California's AI Transparency Act: latent disclosures, the required verification tool and the dates
The California AI Transparency Act has been operative since August 2, 2026. As amended on September 30, 2026, it tells providers of generative AI systems to embed a hidden (latent) disclosure in image, video and audio output, where technically feasible, and to offer a free verification tool. Platforms follow in 2027 and camera makers in 2028.
What does the Act require of AI providers?
SB 942 created the Act and was approved on September 19, 2024. AB 853, approved on October 13, 2025, moved the start to August 2, 2026 and added duties for platforms and camera makers.
On September 30, 2026 the Governor approved SB 1000, an urgency bill that took effect at once, and AB 2713. A law-firm summary dated August 3, 2026 called both still under consideration.
As amended, a "covered provider" is a person that makes a generative AI system that is publicly accessible in California. SB 1000 deleted the earlier threshold of over 1,000,000 monthly visitors or users.
What is a latent disclosure?
AB 853's text defines "latent" as present but not manifest; SB 1000's rewritten definitions section no longer lists the word. Under SB 1000, a covered provider must, to the extent technically feasible, include one in any image, video or audio content its system creates or alters. Content altered only by "minor modification", such as resizing, cropping or format conversion, is outside the duty.
The disclosure must convey, directly or through a link to a permanent website, the provider's name, the system's name and version, the time and date of creation or alteration, a unique identifier, and whether the system created or altered the content. It must be "permanent or extraordinarily difficult to remove or tamper with", work with the provider's own verification tool, and comply with or be interoperable with widely recognized industry standards. None of the four bill texts names C2PA, Content Credentials or any other format.
What must the free verification tool do?
SB 942 called it an AI detection tool. SB 1000 renamed it a disclosure verification tool. It must be free and publicly accessible, with room for security limits. It must accept an uploaded file or a URL and support use through an application programming interface. It must let a user assess whether that provider's system created or altered the content and output any system provenance data it finds, but no personal information unless the person concerned expressly consents. A provider may instead point users to a compliant third-party tool.
The tool answers only for that provider's system. Our checker is not such a tool. It reads files from any source and cannot say whether a provider meets the Act.
Is a visible label still required?
No. SB 942 required providers to offer users the option to add a visible (manifest) disclosure. SB 1000 deleted that requirement.
What are the dates?
| Date | What happens |
|---|---|
| August 2, 2026 | The Act becomes operative (AB 853 set the date). Covered providers owe the latent disclosure and a detection tool, later renamed the verification tool. |
| September 30, 2026 | SB 1000 takes effect immediately. AB 2713 is approved and revises the platform section. |
| January 1, 2027 | Large online platforms must detect and display provenance data. GenAI hosting platforms may not knowingly make available a system that does not place the disclosures. |
| January 1, 2028 | Capture device manufacturers' duties begin, for devices first produced for sale in California on or after that date. |
| January 1, 2029 | Systems designed mainly as assistive technology, exempt before this date, come under the Act (SB 1000). |
What do platforms and camera makers have to do?
A "large online platform" is a public-facing social media, file-sharing, mass messaging or stand-alone search service with over 2,000,000 unique monthly users in the preceding 12 months. From January 1, 2027, AB 2713 says it must detect whether provenance data is attached to content, show an interface that reliably indicates whether the data identifies the content as made or substantially altered by a generative AI system or captured by a capture device, and let users inspect the data. Where technically feasible, it must not knowingly strip system provenance data or digital signatures.
Summaries differ on capture devices, so we read the text. Section 22757.3.3 says a manufacturer must give users the option to include a latent disclosure and must embed one by default, both only as far as technically feasible and compliant with widely adopted specifications.
Who enforces it, and what are the penalties?
The Attorney General, a city attorney or a county counsel can bring a civil action. The penalty is $5,000 per violation, each day is a separate violation, and a prevailing plaintiff recovers reasonable attorney's costs and fees. The law-firm summary reports there is no private right of action.
What did we measure in real files?
The Act asks providers for a machine-readable disclosure in their output. On October 30, 2026 we ran 32 real files through our checker. Of these, 31 were filed or labeled as made with AI tools: 29 from Wikimedia Commons categories named "Images generated by", and two vendor samples. The 32nd is a C2PA test image.
Among the 31 files:
- 8 carry a signed Content Credentials record. One reads as trusted on the current C2PA Trust List, a ChatGPT file signed "OpenAI OpCo, LLC". Five match only the older Interim Trust List (three Adobe Firefly, two Microsoft Image Creator). Two read "signer trust not established": older ChatGPT files with expired certificates.
- 1 carries an unsigned metadata declaration.
- 22 carry neither. One of them names a tool in its metadata.
We do not know when those files were made, and the Act applies only from August 2, 2026. We cannot know how each file was handled before upload, so we draw no conclusion about the Act or any provider. The counts and method are on our accuracy page.
What this means when you check an image
Open the checker and choose the file. If it carries a signed record from a signer on the current C2PA Trust List and the record declares AI use, you see "Trusted Content Credentials declare AI use". That tells you what the signed record says and that the signer is on a list we load, not that the claim is true.
If the record's signer is on no list we load, you see "Content Credentials found; signer trust not established". A signed record is there, but no list we load vouches for the signer's name, so the name is not verified.
If we find nothing, you see "No supported provenance signals found". The line under it says this does not mean the image is real or human-made. Nothing found is not a finding that a provider broke the Act: files lose these signals when shared or re-saved, and we do not read every maker's hidden mark. The limits line applies: "These checks cannot determine whether an image is AI-generated."
Guides on this topic
- Visible AI watermarks is the main page on this topic.
- EU AI Act Article 50 covers the European marking duty.
- China's AI content labeling measures covers China's rules.
- Can AI watermarks be removed? covers what survives edits.
- Platform labels compared shows who labels AI images.
Frequently asked questions
- Does the Act require a visible watermark on AI images?
- Not in the amended text. SB 1000 deleted the requirement that providers offer an optional visible disclosure. The duty on providers is the latent disclosure, where technically feasible, and the verification tool.
- Does an image with no hidden disclosure show a provider broke the law?
- No. The duty covers a provider's own output, with exceptions, and signals can be lost after a file leaves the provider. We cannot tell which case a file is.
- Does the Act put a duty on people who post images?
- The duties we read fall on providers, licensees, large platforms, hosting platforms and capture device makers, not on a person who posts an image.