California’s AI transparency rules are no longer a future compliance slide. The first duties became operative on August 2, 2026, while a second wave is already dated for 2027 and 2028.
The California AI transparency law now requires certain large generative-AI providers to offer detection tools and embed provenance disclosures in generated images, video, and audio. It does not make every California creator add a watermark, and it does not impose every obligation on the same day.
That distinction matters because online summaries often collapse providers, hosting platforms, social networks, camera makers, and individual users into one rule. The enacted text separates them. It also uses different thresholds and start dates.
Who is covered now
California Business and Professions Code section 22757 defines a covered provider as a person that creates or codes a generative-AI system with more than one million monthly visitors or users and makes it publicly accessible in California. The operative date is August 2, 2026, after AB 853 moved the original timetable.
Scope check
The August 2026 duties target providers
A creator using a covered model is not automatically the covered provider. The threshold is tied to the organization that creates or codes the system and exceeds one million monthly users or visitors.
A covered provider must make a free AI-detection tool available. For image, video, and audio content, the tool must accept a file upload or URL and, when technically feasible, provide an API. Its result is about system provenance—whether content was created or altered by the provider’s system—not the personal identity of whoever made it.
The law asks for visible and latent disclosures
User option
Manifest disclosure
The provider must offer a clear option for a user to add a visible disclosure to generated or altered image, video, or audio content.
Provider duty
Latent disclosure
The provider must embed a machine-readable disclosure with the provider, model or version, creation time, and a unique identifier.
The latent disclosure must be detectable by the provider’s tool, aligned with widely adopted industry standards when they exist, and designed to resist removal when technically feasible. Providers that license their models must also contractually require licensees to preserve the disclosure capability. If a provider knows a licensee disabled that capability, the statute calls for revocation within 96 hours.
This is closer to a provenance system than a corner logo. A visible badge helps a person at the point of viewing. A latent or standards-based record is meant to survive copying and give platforms or detectors something to inspect. Our earlier analysis of TikTok’s Bold Glamour filter showed why that durability matters: the transformed pixels can travel while the platform label disappears.
The compliance calendar has three dates
| Date | Actor | Main obligation | Builder decision |
|---|---|---|---|
| August 2, 2026 | Covered generative-AI providers | Detection tool, manifest option, latent disclosure, licensing controls. | Confirm traffic threshold, media types, provenance fields, API, retention rules, and license contracts. |
| January 1, 2027 | Large online platforms and GenAI hosting platforms | Detect supported provenance, show disclosure, preserve access to it, and avoid knowingly stripping or hosting non-disclosing systems. | Map ingestion, transcoding, download, repost, and model-hosting paths before enforcement begins. |
| January 1, 2028 | Covered capture-device manufacturers | Offer optional latent disclosure and enable embedding by default for covered devices first sold in California. | Plan firmware, standards support, opt-out design, and export behavior early. |
The 2027 platform rules apply to a “large online platform,” defined with a separate threshold of at least two million monthly users in California. When a supported disclosure is present, the platform must make it visible through its interface and let users inspect, download, or link to the provenance information. It must not knowingly remove the standard disclosure.
Starting in 2027, a generative-AI hosting platform also may not knowingly offer a system that cannot produce the required latent disclosure. In 2028, covered manufacturers of cameras and other capture devices first sold in California must offer latent provenance and enable it by default when technically feasible and consistent with standards.
Detection is useful, but it is not identity proof
The statute explicitly separates system provenance from personal provenance. A result can say that a provider’s model created or altered media. It should not be read as proof that a named person made it, approved it, or intended the surrounding claim.
The detection tool also comes with data-handling restrictions. A provider may not use submitted content or personal information for unrelated purposes, and retention must be limited to what is reasonably necessary to provide the result or improve accuracy. Compliance teams should therefore review the detector as a public data-ingestion endpoint, not merely a marketing page.
This complements, rather than replaces, the disclosure duties we explained in our EU AI Act labeling guide. The jurisdictions use different definitions, actors, timelines, and enforcement mechanisms. A global product needs a requirements map, not a single “AI watermark” checkbox.
The penalty turns delay into multiplication
The California Attorney General, a city attorney, or a county counsel can seek a civil penalty of up to $5,000 per violation. The statute says each day is a separate violation. That makes a persistent missing control more expensive than a one-time implementation bug.
Illustrative exposure, not a prediction
At the statutory maximum, one continuing violation over 30 days could reach $150,000: 30 days × $5,000. Whether conduct counts as one or several violations, and the penalty actually sought, depends on enforcement facts. The calculation shows why the remediation clock matters; it is not a legal conclusion about any company.
The statute includes exclusions, including systems used exclusively for non-user-generated video games, television, streaming, movies, and interactive experiences. Teams should test the actual product and user-generated-content flow against the text rather than assume every entertainment system is exempt.
A practical compliance pass for builders
Seven questions to answer now
- Are we a covered provider? Document the system-creation role, California availability, and monthly-user or visitor count.
- Which outputs are covered? Inventory image, video, and audio generation or alteration across products and APIs.
- Can users add a manifest disclosure? Test the actual export, not only the editor preview.
- Does latent provenance survive? Run downloads through compression, transcoding, cropping, and platform reposts.
- Can the public detector verify it? Test uploads, URLs, API output, error cases, accessibility, and retention.
- Do licensees preserve the capability? Update contracts, monitoring, notice, and the 96-hour revocation process.
- Are 2027 dependencies mapped? Identify every platform, host, and ingestion path that will need to read or preserve provenance.
My verdict: build provenance as a product surface
The California AI transparency law is important because it makes provenance testable. A detector must be public. A disclosure must carry specified fields. Platforms will have to expose supported records. License contracts need a preservation and revocation path.
Do not bury this work in a legal appendix. The user option, detector, API, metadata, export pipeline, hosting controls, and retention behavior are product features. Build them with owners, logs, tests, and failure budgets. A label that appears in the editor but disappears after export is not a compliant provenance system.
Read the source record
- Read the current California Business and Professions Code, Chapter 25.
- Review AB 853 and its effective-date changes.
- Use the California Reddit discussion only as public reaction.
- Compare California’s framework with our Meta AI video provenance analysis.
Which part of your media pipeline can still remove provenance without anyone noticing?
Checked August 8, 2026. This article explains the enacted text for a builder audience and is not legal advice. Thresholds, definitions, exemptions, enforcement, and technical feasibility should be reviewed against the current statute and your product facts.
