How to Comply with California’s AI Transparency Act

Introduction

SB 942, known as the California AI Transparency Act, requires businesses that make generative AI systems available to California residents to label AI-generated images, video, and audio with clear disclosures, embed provenance data in that content, offer a free public AI detection tool on their website, and require licensees by contract to preserve those transparency measures. It sits within a broader wave of California AI laws, distinct from but complementary to data privacy statutes like the California Consumer Privacy Act.

The bill was signed in 2024. California’s AI Transparency Act takes effect on January 1, 2026, and became operative on August 2, 2026, after amendments introduced by AB 853 adjusted the timeline. Provenance data requirements begin January 1, 2027; capture device manufacturer rules begin January 1, 2028.

The Act applies to businesses and providers operating generative AI systems accessible to California residents, including SaaS companies and Shopify merchants that use AI-powered products, marketing, or media tools. It regulates generative AI systems that can create image, video, or audio content for the public. Text-only AI systems (chatbots, large language models producing only text) fall outside the current scope, though future amendments may expand coverage.

This guide explains who must comply, what the labeling, provenance, detection-tool, and contract requirements mean in practice, how enforcement and penalties work, where the law overlaps with other rules, and what steps businesses can take now to align with the Act. The law is designed to reduce deceptive synthetic media and deepfakes in elections, advertising, and commercial activity, so getting compliance right helps businesses avoid fines while protecting consumer trust in AI-generated content.

Does the AI Transparency Act Apply to Your Business?

SB 942 applies to any entity that qualifies as a covered provider. The laws apply based on the user’s location and usage thresholds, not on where the provider is incorporated or where its servers are located.

Your generative AI system is covered if it meets all three criteria:

• It is publicly accessible (free, paid, freemium, or via public API)
• It generates image, video, or audio content, or a combination thereof
• It has at least 1,000,000 monthly active California users

Companies based outside California or outside the US must still comply if their AI system is accessible to California residents and exceeds the threshold. The company’s geographic boundaries do not determine jurisdiction; the user base does.

Three concrete examples:

1. A US-based image-generation API has 2 million US users, but only 500,000 in California. This system does not cross the threshold and is not covered under SB 942.
2. A global consumer app with 4 million monthly US users, 1.2 million of whom are California residents, is covered.
3. A small Shopify plugin with 50,000 total users is not covered by SB 942 but remains subject to other AI and privacy laws.

Scope: What Counts as a Covered Generative AI System?

A Generative Artificial Intelligence System under SB 942 is any AI system that generates or derives synthetic content, including images, videos, and audio, emulating the structure and characteristics of its training data. The system must be publicly accessible, including free apps, freemium services, and public APIs that power consumer-facing products.

Covered content types:

• User-prompted image synthesis (AI-generated image creation)
• Video content creation tools
• Voice-cloning, audio content generation, and voice recorders producing synthetic speech, including substantially modifying media when the output is synthetic

Excluded or out of scope:

• Non-interactive entertainment such as TV, streaming, cinema productions, and video games with interactive experiences, as specified in the Act
• Text-only generative AI (chatbots, natural language interface tools producing only text)
• Still photography cameras and mobile phones with built-in cameras that only record photographs or capture device content without AI synthesis

It does not cover text-only generation; compliance focuses on media types like images and videos. Future amendments may change this.

Key Requirements Under the California AI Transparency Act

These are the key requirements that any covered provider must implement:

1. AI-generated content labeling and disclosure: Every AI-generated image, video, or audio must carry both latent and manifest disclosures identifying it as AI-generated.
2. Embedded provenance data: At the time of generation, provenance data must be embedded in the content. Latent disclosures must include the AI system’s name and version, a timestamp of the content’s creation, a unique identifier, and which parts were created or altered.
3. Free public detection tool: Covered providers must offer a free AI detection tool accessible on their internet website, allowing any natural person to check whether content was generated by their genAI system.
4. Contractual obligations for licensees: Any third-party licensee using a licensed genAI system must contractually maintain disclosure capabilities. If a licensee disables provenance features, the provider must revoke the license.
5. Record-keeping and monitoring: Providers must track changes to AI systems relevant to transparency and maintain documentation.

California’s AI Transparency Act also intersects with AB 2013, which requires developers to disclose training data sources before each release. Some providers face overlapping obligations: content provenance under SB 942, training data transparency under AB 2013, and automated decision-making rules under CCPA/CPRA.

These requirements support consumer protection and reduce deceptive uses of deepfakes in elections, advertising, and commerce.

How to Label AI-Generated Content Clearly and Consistently

The Act requires that AI-generated content include clear, permanent disclosures so that a reasonable person can understand the content was created or substantially modified by a generative AI system. Both a manifest disclosure (visible label that identifies content as AI-generated) and a latent disclosure (embedded metadata) are mandatory.

Recommended label wording examples:

• “Generated by AI”
• “AI-Generated Image”
• “This audio was created using artificial intelligence”

Labels should match the language and format of surrounding content. Visible disclosures identifying synthetic media as AI-generated are required and should identify content clearly wherever consumers see it: on product pages, in marketing emails, in social posts, and in ad creatives. Hiding labels behind tooltips or burying them in terms and conditions does not satisfy the requirement.

For sensitive use cases such as political advertising, health-related claims, or financial advice, a reasonable-person standard likely requires even more prominent placement. The California Department of Justice and the California Privacy Protection Agency have both flagged these areas for heightened scrutiny.

Shopify merchant checklist:

• Add AI labels on product images enhanced by generative AI
• Disclose AI-generated audio or video in product demos
• Integrate these practices into existing legal and marketing review processes

Implementing Provenance Data and Capture Device Protections

Provenance data must be embedded in AI-generated content at the moment of generation. This means cryptographic or metadata-based signals that reliably indicate a specific generative AI system produced the content. Required fields in system provenance data include the provider’s name, model name and version number, creation timestamp, which parts were generated or altered, and a unique identifier. Personal provenance data (containing device identifiers linkable to a specific user and tied to sharing only where a user opts in) must be handled with privacy safeguards.

The law expects that embedding is technically feasible and resilient. Basic editing (cropping, compression, resizing) should not strip the watermark. Where possible, the methods used should also align with widely accepted industry standards. When embedding directly in the file is extraordinarily difficult, the statute permits a link to a permanent website to be repeated within the content. A capture device manufacturer must, starting January 1, 2028, offer options to embed provenance data into content captured by still photography cameras, mobile phones, and voice recorders with built-in cameras.

Providing a Free Public Tool to Verify AI-Generated Content

Companies must provide a free AI detection tool by August 2, 2026. This detection tool must be publicly accessible on the provider’s internet website, available without paywalls, and usable by average consumers, journalists, and regulators.

Core feature expectations:

• Simple upload or URL-based check for image, video, or audio content
• Clear output such as “likely generated by [AI system]” or “no provenance data found”
• Basic explanation of what the result means
• AI detection tools must be provided at no cost to users

The tool must not collect or retain personal provenance data from uploads except in narrow, specified circumstances. Rate-limiting and abuse prevention are advisable. Privacy safeguards should protect children and prevent content distributed through the tool from being stored or repurposed.

Enterprises can integrate the provider’s verification API into content moderation workflows, trust-and-safety systems, or large online platform content-review pipelines. This tool identifies content as AI-generated and flags it before publication.

Contractual Obligations for Licensees and Downstream Providers

The Transparency Act does not stop at primary AI companies. Contractual obligations extend to third-party users to maintain disclosure capabilities of AI systems. If you license your generative AI system, existing law requires you to contractually bind licensees.

A covered provider must require every third-party licensee to:

• Preserve manifest disclosure and latent disclosure capabilities in downstream products
• Refrain from removing, tampering with, or disabling provenance features
• Cooperate with audits and provide access for compliance verification
• Accept indemnity provisions covering non-compliance and potential civil action

If a licensee disables the ability to embed provenance data, the provider must revoke the license. The attorney general and, in some cases, a city attorney or county counsel may pursue both the primary provider and the downstream entity.

Penalties, Enforcement, and Overlaps With Other AI Laws

Businesses face a $5,000 fine per day for non-compliance, assessed per discrete violation. Enforcement is primarily through the California Attorney General, with potential for injunctive relief and civil penalties. A city attorney or county counsel can also bring a civil action under certain conditions. There is no private right of action under SB 942.

Typical enforcement triggers include:

• Systematic failure to label AI-generated content with visible disclosures
• Absence of provenance embedding in output files
• No public verification or detection tool
• Willful disabling of transparency mechanisms, including by downstream licensees

SB 942 overlaps with other California AI laws. AB 2013 requires public disclosure of training data characteristics. CCPA/CPRA’s automated decision-making rules impose assessment obligations on systems making decisions about California residents. Existing law under the California Privacy Protection Agency’s enforcement framework adds additional layers. Sector-specific new laws (employment, housing) may apply to AI systems in those domains.

Smaller providers below 1M California users are not directly subject to SB 942. They can still face enforcement under general consumer protection statutes and other AI governance rules, and separate state obligations may also apply in specific contexts, such as reporting duties involving the California Office of Suicide Prevention, making voluntary alignment with transparency best practices prudent. The state’s leadership in AI regulation suggests thresholds may lower over time.

Practical Compliance Roadmap for Providers and Online Businesses

Between now and the operative dates, businesses must establish cross-functional governance for compliance with the California AI Transparency Act. Governance teams should include legal, engineering, product, and marketing stakeholders.

Step-by-step roadmap:

1. Inventory AI systems. Catalog every generative AI system your business operates, licenses, or integrates. Record whether each produces image, video, or audio content and whether it is publicly accessible.
2. Map California users. Pull geographic analytics for monthly active users. Determine whether any system crosses the 1M California users threshold.
3. Gap-analyze current capabilities. Test whether outputs already include manifest labels, latent disclosures, or embedded provenance data. Check whether a detection tool exists.
4. Implement technical solutions. Build or procure watermarking, metadata embedding, and a public verification tool. Ensure compliance focuses on resilience against basic content transformations.
5. Update contracts, policies, and documentation. Revise licensing agreements to include pass-through obligations. Update privacy policies and AI transparency statements. Ensure compliance with broader privacy frameworks like GDPR and CCPA.

For e-commerce and Shopify merchants: Audit whether you use AI-generated product images, reviews, or marketing creatives from third-party tools. Verify that labels and disclosures display correctly on your storefront. Treat this as part of ongoing AI governance and consent management.

Monitor legislative updates, attorney general guidance, and standards bodies (such as C2PA) to adapt practices as the California AG’s office issues clarifications.

How Pandectes Fits Into Your AI Transparency and Privacy Strategy

Pandectes does not provide generative AI or watermarking technology. It is built to manage privacy, consent, and disclosure obligations that intersect with AI transparency requirements for Shopify store owners.

Shopify merchants can use the Pandectes GDPR Compliance app to:

• Manage cookie consent and tracking for AI-enabled features on their stores
• Localize privacy and AI disclosure language specifically for California visitors using multilingual support
• Document user consent when AI-driven personalization or profiling is involved, supporting both self-harm prevention and protect children requirements where applicable

Pandectes helps merchants align with GDPR, CCPA/CPRA, LGPD, and other global data privacy regimes, creating a unified compliance layer. This layer can incorporate AI transparency notices in banners, preference centers, and privacy policies.

Evaluate how your AI systems handle personal data, and consider Pandectes as part of a broader, documented AI governance and privacy stack.

Conclusion

Complying with California’s AI Transparency Act is essential for businesses operating generative AI systems that serve significant numbers of California users. By implementing clear labeling, embedding provenance data, providing free detection tools, and enforcing contractual obligations with licensees, companies can meet the Act’s requirements and avoid costly penalties. Integrating these transparency measures not only ensures legal compliance but also builds consumer trust in AI-generated content. Staying informed about evolving regulations and leveraging tools like Pandectes can help businesses maintain a robust AI transparency and privacy strategy.