AI Transparency Bill (SB 313) - Compliance Guide

· About AI Transparency Bill (SB 313)

Key Takeaways

  • California’s AI Transparency Act applies to certain operators of generative AI systems and large online platforms that make AI-created or AI-altered image, video, or audio content available to California users, with the core regime operative on 2 August 2026.[5][10]
  • A 2025 amendment, AB 853, pushed the original operative date from 1 January 2026 to 2 August 2026 and added phased duties for large online platforms, GenAI hosting platforms, and capture-device manufacturers.[1][5][13]
  • Covered providers must offer a no-cost AI detection tool that can assess whether content was created or altered by the provider’s system and output any detectable provenance data, while also making manifest and latent disclosures available as required.[5][10]
  • Large online platforms must provide a user interface that clearly and conspicuously informs users whether provenance data or digital signatures are embedded in, attached to, or otherwise associated with content, and this disclosure regime is already operative.[4][9]
  • Violations can trigger civil penalties enforced through California’s civil-penalty framework, and the statute also contemplates injunctive or compliance-related relief through enforcement by the Attorney General or authorized plaintiff mechanisms.[5][6]
  • The law is still being actively amended in 2026, including proposals that would further refine provenance-data duties and platform obligations, so compliance teams should confirm the latest chaptered text before implementation.[2][9][11]

What It Is

California’s AI Transparency Act is the state’s disclosure-focused AI law for generative AI content, designed to make AI-produced or AI-modified media more identifiable to end users and to expose provenance information where available.[5][10] It is enforced under California law by the state’s civil enforcement authorities, with the statute embedded in the Business and Professions Code framework and implemented through phased obligations for different actors in the AI and platform supply chain.[5][6]

The enacted regime was initially set to become operative on 1 January 2026, but AB 853 amended the statute in 2025 and delayed operative dates to 2 August 2026 for the original covered-provider obligations.[1][5][13] The law now operates in phases: core covered-provider duties are operative on 2 August 2026, while some platform-related obligations were added on a later schedule, including a 1 January 2027 start for certain hosting-platform duties as described in secondary legislative analyses.[5][7]

Who Must Comply

The central category is the covered provider of a generative AI system: the statute targets persons that create, code, or otherwise produce a publicly accessible GenAI system with more than 1,000,000 monthly visitors or users in California.[10] Secondary analyses describe the law as applying to systems publicly accessible within California’s geographic boundaries, which gives it practical extraterritorial reach for out-of-state providers whose services are used in California.[10][13]

AB 853 broadened the law to reach additional actors, including large online platforms, GenAI hosting platforms, and capture-device manufacturers, each with distinct obligations and effective dates.[1][5][7] The later amendments also signaled that platform obligations may turn on whether provenance data or digital signatures are embedded, attached to, or otherwise associated with content, rather than only whether they are “available.”[4][9]

No broad consumer-sector exemption appears in the materials reviewed; instead, applicability is functional and threshold-based, focusing on the type of AI system, its scale, and whether the actor is distributing, hosting, or capturing the content at issue.[5][10] Because the statute continues to be amended, teams should verify whether any later chaptered bill has narrowed or clarified the thresholds before relying on a prior version.[2][9]

Core Requirements

  1. AI detection tool: Covered providers must make available, at no cost, a tool that allows a user to assess whether image, video, audio, or combined-format content was created or altered by the provider’s GenAI system and that outputs any system provenance data detected in the content.[5][10]
  2. Manifest disclosure: Covered providers must include conspicuous disclosure of AI involvement in the content itself, using a notice that is intended to be visible to users at or near the point of interaction.[5][13]
  3. Latent disclosure: Covered providers must also place a machine-readable or embedded disclosure in the content, so that downstream tools can identify AI creation or alteration even where the user-facing disclosure is not visible.[5][13]
  4. Platform user interface notice: Large online platforms must provide a user interface that clearly and conspicuously tells users whether provenance data or digital signatures are available, and current 2026 legislative updates would tighten this to whether such data are embedded, attached to, or otherwise associated with the content.[4][9]
  5. Content provenance support: The law assumes the use of provenance data or digital signatures and places pressure on covered entities to preserve, surface, and transmit that information across content workflows.[4][5]
  6. Operational readiness: Compliance is not purely a labeling exercise; providers and platforms must be able to detect, display, and preserve disclosures consistently enough to satisfy the statute’s content-specific requirements and avoid misleading users.[5][6]

Deadlines and Penalties

| milestone | date | what applies | |---|---|---| | Original operative date | 1 January 2026 | Delayed by AB 853 before taking effect.[1][13] | | Core covered-provider duties operative | 2 August 2026 | AI detection tool, manifest disclosure, and latent disclosure requirements for covered providers.[1][5][13] | | Large online platform disclosure obligations | 2 August 2026 | User-interface disclosure duties tied to provenance data and digital signatures.[4][9] | | Later hosting-platform phase-in | 1 January 2027 | Secondary analyses describe later obligations for GenAI hosting platforms.[5][7] |

Maximum civil penalties are described in secondary analyses as enforced through California’s consumer-protection-style civil-penalty structure, with exposure for noncompliance including monetary penalties and compelled compliance.[5][6] Because the reviewed materials do not provide a single consolidated penalty schedule in the snippets available here, compliance teams should confirm the exact penalty amount and enforcement mechanism in the current codified text before relying on an earlier summary.[5][6]

How to Comply

  1. Map scope and thresholds: Confirm whether the business creates, codes, produces, hosts, or distributes a GenAI system and whether California-user access or the 1,000,000-user threshold brings it into scope.[10][13]
  2. Inventory content flows: Identify where image, video, audio, and mixed media are generated, altered, stored, transmitted, and republished, because the disclosure rules attach to the content lifecycle.[5][10]
  3. Implement provenance architecture: Build or integrate provenance-data and digital-signature support so content can carry latent disclosure from creation through downstream distribution.[4][5]
  4. Deploy user-facing disclosures: Create manifest notices that are clear, conspicuous, and durable across web, mobile, and API delivery channels.[5][13]
  5. Build the detection tool: Offer a no-cost tool that can identify whether qualifying content was AI-created or AI-altered by the provider’s system and surface any detectable provenance data.[5][10]
  6. Align governance with ISO 27001 and NIST CSF 2.0: Use ISO 27001 controls for asset management, change control, and logging, and map operational governance to NIST CSF 2.0 functions for identify, protect, detect, respond, and recover.[]
  7. Add AI-specific management controls: Use ISO 42001 to formalize AI roles, impact assessment, model lifecycle controls, and documentation so disclosures stay accurate as models change.[]
  8. Test and audit continuously: Run periodic verification that disclosures appear correctly, provenance survives transformation, and the user interface still meets the “clear and conspicuous” standard after product releases.[5][6]

Related Regulations

California Consumer Privacy Act/CPRA overlaps because both regimes affect consumer-facing data practices, but the AI Transparency Act is about content provenance and AI disclosure rather than privacy rights and notices. Colorado AI Act overlaps because it regulates high-risk AI decision-making, while California’s law focuses more narrowly on provenance and disclosure. EU AI Act overlaps because both regimes push transparency and traceability for AI outputs, and AB 853’s delayed timing was widely described as aligning with the EU rollout. FTC Act, Section 5 can conflict or overlap where deceptive AI claims or misleading provenance notices create unfair or deceptive practices exposure beyond state disclosure duties. Illinois Biometric Information Privacy Act can overlap where AI-generated media, capture-device systems, or biometric processing are part of the same workflow, though the legal theories and triggers differ.

FAQ

Does the California AI Transparency Act apply to companies outside California?

Yes, if the company’s GenAI system is publicly accessible in California and meets the statutory threshold for covered providers.[10][13] The law’s practical reach is therefore extraterritorial for out-of-state businesses serving California users.[10]

What changed in 2025 and 2026?

AB 853 delayed the operative date from 1 January 2026 to 2 August 2026 and added phased obligations for large online platforms, GenAI hosting platforms, and capture-device manufacturers.[1][5][13] 2026 materials also show additional amendment activity around provenance-data wording and platform disclosures, so the law remains in motion.[2][9][11]

What content is covered?

The statute focuses on image, video, audio, and combined-format content that was created or altered by a generative AI system.[5][10] It is aimed at making that content identifiable to users and detectable by downstream tools through manifest and latent disclosures.[5][13]

Do platforms need to verify every piece of AI content?

The statute does not appear to impose a universal verification duty for all online content; instead, it requires specific user-interface disclosures and provenance-aware functionality for covered platforms and providers.[4][9] The exact operational burden depends on whether the entity falls within the covered-provider or platform categories.[5][10]

Are the penalties the same for all violators?

The reviewed materials indicate civil-penalty exposure and enforcement consequences, but they do not show a single flat penalty amount in the snippets available here.[5][6] The practical exposure will depend on the violation, the enforcement path, and the final codified text in effect when the conduct occurred.[5][6]

Is the law final, or could it change again?

It could change again, because 2026 bill-tracking materials show active amendments and related proposals affecting the same chapter.[2][9][11] Compliance should therefore be anchored to the current enacted text, not to the original 2024 version or a pre-amendment summary.[1][5]

Sources

Put it into practice

More compliance guides