California SB 942 — AI Transparency Act (AI-Generated Content): AI Compliance Requirements

If you are a "covered provider" — you create, code, or otherwise produce a GenAI system that has over 1,000,000 monthly visitors or users and is publicly accessible within California — you must make available an AI detection tool at no cost to the user. The tool must: assess whether image, video, or audio content (or any combination) was created or altered by your GenAI system; output any system provenance data detected (and no personal provenance data); be publicly accessible; let users upload content or provide a URL; and support an API so the tool can be invoked without visiting your website. You must also collect user feedback on the tool's efficacy and incorporate it, and may not collect or retain personal information from tool users except opt-in feedback contact details.

Covered providers must include a latent (hidden, machine-detectable) disclosure in AI-generated image, video, and audio content. To the extent technically feasible and reasonable, the latent disclosure must convey: (1) the name of the covered provider; (2) the name and version number of the GenAI system that created or altered the content; (3) the time and date of the creation or alteration; and (4) a unique identifier. The disclosure must be permanent or extraordinarily difficult to remove, must be detectable by the covered provider's own AI-detection tool, and must be consistent with widely accepted industry standards. If you license your GenAI system to third parties, the license must contractually require the licensee to maintain the disclosure capability, and you must revoke the license within 96 hours of discovering that a licensee's modification disabled the required disclosures (§ 22757.3(c)).

Offer users the option to include a manifest (visible) disclosure in AI-generated or altered image, video, or audio content. Under § 22757.3(a) the disclosure must: (1) identify the content as AI-generated; (2) be clear, conspicuous, appropriate for the medium, and understandable to a reasonable person; and (3) be permanent or extraordinarily difficult to remove, to the extent technically feasible.

If you operate a "large online platform" — a public-facing social media platform, file-sharing platform, mass messaging platform, or stand-alone search engine that distributes content to users who did not create or collaborate in creating it, and that exceeded 2,000,000 unique monthly users during the preceding 12 months — then from January 1, 2027 you must detect whether provenance data meeting the applicable standards exists in distributed content, provide users an interface disclosing that provenance/authenticity data, and must not, to the extent technically feasible, knowingly strip system provenance data from content. This obligation is separate from the covered-provider duties and applies only to large online platforms.

While SB 942 does not mandate C2PA specifically, the statute requires latent disclosures to be "consistent with widely accepted industry standards" (§ 22757.3(b)), and C2PA Content Credentials is the de-facto industry standard for provenance metadata. Providers should implement C2PA-compliant metadata for AI-generated images and video. This also aligns with EU AI Act Article 50 provenance requirements. Note: whether a given C2PA implementation satisfies § 22757.3 is a compliance determination — C2PA does not certify statutory compliance.

If you operate a "generative AI system hosting platform" — an internet website or application that makes the source code or model weights of a GenAI system available for download by a California resident, whether or not for compensation — then from January 1, 2027 you must not knowingly make available a GenAI system that does not place the disclosures required by § 22757.3. This obligation is separate from the covered-provider duties and applies only to hosting platforms.

If you manufacture "capture devices" — devices that can record photographs, audio, or video content, including video and still cameras, mobile phones with built-in cameras or microphones, and voice recorders (§ 22757.1) — sold in California on or after January 1, 2028, you must, to the extent technically feasible, give users the option to include a latent disclosure in content the device captures, and embed latent disclosures in captured content by default. This obligation is separate from the covered-provider duties and applies only to capture device manufacturers.