Question · California AI Transparency
Do CCPA ADMT rules require a risk assessment?
SB 942 requires large generative AI providers to embed hidden provenance disclosures in content their systems create, offer users a visible disclosure option, and run a free public detection tool.
01 / The answer
The short answer
Yes, for covered processing. The California Privacy Protection Agency's regulations, effective 1 January 2026, require a business to conduct a risk assessment before starting processing that presents significant risk, which includes using automated decisionmaking technology (ADMT) for a significant decision about a consumer. Processing already under way must be assessed by 31 December 2027, and assessments from 2026 and 2027 must be submitted to the Agency by 1 April 2028. Businesses already using ADMT for significant decisions must meet the separate ADMT rules by 1 January 2027.
02 / The rule
What California AI Transparency requires
SB 942 requires large generative AI providers to embed hidden provenance disclosures in content their systems create, offer users a visible disclosure option, and run a free public detection tool. AB 853 moved the operative date to 2 August 2026, the same day EU AI Act Article 50 begins to apply.
- 01Embed a latent disclosure in covered content: provider name, system name and version, creation or alteration time, and a unique identifier.
- 02Make the latent disclosure detectable by the provider's own tool, consistent with industry standards, and permanent or extremely difficult to remove.
- 03Offer users the option of a clear, conspicuous manifest disclosure appropriate to the medium.
- 04Provide a free, publicly accessible detection tool with upload or URL input and an API, without outputting personal provenance data.
03 / Records
Records to keep
- 01Latent disclosure specification and per-release test results
- 02Logs showing the manifest-disclosure option was offered on each surface
- 03Detection tool uptime and API availability records
- 04Licensee monitoring records with discovery and revocation timestamps
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
California Legislative Information
California Legislative Information
California State Assembly
Coalition for Content Provenance and Authenticity
RELATED
Related: California AI Transparency: the full guide · Does California require AI training-data disclosure? · When does California SB 942 take effect? · What is California SB 53 frontier AI law?