Binding law — in force
GenAI providers must embed latent provenance disclosure in synthetic media (California)
Since SB 1000 took effect on 2026-09-30, the California AI Transparency Act has no user threshold: anyone who creates, codes or otherwise produces a generative AI system that people in California can access must, as far as technically feasible, embed a latent disclosure in the image, video or audio that system creates or alters (minor edits such as resizing, cropping or format conversion excepted). The disclosure names the provider, the system and its version, the time and date, a unique identifier and whether the content was created or altered (from 2029 also whether the system is built mainly as assistive technology); it must be hard to strip or tamper with, readable by the provider's disclosure verification tool, and follow recognized standards such as C2PA. Detect synthetic-media generation paths that emit no latent provenance marking.
Who it applies to
- Duty falls on: provider
- Covered provider: any person who creates, codes or otherwise produces a GenAI system publicly accessible in California (22757.1(e) as amended by SB 1000, in force 2026-09-30; from 2026-08-02 to 2026-09-29 only systems with over 1,000,000 monthly visitors or users). Applies to content the system creates or alters, except by minor modification (22757.1(l)), and only to the extent technically feasible. Not applicable to products that provide exclusively non-user-generated videogames (22757.5(a); SB 1000 dropped the former television, streaming, movie and interactive-experience exemption) or, before 2029-01-01, to a GenAI system designed to primarily function as assistive technology (22757.5(b), 22757.1(b)). Whether an application built on a third-party model is itself a covered provider needs human determination.
- Whether it applies depends on facts outside the code; a person has to decide.
The guard to add
Embed a signed C2PA manifest or equivalent latent disclosure in generated or captured media when it is created, and do not distribute systems or files that lack it.
Where media is created (the generation handler after images.generate or a diffusion pipeline, or the capture pipeline in device firmware or camera app), build a provenance manifest stating who and what produced it (provider or manufacturer, system or device name and version, timestamp, unique id) and sign and embed it (c2pa.Builder with builder.sign, c2patool, c2pa-node) before the file is saved, uploaded, or returned. Later re-encode steps preserve the manifest. Where the product distributes generative systems rather than media (a model or weights hosting platform), the publish or listing step checks that each system declares support for latent disclosure and blocks publication otherwise.
Where it goes: 9 AI output handling, 1 application source code, 12 repository artifacts, 14 user-facing text.
What this provision adds:
- The latent disclosure conveys the provider name, the system name and version, the time and date of creation or alteration, a unique identifier, and whether the system created or altered the content.
- It is permanent or extraordinarily difficult to remove or tamper with, readable by the provider's disclosure verification tool, and compliant or interoperable with recognized standards such as C2PA.
- From 2029-01-01 the disclosure also states whether the GenAI system is designed to primarily function as assistive technology.
Example (c2pa-python), before:
image = pipe(prompt).images[0]
image.save(out_path)After:
image = pipe(prompt).images[0]
image.save(raw_path)
manifest = {
'claim_generator_info': [{'name': 'acme-image-service', 'version': '2.3.0'}],
'assertions': [
{'label': 'c2pa.actions', 'data': {'actions': [{'action': 'c2pa.created',
'digitalSourceType': 'http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia',
'when': datetime.now(UTC).isoformat()}]}},
{'label': 'com.acme.provenance', 'data': {'system': 'acme-image', 'system_version': '2.3.0', 'content_id': str(uuid.uuid4())}}]}
builder = c2pa.Builder(manifest)
with open(raw_path, 'rb') as src, open(out_path, 'w+b') as dst:
builder.sign(signer, 'image/png', src, dst) # signer from our load_c2pa_signer()Control: GenAI content without latent provenance disclosure. The same guard addresses 3 items with binding law in 1 jurisdiction. Engineering guidance, not legal advice.
Rule id ca-sb942.provenance-disclosure · review status: primary source derived