California SB 942: the AI Transparency Act, in force
On 2 August 2026, two AI-transparency regimes became enforceable on the same day. In the EU, Article 50 of the AI Act (Regulation (EU) 2024/1689) began to apply. In California, SB 942 — the California AI Transparency Act, as amended by AB 853, signed on 13 October 2025 — became operative. The shared date is not cosmetic: both laws lean on the same technical mechanism, provenance data embedded inside AI-generated media. Their scope, however, could hardly differ more. This page sets out who the Act binds, the three duties it imposes, the phased dates through 2028, and what its arrival changes for everyone who is not a covered provider.
Who SB 942 covers — and who it doesn't
SB 942 places its duties on a covered provider: a person who creates, codes, or otherwise produces a generative-AI system that has more than 1,000,000 monthly visitors or users and is publicly accessible in California. That is a deliberately narrow gate. It reaches the large image, video, and audio generators, and it does not reach the businesses that use those tools.
If you run an ordinary company website, an online shop, or a publication, SB 942 imposes no duty on you: you do not have to mark the AI images you publish, and nothing in this Act changed for you on 2 August 2026. That is the most important thing to understand about the law — and where the practical story starts, because the provenance data covered providers must now embed either survives to your published pages or it doesn't.
The three duties on covered providers
Latent disclosure. AI-generated image, video, and audio must carry an embedded, machine-readable disclosure — conveying, among other things, the name and version of the system and when the content was created or altered — designed to be permanent or extraordinarily difficult to remove, to the extent technically feasible. “Latent” means invisible to the eye and readable by software: in practice, the same territory as C2PA Content Credentials and IPTC provenance metadata.
Manifest disclosure option. Providers must offer users the option to include a visible disclosure identifying content as AI-generated — a label in the content itself, chosen by the user rather than imposed on every output.
A free public AI detection tool. Each covered provider must operate a tool that lets anyone assess whether a piece of image, video, or audio content was created or altered by that provider's system — accepting uploads and URLs, with API access. Note what this is: verification against the provider's own embedded marks, not statistical guessing about arbitrary content.
What is not covered: text. SB 942's marking duties apply to image, video, and audio; text-only output is outside the Act. The EU reaches further here — Article 50(4) covers certain AI-generated text published to inform the public on matters of public interest.
The dates, in order
| Date | What happens |
|---|---|
| 13 October 2025 | AB 853 is signed: it amends SB 942, narrows and phases the duties, and resets the operative date to 2 August 2026. |
| 2 August 2026 | The covered-provider duties become operative: latent disclosure, the manifest-disclosure option, and the free detection tool. The same day, EU Article 50 begins to apply. |
| 2 December 2026 | Nothing changes under SB 942. In the EU, the one narrow deferral ends: Article 50(2) machine-readable marking becomes due for generative systems placed on the market before 2 August 2026. |
| 1 January 2027 | Duties for large online platforms and generative-AI hosting platforms begin, including detecting embedded provenance data in distributed content. |
| 1 January 2028 | Capture-device manufacturer duties apply to devices first produced for sale in California on or after this date, such as offering latent disclosures in captured content. |
The 2027–2028 rows bind platforms and device makers, not website owners.
Penalties and enforcement
A violation carries a civil penalty of $5,000, and each day a violation continues counts as a discrete violation. Enforcement sits with the California Attorney General and certain other public attorneys; there is no private right of action, so the Act is not enforced through consumer lawsuits. For comparison: breaches of EU Article 50 carry fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs and startups, whichever is lower (Art. 99(6)). Both frameworks state ceilings, not automatic fines.
SB 942 and EU Article 50: the same mechanics, a different reach
Read side by side, SB 942's latent disclosure and Article 50(2)'s machine-readable marking are the same engineering assignment: put provenance inside the file, in a form software can verify — C2PA Content Credentials, IPTC metadata.
The difference is who must act. SB 942 stops at the large provider. Article 50 also reaches deployers: the chatbot-disclosure duty of Article 50(1) and the deepfake and text labeling of Article 50(4) fall on the businesses using AI, and the territorial trigger is output used in the Union, wherever the operator sits. Those duties have applied since 2 August 2026 with no general grace period — the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026) delayed parts of the high-risk regime and left Article 50 untouched.
SB 942's covered-provider set is, in practice, the short list of tools whose provenance behaviour we document in our AI generator guides — which systems embed C2PA, and which export paths strip it.
What this means if you run a website
The duty is the provider's; the artifacts land on your pages. From 2 August 2026, media made with a covered tool leaves the generator carrying embedded provenance. Whether it still carries it on your site depends on your pipeline — image CDNs and optimisers routinely strip metadata in transit. The checkable question for an ordinary publisher is therefore not “am I violating SB 942?” (you are not its addressee) but “does the media I publish still carry its provenance data?” Under EU law, that same question decides whether machine-readable marking actually reaches your visitors.
This is what DisclosureProof samples from the outside: it reads the C2PA and IPTC data of published media the way any verifier — or any SB 942 detection tool — would, and records each finding as detected, not detected, or FLAGGED. A “not detected” finding is not a violation verdict; it is a documented observation of what a first-time visitor's browser received on a given day. The report seals screenshots and a hash manifest whose integrity anyone can check independently at /verify/; its authenticity (the HMAC seal) is a separate property that only we can confirm, and the report keeps the two distinct. And it never certifies compliance with SB 942, the AI Act, or anything else — a scan documents what was visible, which is a different thing (why we never say “compliant”).
One limit stated plainly: no external scanner can tell whether a file is truly AI-generated. What can be verified from outside is what the file carries and what the page discloses. Both SB 942's detection-tool model and EU Article 50 build on exactly that — embedded provenance and the publisher's own declaration, not statistical guessing.
Common questions
Does SB 942 apply to my company's website?
Not unless you are a covered provider — the creator of a generative-AI system with more than 1,000,000 monthly visitors or users that is publicly accessible in California. A business that merely uses AI tools to make images or copy has no duties under SB 942. The practical question for everyone else is different: whether the provenance data a covered tool embeds still survives in the media you publish.
When did the California AI Transparency Act take effect?
The provider duties became operative on 2 August 2026, after AB 853 (signed 13 October 2025) amended SB 942 and reset its operative date — the same day EU AI Act Article 50 began to apply. Duties for large online platforms and generative-AI hosting platforms start on 1 January 2027, and capture-device manufacturer duties apply to devices first produced for sale in California on or after 1 January 2028.
Does SB 942 cover AI-generated text?
No. SB 942's disclosure duties cover AI-generated image, video, and audio; text-only output is not covered. The EU takes a different line: Article 50(4) of the AI Act reaches certain AI-generated text published to inform the public on matters of public interest — established there through the publisher's own declaration, not through statistical detection.
What are the penalties under SB 942?
A civil penalty of $5,000 per violation, with each day a violation continues counting as a discrete violation. Enforcement rests with the California Attorney General and certain other public attorneys; there is no private right of action. For comparison, breaches of EU Article 50 carry fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher — for SMEs and startups, whichever is lower.
How does SB 942 relate to EU AI Act Article 50?
Both became applicable on 2 August 2026 and both rely on machine-readable provenance embedded in AI-generated media — in practice C2PA Content Credentials and IPTC metadata. The scope differs: SB 942 binds only large generative-AI providers, while Article 50 also reaches deployers, including websites whose chatbot or published AI content is used in the EU. The only EU deferral is Article 50(2) marking for generative systems placed on the market before 2 August 2026, which applies from 2 December 2026.
Sources
- AB 853, California AI Transparency Act — bill text (California Legislative Information; the amended statute as chaptered)
- Morgan Lewis: New California AI Disclosure Rules Become Operative (August 2026 summary of the operative duties and phases)
- Troutman: California AI Transparency Act Amendments Signed Into Law (October 2025, on the AB 853 changes)
- EU AI Act, Article 50 — full statute text — or our plain-English walkthrough, Article 50 explained
This page summarises the rules for orientation. It is not legal advice; the statute texts linked above are the authority. Where your situation is non-obvious, it belongs with qualified counsel.
What do your pages actually serve?
The scan visits your homepage like a first-time visitor, opens the chat widget, asks the control question, reads the metadata of a sample of published media, and seals the evidence — screenshots, timestamps, hash manifest. Free, no registration. The report is in English.
Run the free scan