California AI Transparency Act
SB 942, as amended by AB 853, sets disclosure and detection duties for large generative AI providers. C2PA can supply the signed provenance record, but compliance also needs durable marking, detection, user experience, privacy, and operating controls.
Aug 2, 2026
Covered-provider duties became operative
>1M
Monthly visitors or users in the covered-provider definition
$5,000
Civil penalty per violation under the Act
Relationship map
The statute creates legal duties. C2PA supplies a machine-readable evidence layer inside the broader compliance program.
Timeline
Aug 2, 2026
Free provider detection, optional manifest disclosure, embedded latent disclosure, and related license controls apply under the Act.
Jan 1, 2027
Large online platforms must detect, disclose, expose, and preserve qualifying provenance data. GenAI hosting platforms face a disclosure gate.
Jan 1, 2028
Covered newly produced capture devices must offer, and default to, latent capture disclosures to the extent the statute specifies.
Scope
The statute assigns different duties to four groups. The thresholds and operative dates are part of the rule, not footnotes.
Current duties
The public tool must let a user assess whether covered media was created or altered by that provider's GenAI system and report detected system provenance data. Provider-specific detection is a separate control from general C2PA verification.
Users must be offered an option to include a manifest disclosure in covered media. This is the natural point for a structured C2PA claim that identifies AI generation and carries provenance fields.
AI-generated covered media must carry a latent disclosure detectable by the provider's tool and permanent or extraordinarily difficult to remove, within the statute's technical-feasibility terms. Ordinary embedded C2PA metadata can be stripped by some transformations, so a manifest alone should not be treated as the whole latent-marking control.
The provider must contractually require relevant licensees to preserve the required capability, revoke a license within the statutory period after discovering a disabling modification, and enforce the Act's stop-use consequence.
C2PA mapping
2027 platform duties
Detect provenance data that complies with widely adopted specifications from an established standards-setting body.
Show users when system provenance data reliably indicates GenAI generation, substantial alteration, or capture by a device.
Provide a way to inspect the provenance directly, download the content with its attached data, or follow a link to the record.
Do not knowingly strip qualifying system provenance data or digital signatures when preservation is technically feasible.
C2PA fits this architecture because it is an open specification from the Coalition for Content Provenance and Authenticity and supports interoperable discovery, validation, and display. The statute does not create a C2PA safe harbor and does not name a single approved standard.
Implementation
Classify each product against the statute's defined roles, user thresholds, media scope, exclusions, and operative dates.
Map every required disclosure field and detection outcome to a testable product requirement.
Sign supported outputs with a C2PA claim and the correct AI digital source type. Keep the credential verifiable outside your own service.
Pair the manifest with a latent marking method that meets the provider's durability and detectability obligations.
Build public detection, provenance display, download or link, privacy, feedback, and incident-recovery paths.
Test common edits, metadata stripping, social-platform processing, format conversion, false results, and missing credentials. Keep the evidence for counsel and audit review.
Sources
Statutory references: California Business and Professions Code sections 22757.1 through 22757.6. This summary reflects the enacted text available on August 3, 2026.
FAQ
The Act became operative on August 2, 2026. Duties added by AB 853 for large online platforms and generative AI hosting platforms become operative on January 1, 2027. Duties for covered capture devices begin on January 1, 2028.
A covered provider is a person that creates, codes, or otherwise produces a generative AI system with more than 1,000,000 monthly visitors or users that is publicly accessible within California. Other definitions and exclusions in the statute still matter to a specific product.
No. The statute does not name C2PA. Its platform provisions refer to system provenance data that follows widely adopted specifications from an established standards-setting body. C2PA is an open provenance standard that can support those duties, but each implementation must still satisfy the statute's technical and operational requirements.
No. A C2PA manifest can carry a signed provenance record, AI-generation information, ingredients, actions, timestamps, and an integrity binding. The Act also requires provider detection tools, latent disclosures that meet durability criteria, user interfaces, privacy safeguards, license controls, and later platform and device duties. Those controls sit around the C2PA evidence layer.
The covered-provider content duties in sections 22757.2 and 22757.3 are framed around image, video, audio, and combinations of those media. Teams handling text should assess other California, federal, sectoral, contractual, and foreign requirements separately.
Use C2PA to sign the record. Test the surrounding disclosure, detection, durability, and operating controls against the California Act with counsel.
See also: the separate guide to the EU AI Act and content provenance.