Language

Large online platforms must (1) detect standards-compliant provenance labels embedded in distributed content (to the extent technically feasible), (2) clearly and conspicuously disclose to users when provenance data is available, and (3) allow users to inspect all available system provenance data either through the platform UI or by downloading the content with its attached metadata. The detection obligation is limited to provenance labels compliant with widely adopted standards-body specifications, not proprietary formats.

Statutory Text

(a) A large online platform shall: (1) to the extent technically feasible, detect whether any provenance label that is compliant with widely adopted specifications adopted by an established standards-setting body is embedded in or attached to content distributed on the large online platform; (2) provide a mechanism to disclose any machine-readable provenance label detected in content distributed on the large online platform, which shall, in a clear and conspicuous manner, indicate to a user that provenance data is available; and (3) allow a user to inspect all available system provenance data in an easily accessible manner, either directly through the platform's user interface or by providing a means for the user to download the content with its attached system provenance data.

T-02 AI Content Labeling & Provenance · T-02.6 · Deployer · Content GenerationSocial Media

Section 15(b)

Plain Language

Large online platforms are prohibited from (1) knowingly stripping standards-compliant provenance labels or system provenance data from uploaded or distributed content, to the extent technically feasible, and (2) retaining any personal provenance data from content shared on the platform. The first prohibition covers only labels compliant with established standards-body specifications. The second is an absolute prohibition — no technical feasibility qualifier — on retaining provenance data that could identify individual users.

Statutory Text

(b) A large online platform shall not: (1) to the extent technically feasible, knowingly strip any provenance label or system provenance data that is compliant with widely adopted specifications adopted by an established standards-setting body from content uploaded to or distributed on the large online platform; or (2) retain any personal provenance data from content shared on the large online platform.

T-02 AI Content Labeling & Provenance · T-02.2 T-02.3 · Manufacturer · Recording Device

Section 20

Plain Language

For capture devices first produced for sale in Illinois on or after January 1, 2027, manufacturers must embed provenance labels by default in captured content, to the extent technically feasible and compliant with established standards-body specifications. The label must convey the manufacturer name, device name and version, and creation timestamp. Manufacturers must also give users the option to include the label, inform users of provenance label settings on first use of a recording function, provide a clear opt-out mechanism in device settings, and ensure provenance capabilities are available to both the default capture app and third-party apps using the device's capture functions. Entities engaged exclusively in assembly from others' components are excluded from the definition of capture device manufacturer.

Statutory Text

With respect to any capture device that a capture device manufacturer first produces for sale in this State on or after the effective date of this Act, the capture device manufacturer, to the extent technically feasible and compliant with widely adopted specifications adopted by an established standards-setting body, shall: (1) provide a user with the option to include a provenance label in content captured by the capture device that conveys the following system provenance data: (A) the name of the capture device manufacturer; (B) the name and version number of the capture device that created the content; and (C) the time and date of the content's creation; (2) embed the provenance label described in paragraph (1) in content captured by the device by default; (3) clearly inform a user of the existence of settings relating to the provenance label upon the user's first use of a recording function on the capture device; (4) provide in the capture device's settings a clear and accessible mechanism for a user to opt out of the inclusion of a provenance label in the user's captured content; and (5) ensure the capabilities required by this Section are available for the capture device's default capture application and are made available to third-party applications that use the device's capture functionalities.

T-02 AI Content Labeling & Provenance · T-02.2 · DeveloperDeployer · Content Generation

Section 25(a)-(c)

Plain Language

When a covered AI tool provider licenses its AI to a third party, the provider must contractually require the licensee to maintain the provenance labeling capability. If the provider gains actual knowledge that a licensee has removed that capability, the provider must revoke the license within 96 hours. Once revoked, the licensee is prohibited from continuing to use the AI. This creates a dual obligation: the provider must include and enforce the contractual requirement, and the licensee must cease use upon revocation. The 96-hour clock runs from actual knowledge, not constructive notice.

Statutory Text

(a) If a covered artificial intelligence tool provider licenses its artificial intelligence to a third party, the covered artificial intelligence tool provider shall require by contract that the licensee maintain the system's capability to include a provenance label as required by subsection (f) of Section 10. (b) If a covered artificial intelligence tool provider has actual knowledge that a third-party licensee has modified an artificial intelligence to remove its capability to include a provenance label, the covered artificial intelligence tool provider shall revoke the third party's license to use the artificial intelligence within 96 hours after obtaining the knowledge. (c) A third-party licensee whose license to use artificial intelligence is revoked under this Section shall not use the artificial intelligence after the revocation.

T-02 AI Content Labeling & Provenance · T-02.2 · Distributor · Content GenerationModel Hosting

Section 25(d)

Plain Language

Operators of model hosting platforms — websites or applications that make AI source code or model weights available for download — may not knowingly host AI that lacks the provenance labeling capability required by Section 10(f). This obligation applies based on actual knowledge that the hosted AI does not embed provenance labels; it does not impose a duty to affirmatively audit every hosted model. The obligation falls on the hosting platform operator, not the model developer.

Statutory Text

(d) The operator of a website or application that makes available for download the source code or model weights of artificial intelligence shall not knowingly make available artificial intelligence that does not place disclosures into content as required by subsection (f) of Section 10.