California SB 942 (AI Transparency Act) 2026

Who this law covers

This law applies to "covered providers." A covered provider is a company that creates and publicly offers a generative AI system with over 1 million monthly users that people in California can access. This is a high bar. It targets the largest AI companies that build systems like ChatGPT or similar platforms.

This law generally does not apply to small businesses, freelancers, or creators who use AI tools created by others. If you use ChatGPT to write content, or a design tool's AI features to make graphics, this law is generally understood not to apply to you. However, you should consult with a legal professional if you are unsure whether your specific situation qualifies as a covered provider.

The law also does not apply if your AI system has fewer than 1 million monthly users in California. It does not apply to private or internal AI systems. It only applies to systems that are publicly accessible.

What it actually requires

Covered providers must offer a free, publicly accessible AI detection tool. This tool must allow users to upload content and check whether that content was created or altered by the provider's AI system. The tool must include an API so developers can integrate it into their own software. Providers may collect contact information from users who voluntarily choose to share feedback, but only for the purpose of improving the tool.

Providers must give users the ability to add visible labels to AI-generated content. These labels must be permanent or extraordinarily difficult to remove to the extent that is technically feasible, and understandable to a reasonable person. For example, a label might say "Generated by [AI system name]" or similar wording.

Providers must also include hidden, machine-readable disclosures in AI-generated content. These disclosures must contain the provider's name, the system name and version number, the date and time the content was created, and a unique identifier. These hidden labels should be detectable by the provider's own AI detection tool.

If a provider licenses its AI system to third parties (like a company that builds a chatbot using another company's AI), the provider must require those third parties to maintain the disclosure capabilities in their contracts. Providers must also revoke licenses within 96 hours of discovering that a licensee has disabled these disclosure features.

Deadlines and penalties

The law was originally set to take effect on January 1, 2026, but the date was pushed back to August 2, 2026 to line up with the EU AI Act's timeline. Covered providers must be compliant by that date.

The penalty for violating this law is $5,000 per day of non-compliance. Each day of violation counts as a separate violation and adds to the total penalties owed.

Violations can be enforced through civil action by the California Attorney General, a city attorney, or a county counsel. Whoever brings the enforcement action can also recover attorney's fees and court costs if they win. Courts can also issue injunctions, meaning a judge can order a provider to immediately stop the violation.

What the law requires of providers

Under this law, covered providers are required to build or integrate a detection tool that can scan content and identify whether it was created by their system. The tool must be free and easy for the public to use, and published on the provider's website or made widely available.

For every piece of AI-generated content a system produces, the law requires two types of labels. First, a visible label that humans can see and understand at a glance. Second, hidden metadata embedded in the content that machines can detect. Both must clearly identify the provider's company and system.

When licensing systems to other companies, the law requires providers to include contractual terms that maintain these disclosure features. Providers should build in automated checks or monitoring to verify compliance and have a clear process to revoke licenses within 96 hours of discovering non-compliance.

Example visible label wording: "This image was generated by [Your AI System Name]." Or: "Content created by [Provider Name] AI System v2.1." Example metadata might include: provider name, system name and version, a creation timestamp, and a unique identifier. A provider's detection tool should be able to read this metadata.

Common misconceptions

Misconception: "This law applies to any business that uses AI." What the law actually says: The law only applies to companies that build and publicly offer AI systems with over 1 million users. If you run a small business and use ChatGPT to draft emails, this law generally does not apply to you.

Misconception: "I need to label every AI-generated image on my website." What the law actually says: This law only applies if you built the AI system that generated the image. If you used someone else's tool, that tool's provider is responsible for compliance, not you.

Misconception: "The penalty is $5,000 total." What the law actually says: The penalty is $5,000 per day of non-compliance. If a provider is out of compliance for 30 days, the penalties could add up to $150,000 or more, plus attorney's fees.

Misconception: "This law requires me to tell people whenever they interact with AI." What the law actually says: The law only requires disclosures for content that was actually created or altered by the provider's AI system. Not all interactions with AI systems require separate disclosure labels.

Frequently asked questions

Sources

• California SB 942