California SB 942: the AI Transparency Act, section by section

California's AI Transparency Act requires a covered provider — a generative AI system with over 1,000,000 monthly users, publicly accessible in California — to embed a latent disclosure in the image, video and audio its system produces, to offer a free public AI detection tool, and to contract its licensees into keeping the disclosure intact. It has been operative since 2 August 2026, and each day of violation is a separate $5,000 penalty.

The Act is California Business and Professions Code, Chapter 25 (commencing with Section 22757), enacted by SB 942 and amended by AB 853. Unlike EU AI Act Article 50, SB 942 is specific about what the mark has to say.

§ 22757.1 defines a covered provider as a person that creates, codes or otherwise produces a generative artificial intelligence system that has over 1,000,000 monthly users and is publicly accessible within the geographic boundaries of California.

Three things follow, and each catches somebody out:

• The threshold is users, not revenue or headcount. A small team with a popular product is covered; a large company with a niche one is not.
• It is not a California-company test. Public accessibility within California is what matters, so a provider anywhere in the world can be covered.
• 1,000,000 is the provider threshold. The 2,000,000 figure people often quote belongs to AB 853's separate large online platform duties, below.

§ 22757.3 requires a latent disclosure in image, video or audio content the system creates or alters. This is the part of the statute that decides whether a watermark is adequate, because a bare “this is AI” signal does not carry these fields.

The statute also requires the latent disclosure to be detectable by the provider's own detection tool, consistent with widely accepted industry standards, and permanent or extraordinarily difficult to remove, to the extent technically feasible.

The manifest disclosure

Separately, a covered provider must offer users the option of a manifest disclosure — a visible one — that identifies content as AI-generated. It must be clear, conspicuous, appropriate to the medium and understandable by a reasonable person. Note the asymmetry: the latent disclosure is mandatory, the manifest one is an option you must offer.

§ 22757.2 is the requirement most often missed, because it is not about the content at all — it is a product you must operate. A covered provider must make available an AI detection tool that:

• is available at no cost to the user;
• lets a user assess whether content was created or altered by the provider's system;
• outputs any system provenance data detected in the content;
• outputs no personal provenance data;
• is publicly accessible, and accepts both an upload and a URL;
• supports an API, so a user can invoke it without visiting the provider's website;
• collects user feedback on its performance.

There is a privacy limit attached: the provider may collect only the personal information necessary to comply, and must retain it no longer than needed. A detector that logs everything submitted to it is its own compliance problem.

Under § 22757.3(c)–(d), a covered provider that licenses its system to a third party must require by contract that the licensee maintain the system's ability to include the latent disclosure.

If the provider knows a licensee has modified the system so that it no longer includes the disclosure, the provider must revoke the licence within 96 hours of discovery, and the licensee must stop using the system once revoked.

In practice this is an operational duty, not a legal one: it means knowing which licensees are emitting compliant marks, and being able to act inside four days. Most providers discover they have no mechanism for either.

AB 853 moved the provider duties to 2 August 2026 and extended the Act to three new parties. If you are not a covered provider, you may still be one of these.

The platform duty is worth reading carefully: it is a multi-standard detection obligation, not a single-vendor one. A platform has to read provenance that complies with widely adopted standards — C2PA first — and a watermark is the layer that survives when a manifest has been stripped.

1. 19 September 2024SB 942 signed and chaptered. Source
2. October 2025AB 853 signed. Provider duties moved from 1 January 2026 to 2 August 2026; platform, hosting and device duties added. Source
3. 2 August 2026Covered-provider duties operative: detection tool, latent and manifest disclosure, licensee contracts.
4. 1 January 2027Large online platform and GenAI hosting platform duties operative.
5. 1 January 2028Capture device manufacturer duties operative.

Under § 22757.4, a covered provider that violates the chapter is liable for a civil penalty of $5,000 per violation, and each day a violation continues is a discrete violation. Actions may be brought by the Attorney General, a county counsel or a city attorney.

That daily multiplier is the part worth internalising. This is not a one-off fine — an unresolved gap accrues. A licensee's violation is treated separately from the provider's own duties.

These two are routinely conflated, and the difference decides what your watermark has to carry.

A system built only for Article 50 — a bare “AI-generated” signal — does not satisfy SB 942, because it cannot name the provider or the version. A system built for SB 942 generally does satisfy Article 50(2). See our Article 50 page for the other side.

One more commonly-confused neighbour: AB 2013 is the training-data documentation law. Different subject, frequently searched alongside SB 942.

SB 942 is the regime where Verda's payload design matters most, because the statute enumerates fields rather than leaving them open.

On the AB 853 platform side, the requirement is to read provenance across widely adopted standards. Verda writes signed C2PA manifests as well as the watermark, and is registered on the C2PA soft-binding algorithm list for image, audio and video.

Is SB 942 in force?

Yes. Covered-provider duties have been operative since 2 August 2026. AB 853 moved that date from 1 January 2026; the platform and hosting duties follow on 1 January 2027 and capture devices on 1 January 2028.

What counts as a covered provider?

A generative AI system with over 1,000,000 monthly users that is publicly accessible in California. The threshold is user count, not company size, and the provider does not have to be a California company.

Is a watermark enough on its own?

Only if it carries the four fields. A watermark that signals “AI-generated” and nothing more does not meet § 22757.3, because it cannot convey the provider, the system and version, the timestamp or a unique identifier. The detection tool in § 22757.2 is a separate duty again.

Do I have to build my own detector?

The statute requires the covered provider to make one available. It does not require the provider to have built it, which is why a white-labelled detector on the provider's own domain is a common arrangement.

What is the penalty?

$5,000 per violation, with each day of continuing violation counted as a discrete violation. Enforcement sits with the Attorney General, a county counsel or a city attorney.

• EU AI Act Article 50: watermarking and transparency obligations
• How Verda's imperceptible watermarking works
• About Verda