California's AI Transparency Act: What Businesses Using GenAI Need to Know Now
California's AI Transparency Act, codified at Cal. Bus. & Prof. Code §§ 22757 through 22757.6, is now the law of the land for large generative AI providers doing business in California. The chapter became operative on August 2, 2026, meaning the compliance clock isn't just running, it's already started.
If your company builds, licenses, or deploys a generative AI tool with meaningful reach in California, here's what the statute actually requires — in its own words.
Who Is a "Covered Provider"?
The Act doesn't apply to every AI company. It targets scale. A covered provider is defined as a person that creates, codes, or otherwise produces a generative AI ("GenAI") system with over one million monthly visitors or users that is publicly accessible in California.
The Act defines "artificial intelligence" broadly, as an engineered or machine-based system, varying in autonomy, that infers from input how to generate outputs affecting physical or virtual environments. A GenAI system is narrower still — one capable of generating synthetic image, video, audio, or text content that emulates its training data.
Three Core Obligations
1. A Free, Public AI Detection Tool
Under § 22757.2, a covered provider must offer, at no cost, a tool letting anyone check whether image, video, or audio content was created or altered by the provider's GenAI system. The tool must:
Surface any system provenance data detected in the content, while never outputting personal provenance data;
Remain publicly accessible, though reasonable access limits are allowed to guard against demonstrable risks to system security or integrity;
Support both file upload/URL submission and an API "so a user can invoke the tool without visiting the provider's website; and
Come with strict data-minimization rules — providers generally cannot collect or retain personal information from tool users, aside from opt-in feedback contacts, and may not retain submitted content longer than necessary to run the check.
2. Manifest Disclosure — Optional, User-Facing
Under § 22757.3(a), providers must give users the option to add a "manifest disclosure" — one that is clear, conspicuous, appropriate for the medium, and understandable to a reasonable person, and, so far as technically feasible, permanent and hard to strip out.
3. Latent Disclosure — Mandatory, Machine-Readable
This is the Act's real engine. Under § 22757.3(b), providers must embed a "latent disclosure" — invisible metadata rather than an on-screen watermark — in AI-generated image, video, or audio content. To the extent technically feasible, it must convey the provider's name, the GenAI system's name and version, the date/time of creation, and a unique identifier, and it must be detectable by the provider's own AI detection tool and consistent with widely accepted industry standards — think C2PA-style content credentials.
Licensing flows through. If a covered provider licenses its GenAI system to a third party, it must contractually require the licensee to preserve the system's latent-disclosure capability. If the provider learns a licensee stripped that capability, it must revoke the license within 96 hours — and the licensee must stop using the system once revoked.
What's Exempt
The Act carves out products, services, websites, or apps that provide exclusively non-user-generated video game, television, streaming, movie, or interactive experiences. Studio-produced VFX and CGI content, in other words, sits outside the statute — user-facing generative tools do not.
Enforcement Has Teeth
Under § 22757.4, a violator faces a civil penalty of $5,000 per violation, recoverable in an action brought by the Attorney General, a city attorney, or county counsel. There's no private right of action, but the exposure compounds fast: each day a covered provider, large online platform, or capture device manufacturer remains in violation is a discrete, separately penalized violation. A prevailing plaintiff also recovers reasonable attorney's costs and fees. Licensees who strip disclosure capability face their own exposure to an injunctive-relief action under § 22757.4(c).
Practical Takeaways
Scope check first. If your GenAI tool doesn't clear one million monthly California users/visitors, the Act's core mandates don't apply to you directly — but downstream licensing obligations can still reach you as a licensee.
Build (or buy) latent disclosure now. This is the mandatory, non-optional piece. Content-credential standards like C2PA are the practical path to satisfying the "detectable" and "industry standard" requirements.
Audit your licensing agreements. If you license a GenAI engine from a covered provider, your contract likely already requires you to preserve disclosure metadata — removing or disabling it is a contract breach and a statutory trigger.
Get the detection tool live. Since it's a per-day violation standard, a delayed launch of the required free detection tool is a recurring — not one-time — liability.
Watch the AG's office. With no private right of action, enforcement risk centers on the Attorney General and local prosecutors, which typically means enforcement follows visible, high-profile noncompliance first.
This article is provided for general informational purposes and does not constitute legal advice. Businesses evaluating compliance obligations under the California AI Transparency Act should consult counsel regarding their specific products and licensing arrangements.