California's AI provenance law binds 1M-user providers
SB 942 became operative on 2 August, forcing large generative-AI providers to embed provenance data and publish a free detection tool.
A second deadline, deliberately synchronised
California's AI Transparency Act took effect on 2 August 2026, the same day the European Union's Article 50 transparency duties became applicable — an alignment written into the statute on purpose.
The law, passed as SB 942 in 2024 and substantially rewritten by AB 853 before Governor Gavin Newsom signed it on 13 October 2025, applies to providers of generative AI systems with more than one million monthly visitors or users in California. That threshold captures essentially every consumer-facing frontier model vendor operating in the state.
Covered providers must embed latent provenance data into the image, video and audio content their systems generate — information identifying the content's origin and modification history — and must make available, at no cost, a publicly accessible detection tool that reads any provenance data present in a piece of content and reports what it finds. Providers must also offer users the option of a visible, manifest disclosure.
Enforcement runs through civil actions rather than a regulator's licence power, with penalties of $5,000 per violation per day. For a service updated continuously at scale, that structure makes sustained non-compliance expensive quickly.
What comes next
AB 853 did more than move the date. It extended the Act's architecture beyond model providers to large online platforms, generative-AI system hosting platforms and capture device manufacturers, phasing those duties in later — the hosting-platform obligation begins 1 January 2027. The clear direction is to push provenance metadata along the whole chain, from the camera that records an image to the platform that distributes it, rather than resting the entire burden on the model that generated it.
Why it matters
With no federal provenance standard in place — the White House missed its own 1 August deadline under Executive Order 14409 for publishing frontier-model benchmarking and disclosure frameworks — California is again setting the de facto US rule for how generative media must be labelled. Combined with the EU obligations that landed the same day, the two largest regulated markets for consumer AI now require the same underlying plumbing: cryptographic or metadata provenance embedded at generation time, plus a public way to check it. That is a hard engineering requirement, not a policy statement, and it applies to models served worldwide.