California SB 942, signed in 2024, amended by AB 853 and operative on 2 August 2026. It asks one thing in three forms: that AI-generated image, video and audio be detectable — by a free public tool, by a visible label an ordinary person can read, and by a mark inside the file itself.
CALIFORNIA SB 942 · READINESS SCAN · 2 AUG 2026
The latent disclosure has to survive your whole pipeline.
The duties are your vendor’s. The clause that reaches you is a contract term, and the clock is 96 hours.
Latent disclosure
Detection tool
96 hours
$5,000 a day
2 Aug 2026
Our promise
“A disclosure you cannot verify is a promise.”
Every finding is written against the duty it answers — the statute’s where it reaches you, your vendor’s where it does not. The fee is fixed at $5,000, and nothing is charged until you approve it.
Request this readiness scanThe case file
The Transparency Act, in three chapters
Almost nobody reading this is a covered provider — that threshold is a million monthly users in California. The statute reaches you through the contract instead: your vendor must require the disclosure to keep working, and must pull the licence within 96 hours of finding it does not.
Our review is the independent read. We put a real asset through your real pipeline, read what survives the resize, the re-encode and the export, check the vendor terms against what the statute obliges them to impose, and hand you a dated record of what held, what did not, and where it broke.
The Act, split
Two sides. Only one is yours.
The duties land on the covered provider. The contract is what lands on you.
- Detection tool - free, public, and reachable by API
- Latent disclosure - provider, system and version, time, ID
- Manifest disclosure - a visible label, offered as an option
- Licence terms - preserved by contract, pulled in 96 hours
- Do not strip - the mark stays in the file when it leaves you
- Export paths - resize, re-encode and CDN presets all tested
- Vendor terms - the flow-down clause read before it is signed
- Later tranches - platforms 2027, capture devices 2028
Know your role
The duty is theirs. The pipeline is yours.
The licensee, in practice
You almost certainly are not a covered provider - that threshold is a million monthly users in California. What you are is downstream of one, under terms that say the disclosure has to still be in the file when it leaves you. Nothing about that duty is optional, and none of it is technical.
The covered provider
The detection tool, the latent disclosure and the manifest option are theirs to build, and the penalty for failing is theirs to carry. What comes with it is a duty to police you: they must require the capability contractually, and act when they find it switched off, which is why their terms reach your build pipeline.
When a resize becomes a breach
No one decides to strip provenance. A thumbnailer does it, or a CDN preset, or a re-encode on upload - and the term is broken by a build step nobody reviewed. Once your vendor notices, the clock on revocation is 96 hours, and it runs from their discovery rather than from the day you find it yourself.
What most teams assume
“We don’t build models, so SB 942 isn’t ours.”
What the contract says
You don’t build it. You do ship it.
It is the most common finding we write up.
- Who it is for
- Media & marketing teams
- SaaS & platform vendors
- Publishers & agencies
- Legal & compliance
- AI product teams
Penalties & enforcement
02
The California Attorney General enforces it, and so can a city attorney or a county counsel - three routes in, rather than one regulator's queue.
03
A licensee found to have disabled the latent disclosure has to be cut off within 96 hours of that discovery. Four days is the whole window.
04
The detection tool is free and public by design. Anyone at all can put your published asset into it, which makes the claim checkable from outside.
The 60-second check
Three questions. Then you’ll know.
No email, no signup. A starting point, not a determination.
Opens in a panel. Close it any time - your answers are kept.
California SB 942
Your scope check
The calendar
Four moments, and one has already moved.
The date shifted once already and further amendments were invited before it lands - so a plan pinned to a single day is the wrong shape for this one.
-
Passed
Signed Sept 2024SB 942 was signed on 19 September 2024, with the disclosure duties set to begin on 1 January 2026.
-
Delayed
Amended Oct 2025AB 853 moved the operative date to 2 August 2026 and staggered two further tranches behind it.
-
Operative
2 August 2026The covered-provider duties begin: detection tool, latent disclosure, the manifest option, licence terms.
-
Widened
2027, then 2028Large online platforms take direct duties from 1 January 2027, capture-device makers from 1 January 2028.
The trap
Teams hear “delayed to August 2026” and stop reading. The duty that reaches you is not on this calendar at all — it is the clause your vendor adds to its terms, and that lands whenever your contract is next signed or renewed.
Requirement & coverage
What the Act asks, what we ship
12 things to settle, and the artefact that answers each one. Paired, so every claim on this page can be checked against the requirement beside it.
- Whether you are covered at all Over 1,000,000 monthly users, publicly accessible in California
- A written determination of whether you are a covered provider, a licensee, or neither - so a vendor's duty is never mistaken for yours.
- Which content is in scope Image, video and audio - text is defined but not covered
- Every generative output you publish sorted into what the disclosure duties actually reach, and what they do not.
- The AI-detection tool Free and public, with API access, and no personal data
- Whether the tool exists, what it returns, and whether your own published assets come back correctly identified by it.
- Latent disclosure Provider, system name and version, timestamp, unique identifier
- Each required field read out of a real published asset, rather than taken on trust from a vendor datasheet.
- Permanence "Permanent or extraordinarily difficult to remove"
- The disclosure tested against resize, crop, re-encode and format conversion - the operations your pipeline actually performs.
- Manifest disclosure Optional, and clear and conspicuous where it is offered
- Whether the visible label is present, legible to an ordinary reader, and survives the template it is placed in.
- Provenance metadata C2PA-style signatures, where they are used at all
- Whether the signature is embedded, whether it validates, and whether it still validates after your export path.
- The delivery pipeline Where metadata gets stripped without anyone deciding to
- Every transform between the model and the reader named, with the ones that strip provenance identified by name.
- Licensee flow-down The capability preserved by contract, not by goodwill
- Your generative-AI agreements read for the clause the statute requires, and for what it obliges you to keep working.
- The 96-hour window From the provider's discovery to the licence being pulled
- Who would notice, who can act, and whether four days is achievable in your process as it currently runs.
- The later tranches Platforms from 1 Jan 2027, capture devices from 1 Jan 2028
- Whether either tranche reaches you, and what changes on each date if it does.
- The evidence trail $5,000 per violation, per day
- A dated record of what was tested, what held and what did not - which is what a good-faith posture is actually made of.
The engagement
Your content estate, independently traced
From covered providers to everyday publishers.
-
Inventory
What you generate, where it is published, and which duties reach it.
-
Trace
One real asset run through your real pipeline, and read at the far end.
-
Sign off and file
You see the draft first. Then the trace, the clause review and the record - dated.
Struck in your favour
Why teams choose iDharma to trace the pipeline with them
Genuinely independent
We build, resell and operate no AI systems of our own, and take no fee tied to what we find.
Written to the statute
Every finding names the duty it answers, so a reviewer can check it against the text itself.
Tested, not asserted
We put a real asset through your real pipeline, rather than read a vendor datasheet to you.
One engagement, end to end
Content, pipeline, contracts and the record sit in one scope, so nothing falls between two.
Four marks, struck on every report.
Deliverables
What you get
Concrete artefacts, each with a name and a format - you know what lands before you buy.
Disclosure readiness report
The full assessment in one document: whether SB 942 reaches you at all and in which role, what your published image, video and audio actually carry, where in the delivery pipeline that survives and where it does not, what your vendor terms oblige you to keep working, and every finding written against the duty it answers.
Content and system register
Every generative system, what it produces, where that is published and which duties reach it, in a workbook your team can keep current.
Pipeline trace
One real asset followed step by step from the model to the reader, with the transform that strips the disclosure named and located.
Vendor-clause review
What your generative-AI agreements actually require of you on disclosure, and what the 96-hour revocation right means for your process.
Scope memo
Which systems and which content were in scope, which were not, and why each call was made - the written record behind the inventory.
Remediation shortlist
Where the gaps sit, what to do first, and why each one is where it is. Ranked by consequence to the people affected, not by ease of fixing.
Evidence trail index
The dated record - what was tested, on what date, what held and what did not - kept in a form you can hand to counsel or to a vendor.
Format & fee
Real numbers, upfront.
- Scope
- Set by the statute, not by us
- Input
- Your assets, pipeline, contracts
- Re-read
- Annually, or on a pipeline change - re-traced against your known baseline
The statute fixed the scope, so the fee is flat - nothing to meter, and nothing charged until you approve it.
Request your scan
California SB 942 · Readiness scan
$5,000 flat
- Independent disclosure readiness report
- Pipeline trace, transform by transform
- Vendor-clause review included
- A dated evidence trail you keep
Show your hand
Four things you have to be able to produce
Good faith is not a document. Each of these is either in your hand on the day somebody asks, or it is not.
The asset,
traced
One real generated file followed from the model to the reader, read at every step. A datasheet claims the disclosure is permanent; a trace is what demonstrates it.
The fields,
present
Provider name, system name and version, a timestamp and a unique identifier - read out of something you have actually published, and not out of the documentation.
The label,
visible
Where a manifest disclosure is offered, it is legible to an ordinary person where they meet the content, rather than buried in a file properties panel somewhere.
The clause,
read
The flow-down term in your generative-AI agreement, what it obliges you to keep working, and the 96-hour revocation right that sits behind the whole of it.
Four cards, and the date on each one is part of the card.
FAQ
Plain answers
Scope, timing, and the cost of getting it wrong. Answered straight.
Request your scanWe only use AI tools. Does SB 942 reach us?
Usually not directly - the duties fall on covered providers with over a million monthly California users. It reaches you through the contract: your vendor must require you to keep the disclosure intact, and can pull the licence within 96 hours if you do not.
Is SB 942 in force right now?
Not yet. It was signed in September 2024 with a 1 January 2026 date, and AB 853 moved the core obligations to 2 August 2026. Further follow-up legislation was invited before it takes effect, so the text can still move.
Does it apply to AI-generated text?
No. The substantive disclosure obligations apply to image, video and audio - even though text appears inside the statutory definition of a generative AI system. That distinction is the statute's, not ours.
What are the penalties?
$5,000 per violation, and each day counts as a separate violation. It is enforced by the California Attorney General, and also by a city attorney or county counsel - three routes in rather than one.
How long does it take?
Typically two to four weeks from hand-over for a first reading, longer where the content estate turns out to be bigger than expected - which it usually does. Scope is agreed before anything is charged.
Get started
Request your readiness scan
Tell us what you generate and where it goes, and we come back with a scoping call within one business day.
What we need from you
Nothing you do not already have. Most of this is a folder someone can assemble in an afternoon, and we name every document first, in writing, before you commit.
- Which generative systems you use, and their outputs
- Where that content is published, and who gets to see it
- Any documentation - vendor terms, pipeline notes
- Whether you host the model, buy it, or fine-tune one
- A published asset or two, exactly as your readers get them
What happens next
- You send the five items we need.
- You get a scoping call within one business day.
- Nothing is charged until you approve the scope.
Sources & standing
Where this page gets its facts
Where the claims on this page come from, and what they are worth - stated, not assumed.
What it is drawn from
- California SB 942 - the AI Transparency Act
- AB 853 (2025), which amended it
- Signed
- 19 September 2024
- Operative from
- 2 August 2026
What it means
- General information about what the statute requires — not legal advice, and no professional relationship arises from reading it. It determines nothing about your own systems.
- Where a scope question is arguable, our reports say so rather than the convenient one.
Scope & limitation
- California invited further amendments before 2 August 2026 - check the text as it stands.
- It covers SB 942 alone - the CCPA and federal rules reach the same content.
- Do not rest a binding decision on it; engage qualified counsel.
Something on this page out of date?
Tell usFrom Insights
Before you commission one
How to Prepare for an AI Audit: The Readiness Checklist
Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.
Read the notes
METHODOLOGY NOTES
What Is an AI Audit? Scope, Standards, and What You Get
An independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.
STANDARDS EXPLAINED
What an AI Governance Framework Actually Contains
Five working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.
STANDARDS EXPLAINED
ISO/IEC 42001, SOC 2 and NIST AI RMF: Which One Your Buyer Is Actually Asking For
One certifies an organisation, one is an opinion about controls over a window, one is a method with nothing to issue. What each covers — and what none of them answers.
