Law / United States / 
California
California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713)
Cal. Bus. and Prof. Code Sections 22757 to 22757.6
In force since .
An AI transparency rule binding private bodies.
- Audit expectation
- none
- Setting the rule reaches
- General
What it requires
- Make available, at no cost to the user, a disclosure verification tool that lets a user assess whether image, video, or audio content was created or altered, other than by a minor modification, by your generative AI system and that outputs any system provenance data detected in the contentNIST AI RMFMEASURE 2.8
- To the extent it is technically feasible, embed in image, video, and audio content your system creates or alters a latent disclosure carrying your name, the system's name and version, the time and date, a unique identifier, and whether the system created or altered the content, and make it permanent or extraordinarily difficult to removeNIST AI RMFMEASURE 2.8
- Do not collect, use, retain, sell, share, or otherwise make available personal information derived from a user of the verification tool or from content it processes beyond what is strictly necessary, and do not make access to your system or the tool depend on a user providing personal information beyond thatNIST AI RMFMEASURE 2.10
- If you license your system, tell the licensee its obligations under the chapter; if you know a licensee modified it so that it no longer complies, end the licensee's authorization or notify the licensee within 72 hours, and report an unresolved licensee's noncompliance to the Attorney GeneralNIST AI RMFGOVERN 6.1
- Do not falsely represent that your generative AI system is designed to primarily function as assistive technologyNIST AI RMFMAP 3.3
- If you run a large online platform, from detect provenance data in content distributed on it, show users a clear indication of whether any system provenance data or digital signature identifies the content as generated, substantially altered, or captured by a device, let users inspect that data, and, to the extent technically feasible, do not knowingly strip itNIST AI RMFMEASURE 2.8
- If you manufacture a capture device that you first produce for sale in California on or after , provide users the option to include in captured content a latent disclosure naming you as manufacturer, the device's name and version, and the time and date of the content's creation or alteration, and embed latent disclosures in captured content by default, to the extent technically feasible and compliant with widely adopted specifications
- Later phases add duties for GenAI hosting platforms from
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 6.1Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- NIST Privacy Framework
- CT.DP-P4System or device configurations permit selective collection or disclosure of data elements.
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Bus. and Prof. Code section 22757.4(a)(1): a violator of the chapter is liable for a civil penalty of $5,000 per violation, collected in a civil action filed by the Attorney General, a city attorney, or a county counsel; a prevailing plaintiff also recovers reasonable attorney's costs and fees. Section 22757.4(b) makes each day a covered provider, large online platform, or capture device manufacturer remains in violation a separate, discrete violation. Section 22757.4(d) leaves out a violation of section 22757.3(d), the bar on falsely representing a generative AI system as designed to primarily function as assistive technology, which carries a civil penalty of $50,000 per violation under section 22757.4.1 until that section is repealed on . The chapter names no administrative fine and no private right of action.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 5,000
Over one month of continuous breach, USD 152,200.
Who enforces it
Enforcement body
California Attorney General, a city attorney, or a county counsel, each empowered to bring a civil action for the chapter's civil penalty; the chapter names no administrative regulator.
Enforcement record
The chapter names no administrative regulator; its civil penalty under Section 22757.4 is recovered only in a civil action filed by the Attorney General, a city attorney, or a county counsel, and the Attorney General's site carries no dedicated page for this chapter comparable to its Transparency in Frontier Artificial Intelligence Act page. A review of the Attorney General's most recent press releases, September 1 through , names no civil action or civil penalty under this chapter; that window does not reach back to the chapter's operative date as set by AB 853, and earlier press releases were not reviewed.
- As of
- Source link
- https://oag.ca.gov/news
Settledness
- As of
- Open questions
- When is a latent disclosure not "technically feasible" under section 22757.3(a)?
- Is the list of alterations in the definition of "minor modification" in section 22757.1 exclusive, so that any other alteration to image, video, or audio content triggers the latent disclosure?
- Which generative artificial intelligence systems are "designed to primarily function as assistive technology" for the latent disclosure that applies from ?
What it reaches
How the hook was established
express
What makes it apply
Market targeting, Place of effect
Obligation class
Content labelling, Disclosure
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- the generative AI system is publicly accessible within the geographic boundaries of California
What it makes you log
Log retention
Bus. and Prof. Code section 22757.2(c) bars collecting, using, retaining, selling, or sharing that information outright rather than setting a period, so no minimum or maximum value is stated.
- As of
- Basis
- Unspecified
- Prohibits retaining
- Personal information derived from a user of the disclosure verification tool or from content the tool processes, beyond what is strictly necessary to comply with the chapter; a provider may collect, retain, or use personal information for the sole purpose of communicating with a user who opts in to being contacted.
Logging duty
The chapter requires a covered provider to make a disclosure verification tool available and to include a latent disclosure in content its generative AI system creates or alters. It states no duty to create, keep, or produce on demand a log or record of that labelling or of who used the tool; instead it bars the provider from collecting, using, retaining, selling, or sharing the personal information a user's use of the tool would generate beyond what is strictly necessary.
- Kind
- None
- As of
What this law does
A covered provider must make a disclosure verification tool available at no cost to the user, one that lets a user assess whether image, video, or audio content was created or altered, other than by a minor modification, by the provider's generative AI system and that outputs any system provenance data detected in the content.
To the extent it is technically feasible, a covered provider must also include in that content a latent disclosure that names the provider, the system and its version, the time and date of creation or alteration, a unique identifier, and whether the system created or altered the content, and that is permanent or extraordinarily difficult to remove or tamper with.
A covered provider is a person that creates, codes, or otherwise produces a generative AI system that is publicly accessible within California. SB 1000 was chaptered on as Chapter 861 of the Statutes of 2026. It is an urgency statute and went into immediate effect.
SB 1000 deleted the user threshold from the definition of covered provider, replaced the term AI detection tool with disclosure verification tool, and deleted the requirement that a covered provider offer the user the option to include a manifest disclosure in content. A violator of the chapter is liable for a civil penalty of $5,000 per violation, collected in a civil action filed by the Attorney General, a city attorney, or a county counsel, and each day of violation is a discrete violation.
SB 1000 added Section 22757.4.1, which sets a civil penalty of $50,000 per violation, collected in a civil action filed by the Attorney General, a city attorney, or a county counsel, for a violation of Section 22757.3(d), and which is repealed on . A covered provider shall not falsely represent that a generative AI system is designed to primarily function as assistive technology.
Before , the chapter does not apply to a generative AI system that is designed to primarily function as assistive technology. Until the definition of covered provider carried a user-count threshold that the chapter no longer contains. AB 853 (2025) moved the chapter's operative date from to .
AB 853 also added duties for large online platforms and GenAI hosting platforms from and for capture device manufacturers from . AB 2713 was chaptered on as Chapter 856 of the Statutes of 2026. AB 2713 revised the duties and prohibitions applicable to a large online platform in Section 22757.3.1, which is operative on .
Under AB 2713 a large online platform must detect whether any provenance data is embedded into, attached to, or otherwise associated with content distributed on the platform. It must provide a user interface that reliably indicates whether any system provenance data or digital signature associated with content identifies the content as generated or substantially altered by a GenAI system or captured by a capture device.
It must allow a user to inspect any system provenance data associated with the content in an easily accessible manner. The section does not require a large online platform to take any action with respect to provenance data, system provenance data, or digital signatures that are not compliant or interoperable with widely adopted specifications issued by an established standards-setting body.
The version of the section that AB 853 enacted required a large online platform to detect only provenance data compliant with widely adopted specifications adopted by an established standards-setting body. The chapter is Chapter 25 (commencing with Section 22757) of Division 8 of the Business and Professions Code. A Section 22756 to 22756.6 range sometimes cited for the chapter does not exist.
Section 22757.1 defines a large online platform as a public-facing social media platform, file-sharing platform, mass messaging platform or stand-alone search engine that distributes content to users who did not create or collaborate in creating the content and that exceeded 2,000,000 unique monthly users during the preceding 12 months.
Section 22757.3.3, added by AB 853, requires a capture device manufacturer, for any capture device it first produced for sale in California on or after , to provide a user the option to include a latent disclosure in captured content naming the manufacturer, the device name and version, and the time and date of creation or alteration, and to embed latent disclosures in captured content by default, only to the extent technically feasible and compliant with widely adopted specifications.
When LexLint raises it
When your app profile says your app generates images with AI, generates video with AI, generates audio with AI, deploys a chatbot, reuses other publishers' content or operates a social platform.
Back to the example · Lint your app
Page updated .