California's AI Transparency Act became operative on August 2, 2026. It is codified at Business and Professions Code sections 22757 through 22757.6, was enacted by SB 942 in 2024, and was substantially amended by AB 853 in 2025 which both pushed the operative date from January 1, 2026 to August 2, 2026 and added entirely new categories of regulated businesses.

The Act is narrow in who it directly regulates and broad in who it affects. Most California businesses are not covered providers. But if your company publishes AI-generated images, video, or audio (or licenses a generative AI system from a vendor) this statute now shapes what your vendor owes you, what your contracts should say, and what provenance data must survive your publishing pipeline. (For the broader California AI regulatory picture, see our California AI compliance guide.)

Who Is Actually Covered

The Act reaches four distinct categories, each with its own obligations and its own start date.

Covered providers. A “covered provider” is a person that creates, codes, or otherwise produces a generative AI system that has over 1,000,000 monthly visitors or users and is publicly accessible within California. (Bus. & Prof. Code, § 22757.1, subd. (d).) This is the threshold that excludes the overwhelming majority of California businesses, including most companies that use generative AI heavily.

Large online platforms. A public-facing social media platform, file-sharing platform, mass messaging platform, or stand-alone search engine that distributes content users did not create, exceeding 2,000,000 unique monthly users in the preceding 12 months. Broadband internet access services and telecommunications services are expressly excluded. (§ 22757.1, subd. (h).)

GenAI hosting platforms. A website or application that makes model weights or source code available for download to a California resident — with or without compensation. (§ 22757.1, subd. (g).)

Capture device manufacturers. Producers of cameras, phones with cameras or microphones, and voice recorders sold in California. (§ 22757.1, subds. (b), (c).)

What Covered Providers Must Do as of August 2, 2026

1. A free, public AI detection tool (§ 22757.2)

A covered provider must make available, at no cost, a tool that lets a user assess whether image, video, or audio content was created or altered by that provider's GenAI system. The statute is specific about the tool's design: it must output any system provenance data detected, must not output personal provenance data, must be publicly accessible (subject to reasonable limits to protect system security or integrity), must accept either an uploaded file or a URL, and must support an API so the tool can be invoked without visiting the provider's website.

2. Two kinds of disclosure and only one is optional (§ 22757.3)

This distinction is the one most commonly misstated, and it matters.

A manifest disclosure (one a person can actually perceive) must be offered to the user as an option. When applied, it must identify the content as AI-generated, be clear, conspicuous, appropriate to the medium, and understandable to a reasonable person, and be permanent or extraordinarily difficult to remove where technically feasible. The user chooses whether to use it; the provider has no choice about offering it.

A latent disclosure (present but not manifest, carried in the content's metadata) is mandatory. The provider must include it in AI-generated image, video, and audio content its system creates. To the extent technically feasible and reasonable, it must convey the provider's name, the name and version number of the GenAI system, the time and date of creation or alteration, and a unique identifier. It must be detectable by the provider's own detection tool, consistent with widely accepted industry standards, and permanent or extraordinarily difficult to remove.

3. The licensing provision with a 96-hour clock (§ 22757.3, subd. (c))

If a covered provider licenses its GenAI system to a third party, it must require by contract that the licensee preserve the system's latent-disclosure capability. If the provider then learns that a licensee has modified the system so it can no longer apply those disclosures, the provider must revoke the license within 96 hours. The licensee, in turn, must stop using the system once the license is revoked.

For licensees, that is a real operational risk: fine-tuning or modifying a licensed model in a way that strips provenance metadata can terminate your right to use it on four days' notice.

What Starts Later: The Phased Obligations

AB 853 layered in two future compliance waves that businesses should calendar now.

January 1, 2027: large online platforms (§ 22757.3.1). Covered platforms must detect provenance data compliant with widely adopted standards, provide a user interface disclosing whether provenance data is available and what system or capture device created or substantially altered the content, and let users inspect that data through the interface, by downloading a version with the provenance data attached, or via a link.

January 1, 2027: GenAI hosting platforms (§ 22757.3.2). A hosting platform may not knowingly make available a GenAI system that fails to place the disclosures required by section 22757.3.

January 1, 2028: capture device manufacturers (§ 22757.3.3). For devices first produced for sale in California on or after that date, manufacturers must give users the option to include a latent disclosure identifying the manufacturer, the device name and version, and the time and date of capture.

Penalties and Who Enforces

The civil penalty is $5,000 per violation, and, critically, each day in violation is a discrete violation. (§ 22757.4, subds. (a)(1), (b).) A sustained compliance failure does not produce one $5,000 exposure; it produces $5,000 multiplied by the number of days.

Enforcement belongs to the Attorney General, a city attorney, or a county counsel. The statute does not create a private right of action for the disclosure obligations, and a prevailing plaintiff in such an action is entitled to reasonable attorney's fees and costs. Where a third-party licensee keeps using a revoked system, those same public enforcers may seek injunctive relief plus fees and costs. (§ 22757.4, subd. (c).)

One Notable Exemption

The chapter does not apply to any product, service, website, or application providing exclusively non-user-generated video game, television, streaming, movie, or interactive experiences. (§ 22757.5.) Studio-produced entertainment content sits outside the Act; the moment users generate content in your product, the analysis changes.

If You Are Not a Covered Provider (Which You Probably Are Not)

The practical question for most California businesses is not “do we comply?” but “what do we now demand from the vendors we buy AI from, and what breaks in our own pipeline?” Four concrete steps:

• Confirm your status in writing. If any AI feature you offer publicly could approach 1,000,000 monthly users, get a documented analysis rather than an assumption.
• Push the obligation to the vendor in your contract. Allocate expressly who bears the detection-tool and disclosure duties, and require the vendor to represent that its system applies compliant latent disclosures.
• Do not strip provenance metadata. Many content pipelines  (image compressors, CMS uploads, social schedulers) discard metadata by default. If you are a licensee, removing latent disclosures can trigger the 96-hour revocation provision against you.
• Watch the license-revocation clause. Ask what notice you would receive and what continuity you would have if your provider concluded it had to revoke.

Businesses already thinking about AI risk should also review our AI liability FAQ, our research on employees putting company data into personal AI accounts, and our guide to AI conversations as court evidence.

Frequently Asked Questions

Q: When did the California AI Transparency Act take effect?
A: The chapter became operative August 2, 2026. (§ 22757.6.) SB 942 was enacted in 2024 with a January 1, 2026 date; AB 853 moved it to August 2, 2026.

Q: Does it apply to my business if we just use ChatGPT or similar tools?
A: Almost certainly not directly. The covered-provider obligations attach to the company that produces the GenAI system at over 1,000,000 monthly users; not to ordinary business users. Your exposure is contractual and operational rather than statutory.

Q: Is there a private right of action?
A: No. Enforcement of the disclosure obligations is by the Attorney General, a city attorney, or a county counsel. (§ 22757.4.)

Q: How large can the penalties get?
A: $5,000 per violation, with each day of violation treated as a separate violation, so exposure scales with the duration of noncompliance, not just the fact of it.

Q: Does the Act require watermarking every AI output?
A: Not in the colloquial sense. Visible (manifest) disclosure must be offered to users as an option; the metadata-level (latent) disclosure is what covered providers must actually apply to image, video, and audio content.

Q: What about AI-generated text?
A: The detection-tool and disclosure obligations in sections 22757.2 and 22757.3 are framed around image, video, and audio content.

Talk to a California Business Litigation Attorney

If you are negotiating an AI vendor agreement, assessing whether a product crosses the covered-provider threshold, or facing a dispute over AI-generated content, Kolmogorov Law, P.C. advises California businesses on commercial disputes and technology-related risk. Call (909) 235-6116 or contact us to schedule a consultation.

This article is provided for general informational purposes and is not legal advice. Statutory citations are to the California Business and Professions Code as of August 2026; confirm current text before relying on it.