If your product generates images, video, or audio with AI, California's rulebook changed on August 2, 2026 — and the penalty meter runs at $5,000 per violation, per day. The California AI Transparency Act (SB 942) is now operative, after AB 853 pushed its original January 1, 2026 start date back to align with Europe's AI Act timeline. Much of the internet still cites the old date, which means plenty of founders believe they have time they no longer have.
Here's the part that should get your attention even if you're small: the headline obligations kick in at one million monthly users in California, but the law's phase-in schedule pulls hosting platforms, distribution channels, and even hardware into scope over the next two years. If you license a model, embed someone else's generation API, or plan to grow, this law shapes decisions you're making right now — including a few that belong in your books, not just your legal folder.
This guide walks through who is covered, what compliance actually requires, the deadlines still coming, and how to account for the whole thing so a regulator's letter never becomes a five-figure surprise.
Who Counts as a "Covered Provider"
SB 942 applies to providers of generative AI systems that are publicly accessible in California and have more than one million monthly visitors or users. Three details in that definition matter more than the big number:
The threshold is visitors or users
A free web demo that goes viral can cross one million monthly visitors long before you have one million registered accounts. If your image generator gets a burst of traffic from a social media moment, you may become a covered provider that month — with obligations that were supposed to be built into your product already. Waiting until you're "big enough to worry about it" is a plan that fails exactly when things go well.
Text is out; images, video, and audio are in
The Act's disclosure requirements target AI-generated image, video, and audio content. Purely textual output is not covered. If your product writes marketing copy, you're outside the core mandate; if it generates product photos, voiceovers, or clips, you're squarely inside it.
Games and streaming get a carve-out
Systems that are exclusively non-user-generated video game, television, streaming, movie, or interactive experiences are excluded. A game studio using AI to render in-engine content isn't a covered provider for that content — but the same studio's public avatar-generator tool could be.
The Three Core Obligations (Live Now)
For covered providers, three requirements became operative on August 2, 2026.
1. A free, public AI detection tool
You must offer a tool — at no cost to the user — that lets anyone check whether a piece of content was created or altered by your system. The statutory requirements are specific:
- It must accept uploaded content, URL submission, and API access
- It must output any system provenance data it detects
- It must not collect or retain personal information from users, except voluntary feedback with opt-in consent
- It must not retain submitted content longer than needed to run the check
- It needs a feedback mechanism so the tool improves over time
For a small team, the API requirement is the sleeper. A checkbox web form is a weekend project; a documented, rate-limited public API that third parties can hit is an ongoing service with hosting costs, abuse handling, and uptime expectations. Budget for it like a product surface, because legally, it is one.
2. An optional visible ("manifest") disclosure
Users must have the option to add a clear, conspicuous label identifying content as AI-generated. The label has to be permanent or extraordinarily difficult to remove, to the extent technically feasible. Note the design nuance: the visible label is the user's choice. You must offer it; you don't have to force it.
3. A mandatory hidden ("latent") disclosure
This is the watermarking mandate, and unlike the visible label, it is not optional. All covered AI-generated content must carry an embedded, machine-readable disclosure containing:
- The name and version of the generative AI system
- The date and time the content was created or altered
- A unique identifier for the content
The latent disclosure must be durable, consistent with widely accepted industry standards, and detectable by your own detection tool. In practice, "widely accepted industry standards" points at content-provenance specifications like C2PA — which most major model providers have already adopted. If you build on a foundation model API, much of the technical lift may already be done upstream; your job is to verify you're not stripping the metadata in your own pipeline (a resize, re-encode, or thumbnail step can silently destroy it).
The 96-Hour Rule: Licensing Just Got Teeth
If you license your generative AI system to third parties, SB 942 reaches into your contracts. You must require licensees to maintain the latent disclosure capability. If you discover a licensee has disabled it, you must revoke the license within 96 hours, and the licensee must stop using the system.
Two operational consequences follow:
- Your license agreements need an update. A revocation right tied to disclosure-tampering, exercisable on a 96-hour clock, has to exist in the paper before you need it. Retrofitting it into signed contracts means amendments, and amendments take longer than 96 hours.
- You need a way to "discover." The clock starts at discovery, but a provider with no monitoring at all is betting that regulators will accept willful blindness. A periodic sampling process — pull licensee output, run it through your own detection tool, log the result — is cheap insurance and creates the audit trail that shows good faith.
If you're on the other side of that table — a startup licensing someone else's model — read your agreement for the mirror-image clause. Disabling watermark output to make content "cleaner" is no longer a product decision; it's a contract breach with a statutory deadline attached.
The Deadlines Still Coming
AB 853 didn't just delay SB 942; it extended the law's reach in phases. Even if you're under the one-million threshold today, these dates may touch you:
January 1, 2027 — large online platforms and hosting services
Platforms exceeding two million unique monthly users — social media, file-sharing, mass messaging, and standalone search — must detect standards-compliant provenance data in distributed content and surface it to users through their interface. They also may not knowingly strip compliant provenance data or digital signatures from uploaded content, to the extent technically feasible.
Separately, platforms that host generative AI systems may not knowingly offer systems that fail the latent disclosure requirements. If you distribute a model or app through a marketplace, expect the marketplace to start asking compliance questions — your watermarking posture becomes a listing requirement, whatever your own user count is.
January 1, 2028 — capture devices
Manufacturers of devices that record photos, audio, or video must let users embed provenance disclosures in captured content by default. This completes the loop: authentic content gets provenance at capture, AI content gets it at generation, and platforms surface both.
The strategic read for a small AI company: provenance metadata is becoming the plumbing of the content internet. Building your pipeline around it now — rather than bolting it on at 999,000 users — is the cheaper path in every scenario.
What Non-Compliance Actually Costs
The Act sets a civil penalty of $5,000 per violation, and each day a violation continues counts as a discrete violation. There's no private right of action — enforcement belongs to the Attorney General and other public attorneys — but the daily accrual does the deterrence work: a single unresolved defect left unaddressed for a quarter is a $450,000 exposure before attorney's fees, which the statute also allows the state to recover.
The daily-accrual structure rewards fast detection and fast fixes. A startup that finds its own gap in a weekly compliance check and closes it in two days faces a fundamentally different exposure than one that learns about the same gap from a regulator six months in.
A Compliance Checklist You Can Run This Week
- Measure your California traffic honestly. Set up analytics that can tell you monthly California visitors and users, and an alert well below one million. You want runway, not a surprise.
- Audit your output pipeline for metadata survival. Generate content, then run it through every transformation your product applies — compression, resizing, format conversion, CDN optimization — and verify the latent disclosure survives each step.
- Check your upstream provider's provenance support. If you build on a major model API, confirm what provenance standard it embeds and what your terms say about preserving it.
- Draft the detection tool spec now. Upload, URL, and API intake; provenance output; no personal data retention. Even pre-threshold, a scoped spec turns a legal mandate into a sized engineering ticket.
- Update license templates. Add the latent-disclosure maintenance requirement and the 96-hour revocation mechanics to anything you sign going forward.
- Assign ownership and a log. One person owns compliance checks; every check, finding, and fix gets a dated entry. If a regulator ever asks, the log is your best exhibit.
Put the Compliance Program on Your Books
Compliance work you can't see in your ledger is compliance work you'll underfund. A few bookkeeping moves make the whole program manageable:
- Track compliance engineering as its own cost category. The detection tool's hosting, the watermarking library, the monitoring jobs — tag these expenses to a dedicated account rather than letting them dissolve into general R&D. When you price your product or talk to investors, you'll know what regulatory overhead actually costs you.
- Recognize the penalty math in your risk planning. You don't accrue a liability for penalties you haven't incurred, but a known, unresolved compliance gap with a $5,000-per-day meter is exactly the kind of contingency your financial planning should name. Quantify it; it's the number that gets the fix prioritized.
- Keep the audit trail where your records live. Licensee monitoring results, revocation notices, and remediation dates are the evidence that caps your exposure. Date-stamped, immutable records beat reconstructed timelines every time a "when did you discover this?" question gets asked.
Keep Clean Records While the Rules Keep Changing
Regulatory regimes like SB 942 reward companies whose records are precise, dated, and auditable — and that's as true of your finances as your compliance log. Beancount.io gives you plain-text accounting that's version-controlled and fully transparent, so every compliance expense, reserve decision, and vendor payment has a durable, reviewable history. Get started for free and keep your books as auditable as regulators expect your AI outputs to be.