California AI Transparency Act (SB 942): 2026 Compliance Guide for Businesses
California's SB 942 forces large generative-AI providers to watermark their output and ship a free AI-detection tool. If you build or license a high-volume AI system reachable in California, here's what 2026 compliance actually looks like.
What SB 942 Actually Regulates
The California AI Transparency Act targets a specific problem: people can no longer tell whether an image, video, or audio clip was made by a human or a machine. Rather than banning generative AI, the law makes provenance traceable. It does this through two kinds of disclosure that covered providers must build into their systems:
- Latent disclosure — a hidden, machine-readable signal embedded in AI-generated content that identifies the provider, that the content is AI-generated, and ideally when and which system made it
- Manifest disclosure — a visible, user-facing label that the content was AI-generated, which covered providers must offer users the option to apply
On top of the disclosures, covered providers must make a free, public AI-detection tool available so anyone can check whether content carries the provider's latent signal. The combination is meant to let platforms, journalists, and the public verify AI provenance at scale.
Are You a "Covered Provider"?
The law's reach is defined by the user threshold, not your headquarters. You're a covered provider if you create, code, or produce a generative AI system that exceeds one million monthly users and is publicly accessible in California.
- •You operate a generative AI product with 1M+ monthly users
- •Your system is publicly accessible to Californians
- •You produce AI images, audio, or video at scale
- •You build the generative system yourself
- •You license a covered provider's AI system
- •You embed it in your own product or workflow
- •You must keep the latent disclosure intact
- •Your license can be revoked if you strip it
Most SMBs fall below the one-million-user threshold and are not covered providers. But if you license a covered provider's model and your product strips out the latent disclosure — even unintentionally through re-encoding or compression — you can trigger the provider's duty to revoke your license. That makes provenance preservation a real engineering requirement, not just a legal footnote.
The SB 942 Compliance Checklist
Here's the practical breakdown, split by whether you're the covered provider or a business that licenses one.
If You're a Covered Provider
- ☐Embed a latent, machine-readable disclosure in all AI output
- ☐Offer users an option to add a visible manifest disclosure
- ☐Build and publish a free AI-detection tool
- ☐Let the detection tool accept uploads and links
- ☐Provide a way for users to assess content provenance
- ☐Bind licensees to keep disclosures via contract
- ☐Revoke licenses from those who remove disclosures
If You License a Covered AI System
- ☐Confirm your pipeline preserves the latent disclosure
- ☐Avoid re-encoding steps that strip provenance signals
- ☐Pass through manifest-disclosure options to users
- ☐Read your AI vendor's terms for disclosure duties
- ☐Document that you don't remove AI watermarks
- ☐Monitor for compression that degrades the signal
How SB 942 Fits the Broader Disclosure Wave
SB 942 doesn't exist in isolation. The EU AI Act requires AI-generated content (including deepfakes) to be labeled, and a growing set of US states are passing their own deepfake and AI-disclosure rules. The common thread is content provenance: regulators increasingly expect that AI-generated media carries a traceable signal. If you build for the California market, designing provenance in once tends to satisfy multiple regimes — which is why content-labeling is becoming table stakes rather than a California-only chore.
Penalties and Enforcement
Civil penalties run up to $5,000 per violation, and because each day of noncompliance can count separately, exposure compounds fast for a covered provider that ignores the requirements. Enforcement sits with the California Attorney General and other authorized public attorneys. For most businesses the realistic risk isn't a single fine but the operational cost of retrofitting provenance into a system that wasn't designed for it — far cheaper to build it in now.
Frequently Asked Questions
We're a small SaaS with an AI image feature. Are we covered?
Only if your generative AI system exceeds one million monthly users and is publicly accessible in California. Most SMBs fall below that threshold and aren't covered providers. But if you license a covered provider's model, make sure your pipeline doesn't strip the latent disclosure — that's where smaller businesses get pulled in.
Does SB 942 apply to text, or just images and audio/video?
The law centers on content where provenance is hardest to judge — image, audio, and video. The practical compliance focus for covered providers is embedding and detecting signals in that media. Always check the current text and regulations for the precise content scope before finalizing your implementation.
We're based outside California. Does the law reach us?
If your generative AI system is publicly accessible to people in California and clears the user threshold, your location doesn't exempt you. Like many California tech laws, the trigger is access by Californians, not where you're incorporated.
Isn't a watermark easy to remove? Why bother?
Latent disclosures are designed to be durable and machine-readable, and the law specifically targets the removal of them — covered providers must revoke licenses from parties who strip disclosures. Even if no method is perfect, shipping provenance is the compliance obligation; defeating it is what the statute penalizes.
Build Provenance In Before Enforcement Arrives
SB 942 turns AI content provenance from a nice-to-have into a legal requirement for large providers — and a contractual one for the businesses that license them. The expensive path is discovering you've been stripping a latent disclosure after a license revocation or an AG inquiry.
Confirm whether you're a covered provider or a licensee, audit your content pipeline for where provenance signals could be lost, and align your AI-disclosure approach with the EU AI Act and state deepfake laws while you're at it. One provenance program can clear several regimes at once.