California · AI Transparency Act
California SB 942: the four duties, and the evidence each one leaves behind
SB 942 is operative 2 August 2026. It tells covered providers what to embed, what to offer, what to run, and how fast to revoke — it does not tell them how to prove any of it afterwards.
01 / Who owes what
Who owes what
The test is narrow, and it lands on the builder of the system rather than the business that merely uses one.
| Who | What the duty requires | Provision |
|---|---|---|
| Covered provider | Embed a latent disclosure in covered content: provider name, system name and version, time and date created or altered, and a unique identifier. | § 22757.3 |
| Covered provider | Offer the user the option of a manifest disclosure, clear and conspicuous, appropriate to the medium. | § 22757.3 |
| Covered provider | Make available a free, publicly accessible AI detection tool for content created by the provider's system. | § 22757.2 |
| Covered provider that licenses its system | Revoke the licence within 96 hours of discovering a licensee modified the system so it no longer applies the required disclosures. | § 22757.4 |
| Licensee | Stop using the system once the licence is revoked. | § 22757.4 |
Two widely misread points about the threshold: there is no measurement window (a June 2024 amendment struck the 12-month averaging clause), and the count is not California-only. Plan against the worldwide count.
02 / Find your duty
Quick decision
Each branch comes from the duties below. Read the provision before relying on it.
Three yeses makes you a covered provider, and all four duties attach on 2 August 2026.
Embed a latent disclosure carrying the four data elements, detectable by your own tool and permanent or extremely difficult to remove.
Offer the user a manifest disclosure. The duty is to offer, not to apply.
Run a free public detection tool that identifies your own system's output, with upload or URL and an API.
Revoke the licence within 96 hours of discovery.
Probably not you: a company that only calls a third-party model through an API is generally not the covered provider for that model — but licensing somebody else's covered system carries its own obligation, and it runs on a 96-hour clock.
03 / Dates
One deadline, shared with Brussels
SB 942 passed in 2024 with a 1 January 2026 start. AB 853 moved it to the same day the EU AI Act's transparency article begins to apply.
Latent disclosure, the manifest disclosure option, the public detection tool and the 96-hour revocation duty are all live. Penalties accrue per day.
EU AI Act Article 50 begins to apply. A provider serving both markets gets one deadline, not two.
AB 853 extends the regime to further classes of duty holder on later dates; this page does not state those dates.
04 / The duties
The four duties
Each duty as the statute frames it, then as an engineer has to build it, then as an enforcement inquiry will test it.
In practice a watermark or a signed metadata assertion; C2PA Content Credentials is the standard most providers are reaching for. The statute names no technology — it names four data elements, a detectability requirement and a durability requirement. "Technically feasible" is part of the duty, not a defence to it, and whether text is covered was never settled.
AN INQUIRY ASKS · For this specific artefact, on this specific date, what did you embed, and what were the four values?
▸ Read the provision
Covered content must carry a disclosure embedded in the content itself, conveying — where technically feasible and reasonable — the provider's name, the name and version of the system that produced it, the time and date it was created or altered, and a unique identifier. It must be detectable by the provider's own detection tool, consistent with relevant industry standards, and permanent or extremely difficult to remove.
Note the verb. The duty is to offer, not to apply. The user decides — so the compliance artefact is a record of the offer being available on a channel at a time, not a visible mark on any particular file.
AN INQUIRY ASKS · Was the option actually presented on this surface during the period under review, or did it silently regress in a release three months ago?
▸ Read the provision
A covered provider must offer the user the option of a manifest disclosure — one a person can actually see — applied in a clear and conspicuous manner, appropriate to the medium, and permanent or extremely difficult to remove.
A duty to operate a service, continuously. Uptime is the compliance posture, and the penalty is calculated per day. One relief: the tool only has to identify your own system's output.
AN INQUIRY ASKS · On which days was the tool reachable and answering? Prove it for the whole period, not for the day you were asked.
▸ Read the provision
A covered provider must make available a free, publicly accessible AI detection tool that accepts content from a user and assesses whether it was created by the provider's system. It must accept upload or a URL, expose an API, output any available system provenance data — and it must not output personal provenance data about the person who created the content.
The only duty in the Act with a clock on it. The trigger is actual knowledge; the statute adds no "or reasonably should know". Ninety-six hours from discovery makes the moment of discovery a legally load-bearing fact.
AN INQUIRY ASKS · When did you find out, and when did you revoke? The gap between those two timestamps is the entire question.
▸ Read the provision
Where a covered provider licenses its system to a third party, and later discovers that the licensee has modified the system so that it no longer applies the required disclosures, the provider must revoke the licence within 96 hours of discovery. The licensee must then stop using the system.
05 / Timeline & enforcement
How the dates fit together, and who enforces
SB 942 enacted. The California AI Transparency Act is signed, with an original operative date of 1 January 2026.
AB 853: amended, delayed, and widened. Pushes the operative date to 2 August 2026 and extends the regime to further classes of duty holder on later dates.
The four duties attach. All four duties are live. Penalties accrue per day.
EU AI Act Article 50 begins to apply. The EU duties are different in shape — one evidence trail can answer both, but only if it was designed to.
| Enforcement | What the page states |
|---|---|
| Who enforces | The Attorney General, city attorneys and county counsel, by civil action only. |
| Penalty | $5,000 per violation. Each day of a continuing violation is a separate violation. |
| Guidance | None, and there cannot be regulations: Chapter 25 delegates rulemaking authority to no one. |
| Litigation | None on this statute. A late-2025 suit against the Attorney General concerns California's training-data law, not this one. |
| Pending | A further bill on large-online-platform provenance data passed the Assembly in May 2026. It does not touch the operative date. |
Almost nothing has happened so far. The per-day penalty means exposure accrues quietly during exactly the period when nobody is knocking.
06 / Where Planisphere fits
Duty → receipt
This is where Planisphere enters, and not before. Planisphere is an evidence layer. It sits beside your systems, never inside the act.
Embeds the disclosure, offers the manifest option, runs the detection tool, revokes the licence.
Hash-chained into a per-tenant series, signed and periodically anchored, so a later edit to an earlier record is detectable.
Every sealed record has a public standing endpoint — no key, no login, no relationship with us.
It does not embed latent disclosures, operate your detection tool, present the manifest option or revoke licences. A record is evidence a third party can check; it is not a finding that you complied.
QUESTIONS
The questions that come next
We use a third-party model. Are we the covered provider?+
Generally not — the duties fall on whoever creates, codes or produces the system, which is the model developer rather than a business calling its API. But if you have licensed a covered system and modified it in a way that strips the disclosures, duty four makes you the subject of a 96-hour revocation by your licensor.
Does the penalty really run per day?+
Yes. The defensible question is not "are you compliant" — it is "on which days can you show you performed the duty". A continuous per-day record answers a per-day penalty. A screenshot does not.
We are already doing C2PA. Isn't that enough?+
C2PA addresses the latent disclosure duty well, and it is the obvious way to meet the "consistent with industry standards" language. It does not address the detection tool, the manifest disclosure option, or the 96-hour revocation.
What if we start recording after 2 August?+
Then your evidence begins on the day you start, and it says so. A record cannot be back-dated. Starting late is recoverable. Starting late and pretending otherwise is not.
Does this cover the EU obligations too?+
The same evidence discipline, different duties. Article 50 binds providers and deployers differently and turns on marking and disclosure rather than detection tools and licensing. <a href="/regulations/eu-ai-act-article-50">EU AI Act Article 50: provider and deployer requirements</a>
SOURCES
Go back to the source
The four duties, the covered-provider definition, the one-million threshold, the $5,000 per-violation penalty, and the enforcement provisions.
Moves the operative date to 2 August 2026 and extends the regime to further classes of duty holder on later dates.
Article 50, whose transparency obligations begin to apply on the same date California's do.
The own-outputs-only reading of the detection tool, the unresolved question of whether text is covered, and the amendment that struck the 12-month averaging window.
The provenance standard most covered providers are adopting to satisfy the latent disclosure duty.
RELATED
Related: EU AI Act Article 50 · AI content labeling laws, compared · All five AI transparency regimes · China AI labelling Measures · India IT Rules on synthetic media · Korea AI Framework Act