California AI Transparency Act
Since 30 September 2026, every generative AI system publicly available in California, whatever its size, must embed a latent disclosure in the images, video and audio it makes or alters. One call to POST /v1/mark embeds all five items, and anyone can check them in an image, free, at kennmarq.com/check.
In short
- Who: anyone whose generative AI system is publicly accessible in California; SB 1000 removed the 1 million-user threshold.
- When: since 30 September 2026.
- What: a latent disclosure with the provider's name, the system's name and version, the time and date, a unique ID, and whether the content was created or altered; plus a way to verify it, which may be a third party's tool.
- Kennmarq.com: all five in the signed credential when you send
provider,app_nameandapp_version; our free checker shows them. - Penalties: up to USD 5,000 per violation, each day a new one.
Who it covers
The Act is Chapter 25 of California's Business and Professions Code (SB 942, amended by AB 853 and SB 1000). SB 1000, signed and in force on 30 September 2026, removed the old threshold of one million monthly users. Anyone who produces a generative AI system that is publicly accessible in California is now a covered provider: startups, open-source developers and small SaaS products included.
What the latent disclosure must carry
A latent disclosure is machine-readable and travels with the file. Ours is the signed C2PA manifest, an industry standard, backed by an invisible watermark that leads back to it when platforms strip metadata.
| Item | You send | Where it lives | Checker row |
|---|---|---|---|
| The provider's name | provider, e.g. Acme Inc. | com.kennmarq.generator, provider | Provider |
| The AI system's name and version | app_name and app_version | The created action's software agent | AI system |
| The time and date it was made or altered | Added by us | The created action's time, and our RFC 3161 time-stamp | Created at, Signed at |
| A unique identifier | Added by us | The manifest's ID, and the watermark's ID in the pixels | Manifest ID, Watermark ID |
| Whether it was created or altered | source: created, or edited | The IPTC digital source type | How it was made |
One call
curl https://api.kennmarq.com/v1/mark \
-H "Authorization: Bearer $KENNMARQ_API_KEY" \
-F file=@render.png \
-F source=created \
-F provider="Acme Inc." \
-F app_name="Acme Studio" \
-F app_version="2.1" \
-F model="FLUX.1 schnell" \
-o render.marked.pngThe same fields work for songs and clips, in the Python SDK (local mode too) and in the ComfyUI nodes. Without app_name the manifest names no AI system: we never put our own name there, because we don't make your content.
Add -F markets=us-ca and we refuse a call that lacks the provider or the system's name and version, and keep a signed receipt of what the file carries.
Letting people verify it
The Act asks covered providers for a disclosure verification tool. Since SB 1000, they may meet that by directing people to a third party's tool.
- Pictures: anyone can check one at kennmarq.com/check. It shows all five items, and the picture never leaves their browser.
- Songs and clips: POST /v1/verify reads them with an API key, so offer that check in your own app.
Whether a tool meets the Act for your system is for you and your counsel to decide.
Penalties
Up to USD 5,000 per violation, each day counting as a separate violation, enforced by the Attorney General, city attorneys and county counsel.
Coming next
- 1 January 2027: large online platforms, over 2 million monthly users, must detect provenance data and show whether content was made or altered by AI or captured by a device (AB 853, as rewritten by AB 2713).
- Washington and Utah: HB 1170 (from 1 February 2027) and HB 276 (from 1 January 2027) ask large generative AI providers for similar provenance data.
What stays with you
- Being the covered provider of your AI system.
- Sending an accurate provider, system and source with each file.
- If you license your system to others, the Act's rules for licensees.