Regulon.AI — T-03 · Training Data Disclosure

Core Obligation

Developers must disclose information about the data used to train AI models. Public disclosure obligations require posting documentation on the developer's website covering dataset sources, data types, volume, IP status, personal information presence, processing methods, collection timeframes, and use of synthetic data. Regulator disclosure obligations require submitting similar documentation to a designated authority, which may treat it as confidential.

Sub-Obligations3 sub-obligations

Name & Description

Enacted

Proposed

T-03.1

Regulator disclosure Developers must provide training data documentation to designated regulatory authorities. This disclosure may be treated as confidential and is not required to be made public.

0 enacted

2 proposed

T-03.2

Public disclosure Developers must post training data documentation publicly on their website before making a system available and before each new release or substantial modification. Substantial modification includes retraining and fine-tuning.

1 enacted

3 proposed

T-03.3

Training Data Governance Disclosure to Deployers Developers must disclose to deployers the data governance measures applied to training datasets, including examination of data source suitability, possible biases, and mitigation steps taken, as part of pre-deployment technical documentation.

1 enacted

4 proposed

Bills That Map This Requirement 11 bills

Bill

Status

Sub-Obligations

Section

CA AB 2013 (Training Data Transparency) CA

Enacted 2026-01-01

T-03.2

Civ. Code § 3111(a)(1)-(12), (b)

Plain Language

Developers of generative AI systems or services available to Californians must publish a detailed training data documentation page on their website. The documentation must include a high-level summary covering twelve enumerated categories: dataset sources/owners, purpose alignment, data point counts (general ranges and estimates permitted), data point types, IP status (copyright/trademark/patent or public domain), whether data was purchased or licensed, presence of personal information (per CCPA definition) or aggregate consumer information, any cleaning or processing performed, collection time periods, dates of first use in development, and whether synthetic data generation was used. This obligation applies to any system released on or after January 1, 2022, with initial documentation due by January 1, 2026, and updated documentation required before each new release or substantial modification. Three exemptions apply: systems solely for security and integrity purposes, systems solely for national airspace aircraft operations, and national security/military/defense systems available only to federal entities. Notably, the statute contains no enforcement mechanism or penalties — compliance is effectively self-enforced. This is one of the earliest U.S. state laws requiring public training data disclosure and is considerably more detailed in its enumerated requirements than the EU AI Act's Article 53 training data summary obligation, though weaker in enforcement.

On or before January 1, 2026, and before each time thereafter that a generative artificial intelligence system or service, or a substantial modification to a generative artificial intelligence system or service, released on or after January 1, 2022, is made publicly available to Californians for use, regardless of whether the terms of that use include compensation, the developer of the system or service shall post on the developer's internet website documentation regarding the data used by the developer to train the generative artificial intelligence system or service, including, but not be limited to, all of the following: (a) A high-level summary of the datasets used in the development of the generative artificial intelligence system or service, including, but not limited to: (1) The sources or owners of the datasets. (2) A description of how the datasets further the intended purpose of the artificial intelligence system or service. (3) The number of data points included in the datasets, which may be in general ranges, and with estimated figures for dynamic datasets. (4) A description of the types of data points within the datasets. For purposes of this paragraph, the following definitions apply: (A) As applied to datasets that include labels, "types of data points" means the types of labels used. (B) As applied to datasets without labeling, "types of data points" refers to the general characteristics. (5) Whether the datasets include any data protected by copyright, trademark, or patent, or whether the datasets are entirely in the public domain. (6) Whether the datasets were purchased or licensed by the developer. (7) Whether the datasets include personal information, as defined in subdivision (v) of Section 1798.140. (8) Whether the datasets include aggregate consumer information, as defined in subdivision (b) of Section 1798.140. (9) Whether there was any cleaning, processing, or other modification to the datasets by the developer, including the intended purpose of those efforts in relation to the artificial intelligence system or service. (10) The time period during which the data in the datasets were collected, including a notice if the data collection is ongoing. (11) The dates the datasets were first used during the development of the artificial intelligence system or service. (12) Whether the generative artificial intelligence system or service used or continuously uses synthetic data generation in its development. A developer may include a description of the functional need or desired purpose of the synthetic data in relation to the intended purpose of the system or service. (b) A developer shall not be required to post documentation regarding the data used to train a generative artificial intelligence system or service for any of the following: (1) A generative artificial intelligence system or service whose sole purpose is to help ensure security and integrity. For purposes of this paragraph, "security and integrity" has the same meaning as defined in subdivision (ac) of Section 1798.140, except as applied to any developer or user and not limited to businesses, as defined in subdivision (d) of that section. (2) A generative artificial intelligence system or service whose sole purpose is the operation of aircraft in the national airspace. (3) A generative artificial intelligence system or service developed for national security, military, or defense purposes that is made available only to a federal entity.

CO SB 25B-004 (AI Transparency Amendments) CO

Enacted 2026-06-30

T-03.3

C.R.S. § 6-1-1702(2)-(3)(a)

Plain Language

Developers must provide deployers and downstream developers with the documentation and information — such as model cards, dataset cards, and other impact assessment materials — necessary for the deployer or its contracted third party to complete a required impact assessment under § 6-1-1703(3). This is a 'to the extent feasible' obligation. The documentation must be provided at or before the point when the system is made available. This is developer-to-deployer disclosure, not public-facing.

(2) On and after June 30, 2026, and except as provided in subsection (6) of this section, a developer of a high-risk artificial intelligence system shall make available to the deployer or other developer of the high-risk artificial intelligence system: (3) (a) Except as provided in subsection (6) of this section, a developer that offers, sells, leases, licenses, gives, or otherwise makes available to a deployer or other developer a high-risk artificial intelligence system on or after June 30, 2026, shall make available to the deployer or other developer, to the extent feasible, the documentation and information, through artifacts such as model cards, dataset cards, or other impact assessments, necessary for a deployer, or for a third party contracted by a deployer, to complete an impact assessment pursuant to section 6-1-1703 (3).

GA SB 167 (Automated Decision Systems) GA

Pending 2025-07-01

T-03.3

O.C.G.A. § 10-16-2(c)

Plain Language

When a developer provides an automated decision system to a deployer or other developer, the developer must share — to the extent feasible — all the documentation required for the AG submission (including data governance measures, training data summaries, and bias mitigation steps), plus whatever additional information the deployer needs to complete its impact assessment (e.g., model cards, dataset cards). A developer that is also the deployer of its own system is exempt from generating this documentation unless the system is provided to an unaffiliated deployer. Trade secret redactions are permitted under § 10-16-2(f) but may not cover information the deployer needs for compliance.

(1) Except as provided in subsection (f) of this Code section, a developer that offers, sells, leases, licenses, gives, or otherwise makes available to a deployer or other developer an automated decision system shall make available to the deployer or other developer, to the extent feasible, all of the information required to be provided to the Attorney General by subsection (b) of this Code section, as well as the documentation and information, through artifacts such as model cards, data set cards, or other impact assessments, necessary for a deployer or third party contracted by a deployer to complete an impact assessment pursuant to subsection (e) of Code Section 10-16-3. (2) A developer that also serves as a deployer for an automated decision system is not required to generate the documentation required by this subsection unless the automated decision system is provided to an unaffiliated entity acting as a deployer.

NY A 768 (AI Consumer Protection Act) NY

Pending 2027-01-01

T-03.3

GBL § 1551(2)(c)(ii)

Plain Language

Developers must disclose to deployers the data governance measures applied to training datasets, including how data source suitability was evaluated, possible biases identified, and mitigation steps taken. This is part of the broader documentation package required under § 1551(2) and is specifically a training data governance disclosure obligation to downstream deployers.

Documentation describing: (ii) the data governance measures used to cover the training datasets and examine the suitability of data sources, possible biases, and appropriate mitigation;

NY A 6578 (AI Training Data Transparency Act) NY

Pending 2027-01-01

T-03.2

Gen. Bus. Law § 1432(1)-(2)

Plain Language

Developers of generative AI models or services made publicly available to New Yorkers — whether free or paid — must post training data documentation on their website by January 1, 2027, and before each subsequent release or substantial modification of any model released on or after January 1, 2022. The required documentation includes a high-level summary covering twelve enumerated categories: dataset sources/owners, how datasets serve the model's purpose, data point counts (ranges and estimates permitted), data point types, IP status (copyright/trademark/patent or public domain), whether data was purchased or licensed, presence of personal information, presence of aggregate consumer information, any cleaning or processing applied, data collection timeframes, dates datasets were first used, and whether synthetic data generation was employed. Two narrow exemptions apply: models solely for aircraft operations in national airspace, and models developed for national security/military/defense purposes available only to federal entities. The bill does not specify enforcement mechanisms or penalties for noncompliance.

1. On or before January first, two thousand twenty-seven, and prior to each time thereafter that a generative artificial intelligence model or service, or a substantial modification to a generative artificial intelligence model or service, released on or after January first, two thousand twenty-two, is made publicly available to New Yorkers for use, regardless of whether the terms of such use include compensation, the developer of such model or service shall post on the developer's website documentation regarding the data used by the developer to train the generative artificial intelligence model or service, including a high-level summary of the datasets used in the development of the generative artificial intelligence model or service, including, but not limited to: (a) the sources or owners of the datasets; (b) a description of how the datasets further the intended purpose of the artificial intelligence model or service; (c) the number of data points included in the datasets, which may be in general ranges, and with estimated figures for dynamic datasets; (d) a description of the types of data points within the datasets. For purposes of this paragraph, the following definitions apply: (i) as applied to datasets that include labels, "types of data points" means the types of labels used; and (ii) as applied to datasets without labeling, "types of data points" refers to the general characteristics; (e) whether the datasets include any data protected by copyright, trademark, or patent, or whether the datasets are entirely in the public domain; (f) whether the datasets were purchased or licensed by the developer; (g) whether the datasets include personal information or personal identifying information, as defined in section eight hundred ninety-nine-aaa of this chapter; (h) whether the datasets include aggregate consumer information; (i) whether there was any cleaning, processing, or other modification to the datasets by the developer, including the intended purpose of those efforts in relation to the artificial intelligence model or service; (j) the time period during which the data in the datasets were collected, including a notice if the data collection is ongoing; (k) the dates the datasets were first used during the development of the artificial intelligence model or service; and (l) whether the generative artificial intelligence model or service used or continuously uses synthetic data generation in its development. A developer may include a description of the functional need or desired purpose of the synthetic data in relation to the intended purpose of the model or service. 2. A developer shall not be required to post documentation regarding the data used to train a generative artificial intelligence model or service for any of the following: (a) A generative artificial intelligence model or service whose sole purpose is the operation of aircraft in the national airspace; or (b) A generative artificial intelligence model or service developed for national security, military, or defense purposes that is made available only to a federal entity.

NY A 6578 (AI Training Data Transparency Act) NY

Pending 2027-01-01

Gen. Bus. Law § 1433(1)-(2)

Plain Language

Any entity — including private companies and government agencies — that develops or substantially modifies a generative AI model using data substantially derived from its own employees or contractors must individually disclose to each affected employee six categories of information: the model's intended purpose, how the datasets serve that purpose, data point types, whether personal information is included, when datasets were first used, and the data collection timeframe. Unlike the public posting obligation in § 1432, this disclosure is owed directly to affected employees regardless of whether the model is made publicly available — meaning even internal-only AI tools trigger this requirement. The same two narrow exemptions apply (aircraft operations and national security/defense models for federal entities). The bill does not specify the form, timing, or method of employee disclosure, nor does it provide enforcement mechanisms or penalties.

1. Any person, partnership, state or local government agency, or corporation that designs, codes, produces, or substantially modifies a generative artificial intelligence model or service using data of which a substantial part is derived from individuals employed or contracted by the entity, regardless if whether the model is made publicly available, shall ensure that the following information is disclosed to each employee whose data is used to train the artificial intelligence model: (a) the intended purpose of the artificial intelligence model or service; (b) a description of how the collected datasets further the intended purpose of the artificial intelligence model or service; (c) a description of the types of data points within the datasets; (d) whether the datasets include personal information or personal identifying information, as defined in section eight hundred ninety-nine-aaa of this chapter; (e) the dates the datasets were first used during the development of the artificial intelligence model or service; and (f) the time period during which the data in the datasets were collected, including a notice if the data collection is ongoing. 2. An entity that uses employee or contractor data to design, code, produce, or substantially modify a generative artificial intelligence model or service shall not be required to disclose the information required by this section if the model or service: (a) is solely intended to be used in the operation of aircraft in the national airspace; or (b) is developed for national security, military, or defense purposes and only made available to a federal entity.

NY S 1962 (AI Consumer Protection Act) NY

Pending 2025-10-11

T-03.3

GBL § 1551(2)(c)(ii)

Plain Language

Developers must disclose to deployers the data governance measures applied to training datasets, including examination of data source suitability, possible biases, and mitigation steps taken. This is a component of the broader documentation package required under § 1551(2) and specifically addresses training data governance transparency to downstream deployers.

(ii) the data governance measures used to cover the training datasets and examine the suitability of data sources, possible biases, and appropriate mitigation;

NY S 6955-A (AI Training Data Transparency Act) NY

Pending 2027-01-01

T-03.2

Gen. Bus. Law § 1432(1)(a)-(l), (2)(a)-(b)

Plain Language

Developers of generative AI models or services made publicly available to New Yorkers — whether free or paid — must post detailed training data documentation on their website. The initial deadline is January 1, 2027, and updated documentation must be posted before each subsequent public release or substantial modification. The documentation must include a high-level summary covering twelve enumerated categories: dataset sources/owners, purpose alignment, data volume, data types, IP status (copyright/trademark/patent or public domain), licensing status, presence of personal information or PII, presence of aggregate consumer information, any cleaning or processing performed, data collection timeframes, dates datasets were first used, and use of synthetic data generation. The obligation applies retroactively to models released on or after January 1, 2022. Two narrow exemptions apply: AI solely for aircraft operation in national airspace, and AI developed for national security/military/defense purposes available only to federal entities. The definition of 'train' is broad — it includes testing, validating, and fine-tuning, meaning documentation must cover data used in all phases of model development.

1. On or before January first, two thousand twenty-seven, and prior to each time thereafter that a generative artificial intelligence model or service, or a substantial modification to a generative artificial intelligence model or service, released on or after January first, two thousand twenty-two, is made publicly available to New Yorkers for use, regardless of whether the terms of such use include compensation, the developer of such model or service shall post on the developer's website documentation regarding the data used by the developer to train the generative artificial intelligence model or service, including a high-level summary of the datasets used in the development of the generative artificial intelligence model or service, including, but not limited to:
(a) the sources or owners of the datasets;
(b) a description of how the datasets further the intended purpose of the artificial intelligence model or service;
(c) the number of data points included in the datasets, which may be in general ranges, and with estimated figures for dynamic datasets;
(d) a description of the types of data points within the datasets. For purposes of this paragraph, the following definitions apply:
(i) as applied to datasets that include labels, "types of data points" means the types of labels used; and
(ii) as applied to datasets without labeling, "types of data points" refers to the general characteristics;
(e) whether the datasets include any data protected by copyright, trademark, or patent, or whether the datasets are entirely in the public domain;
(f) whether the datasets were purchased or licensed by the developer;
(g) whether the datasets include personal information or personal identifying information, as defined in section eight hundred ninety-nine-aaa of this chapter;
(h) whether the datasets include aggregate consumer information;
(i) whether there was any cleaning, processing, or other modification to the datasets by the developer, including the intended purpose of those efforts in relation to the artificial intelligence model or service;
(j) the time period during which the data in the datasets were collected, including a notice if the data collection is ongoing;
(k) the dates the datasets were first used during the development of the artificial intelligence model or service; and
(l) whether the generative artificial intelligence model or service used or continuously uses synthetic data generation in its development. A developer may include a description of the functional need or desired purpose of the synthetic data in relation to the intended purpose of the model or service.
2. A developer shall not be required to post documentation regarding the data used to train a generative artificial intelligence model or service for any of the following:
(a) A generative artificial intelligence model or service whose sole purpose is the operation of aircraft in the national airspace; or
(b) A generative artificial intelligence model or service developed for national security, military, or defense purposes that is made available only to a federal entity.

PA HB 2288 (AI Training Disclosure) PA

Pending 2026-06-11

Section 9.5(a)-(c)

Plain Language

Any platform that collects user-generated content for AI training must affirmatively disclose that fact to each user at the time of sign-up. The disclosure must be presented separately from the platform's terms of service — it cannot be buried in or combined with the TOS. Users must affirmatively acknowledge receipt of the disclosure before they are permitted to post any content on the platform. This is a notice-and-acknowledgment requirement, not a consent or opt-out regime — the statute does not require the platform to obtain consent to use the content for AI training, only to inform the user and receive acknowledgment. The obligation applies broadly to any application, website, or interface where user content may be collected for AI training purposes.

(a) A platform that collects user-generated content for the purpose of training artificial intelligence algorithms shall disclose to the user that the user-generated content may be used for the purpose of training artificial intelligence. (b) The disclosure shall be presented to the user at the time the user signs up for the platform and shall be separate from the platform's terms of service agreement. (c) Each user of a platform must acknowledge receipt of the disclosure before being allowed to post user-generated content on the platform.

RI H 7190 (Health Insurer AI Transparency) RI

Pending 2026-01-21

T-03.1T-03.3

R.I. Gen. Laws § 27-84-3(b)(1)-(2)

Plain Language

DBR/OHIC must report to the governor and legislative leaders on how health insurers use AI — initially within 18 months of effective date and annually thereafter. While the report is prepared by DBR/OHIC, the data comes from insurers, so this creates an implicit data-production obligation on insurers to provide the information needed. The report must cover, per insurer: AI model types, AI's role in claim decisions, training data governance and bias mitigation measures, and detailed performance metrics including claim volumes, acceptance/denial rates, reviewer time per claim, appeal rates, and reversal rates. The training data and bias reporting component (subsection iii) effectively requires insurers to disclose data governance practices — suitability of data sources, bias identification, and mitigation — making this a training data transparency obligation as well.

(1) DBR/OHIC shall provide an initial report to the governor, the senate president and the speaker of the house on the use of artificial intelligence by health insurers within eighteen (18) months of the effective date of this chapter and annually thereafter. (2) The annual report shall state how health insurers use artificial intelligence to manage claims and coverage. The report shall state, for each insurer: (i) The types of artificial intelligence models used; (ii) The role of artificial intelligence in the decision-making process to approve or deny healthcare claims or coverage whenever artificial intelligence is used to make, or is a substantial factor in making, a decision on healthcare claims or coverage; (iii) Information regarding training, testing, and risk management including data governance measures used to cover the training data sets and the measures used to examine the suitability of data sources, possible biases and appropriate mitigation; and (iv) Performance metrics including: number of claims; percentage of claims accepted and denied; the average time claim reviewers and medical professional reviewers spend on each claim and on denials of claims; percentage of claims appealed; and percentage of denials reversed.

RI S 2010 (AI Health Insurer Transparency) RI

Pending 2026-01-09

T-03.1

R.I. Gen. Laws § 27-84-3(b)(1)-(2)

Plain Language

DBR and OHIC must compile and submit to the governor, senate president, and speaker of the house a report on insurer AI use within 18 months of the effective date and annually thereafter. For each insurer, the report must cover: AI model types, AI's role in claims and coverage decisions, training data governance measures (including suitability of data sources, possible biases, and mitigation), and performance metrics (claims counts, acceptance/denial rates, average reviewer time per claim and denial, appeal rates, and denial reversal rates). While this section imposes the reporting obligation on DBR/OHIC rather than on insurers directly, it effectively requires insurers to furnish all the enumerated information to the regulators — the proactive disclosure obligation in § 27-84-3(a)(1) and the on-request production obligation in § 27-84-3(a)(2) are the mechanisms by which insurers supply this data. The training data governance disclosure (including bias assessment) is a notable data transparency requirement.

(1) DBR/OHIC shall provide an initial report to the governor, the senate president and the speaker of the house on the use of artificial intelligence by health insurers within eighteen (18) months of the effective date of this chapter and annually thereafter. (2) The annual report shall state how health insurers use artificial intelligence to manage claims and coverage. The report shall state, for each insurer: (i) The types of artificial intelligence models used; (ii) The role of artificial intelligence in the decision-making process to approve or deny healthcare claims or coverage whenever artificial intelligence is used to make, or is a substantial factor in making, a decision on healthcare claims or coverage; (iii) Information regarding training, testing, and risk management including data governance measures used to cover the training data sets and the measures used to examine the suitability of data sources, possible biases and appropriate mitigation; and (iv) Performance metrics including: number of claims; percentage of claims accepted and denied; the average time claim reviewers and medical professional reviewers spend on each claim and on denials of claims; percentage of claims appealed; and percentage of denials reversed.

WA HB 1168 (AI Training Data Transparency) WA

Pending 2026-01-01

T-03.2

Sec. 2(1)(a)(i)-(x), (b), (2)

Plain Language

Developers of generative AI systems or services made publicly available to Washington residents must publish detailed training data documentation on their website before each release or substantial modification. The documentation must include a high-level summary covering ten specified categories: dataset sources, how datasets serve the system's purpose, data point counts, data point types, whether data was purchased/licensed/public, presence of personal information, presence of aggregate consumer information, data cleaning or processing performed, dataset training dates, and use of synthetic data generation. The obligation applies retroactively to systems released on or after January 1, 2022, with initial documentation due by January 1, 2026. Three categories are exempt: systems solely for security and integrity, systems solely for aircraft operation in national airspace, and national security/military/defense systems available only to federal entities. The scope of "training" is broad — it includes testing, validating, and fine-tuning by the developer.

(1) On or before January 1, 2026, and before each time thereafter that a generative artificial intelligence system or service, or a substantial modification to a generative artificial intelligence system or service, released on or after January 1, 2022, is made publicly available to Washingtonians for use, regardless of whether the terms of that use include compensation, the developer of the system or service shall post on the developer's internet website documentation regarding the data used by the developer to train the generative artificial intelligence system or service including, but not limited to: (a) A high-level summary of the datasets used in the development of the generative artificial intelligence system or service including, but not limited to: (i) The sources or owners of the datasets; (ii) A description of how the datasets further the intended purpose of the generative artificial intelligence system or service; (iii) The number of data points included in the datasets, which may be in general ranges, and with estimated figures for dynamic datasets; (iv) A description of the types of data points within the datasets; (v) Whether the datasets were purchased or licensed by the developer or if the datasets were publicly available; (vi) Whether the datasets include personal information, as defined in RCW 19.373.010; (vii) Whether the datasets include aggregate consumer information; (viii) Whether there was any cleaning, processing, or other modification to the datasets by the developer, including the intended purpose of those efforts in relation to the generative artificial intelligence system or service; (ix) The dates the datasets were first trained or the date of the last significant update to the datasets during the development of the generative artificial intelligence system or service; and (x) Whether the generative artificial intelligence system or service used or continuously uses synthetic data generation in its development. A developer may include a description of the functional need or desired purpose of the synthetic data in relation to the intended purpose of the system or service. (b) For purposes of this subsection, the following definitions apply: (i) As applied to datasets that include labels, "types of data points" means the types of labels used; and (ii) As applied to datasets without labeling, "types of data points" refers to the general characteristics. (2) A developer is not required to post documentation regarding the data used to train a generative artificial intelligence system or service for any of the following: (a) A generative artificial intelligence system or service whose sole purpose is to help ensure security and integrity; (b) A generative artificial intelligence system or service whose sole purpose is the operation of aircraft in the national airspace; and (c) A generative artificial intelligence system or service developed for national security, military, or defense purposes that is made available only to a federal entity.