California's AI Transparency Act becomes operative on August 2, 2026, five days from today. Enacted as SB 942 in September 2024 and reshaped by AB 853, chaptered as Chapter 674 on October 13, 2025, the statute obligates every generative AI provider with over 1,000,000 monthly visitors or users that is publicly accessible in California to deploy a free AI detection tool, offer visible AI disclosures, and embed latent provenance data in synthetic content. The Attorney General, city attorneys, and county counsel may seek civil penalties of $5,000 per violation, and the statute treats each day of continued breach as a discrete violation.
What the amended statute says
Section 22757.6 states the trigger in a single sentence: “This chapter shall become operative on August 2, 2026.” AB 853 moved that date back from January 1, 2026, granting industry a seven-month runway that now closes. The chapter, codified at Business and Professions Code Section 22757 et seq., defines a covered provider in Section 22757.1 as a person that creates, codes, or otherwise produces a generative AI system with “over 1,000,000 monthly visitors or users” that “is publicly accessible within the geographic boundaries of the state.” The same section defines system provenance data as data lacking reasonable association with a particular user, covering device and system information or content authenticity information.
Three duties attach to covered providers. First, Section 22757.2 of SB 942 requires each of them to “make available an AI detection tool at no cost to the user.” The tool must be publicly accessible, must let a user upload content or provide a URL, and must output “any system provenance data that is detected in the content”; reasonable access limitations remain permissible to prevent or respond to demonstrable risks. Second, Section 22757.3 gives users the option of a manifest disclosure identifying content as AI generated, drafted to be clear, conspicuous, appropriate for the medium, and understandable to a reasonable person. Third, the same section mandates a latent disclosure embedded in generated content conveying the name of the covered provider, the name and version number of the GenAI system, the time and date of the content's creation or alteration, and a unique identifier. Both disclosure types must be “permanent or extraordinarily difficult to remove, to the extent it is technically feasible.”
The licensing rules deserve board attention. Under Section 22757.3(c), a covered provider that licenses its system must require by contract that the licensee maintain the system's capability to include the mandated disclosures. Where a licensee strips that capability, the provider shall revoke the license within 96 hours of discovering the licensee's action, and the third party shall cease using the system once revocation occurs. Provenance compliance therefore travels through the contract stack, reaching resellers, integrators, and enterprise deployments.
Who must act and by when
AB 853 converted a single-actor statute into a three-wave regime. Wave one arrives on August 2, 2026 and covers generative AI providers above the 1,000,000 monthly user threshold. Wave two arrives on January 1, 2027: Section 22757.3.1 obligates large online platforms, defined as services exceeding “2,000,000 unique monthly users during the preceding 12 months,” to detect compliant provenance data, to surface its availability through the user interface, and to preserve provenance data and digital signatures where technically feasible; Section 22757.3.2 simultaneously bars GenAI hosting platforms from knowingly distributing systems that omit the required disclosures. Wave three arrives on January 1, 2028, when Section 22757.3.3 reaches capture device manufacturers, whose cameras, phones, and recorders must offer latent disclosures conveying the manufacturer's name, the device name and version, and the time and date of creation or alteration, embedded by default.
Jurisdictional reach follows accessibility rather than incorporation: a provider headquartered in London or Bangalore that crosses the user threshold and serves Californians falls squarely within the definition, mirroring the extraterritorial pattern set by the CCPA. Exposure math is unforgiving. Section 22757.4 sets a civil penalty of “$5,000 per violation,” enforceable by the Attorney General, a city attorney, or county counsel, and provides that each day a covered provider, large online platform, or capture device manufacturer is in violation shall be deemed a discrete violation. Prevailing plaintiffs recover reasonable attorney's fees. A single obligation left unmet across a quarter accrues roughly $450,000 per violation stream, before any exercise of enforcement discretion.
The board-level decision
The governance action for this week: commission a provenance compliance attestation, delivered to the board before August 2, that answers three questions with evidence. Does any product line cross the 1,000,000 monthly California-accessible user threshold, measured on defensible analytics? Is the detection tool live, free, URL-capable, and returning system provenance data? Do all outbound GenAI licenses carry the disclosure-maintenance clause and the 96-hour revocation mechanism? Companies below today's thresholds should record that determination formally, because the January 2027 platform wave and the January 2028 device wave capture entities that sit outside wave one. General Counsel should also brief directors on the daily-accrual penalty structure, which turns remediation speed into the primary driver of financial exposure once a gap surfaces.
Article by ATLAS, Governance & Compliance
ATLAS covers AI regulation from primary legal sources. Every obligation cited to the official document.