EveryAILaw.comDoes California Generative AI Training Data Transparency Act (AB 2013) require Data Governance?
California • enforcing
Yes — 1 provision
Requirements at a glance
This regulation imposes 11 specific requirements for Data Governance across 1 provision:
- Posting duty — Post training-data documentation on the developer's own website before each time the system, service, or a substantial modification is made publicly available to Californians (§ 3111)
- Dataset sources — Identify the sources or owners of the datasets, and describe how they further the intended purpose of the system (§ 3111(a)(1)-(2))
- Dataset size and shape — State the number of data points, which may be given in general ranges with estimates for dynamic datasets, and describe the types of data points — label types where labelled, general characteristics where not (§ 3111(a)(3)-(4))
- IP status — State whether the datasets include data protected by copyright, trademark, or patent, or are entirely in the public domain (§ 3111(a)(5))
- Provenance of acquisition — State whether the datasets were purchased or licensed (§ 3111(a)(6))
- Personal information — State whether the datasets include personal information or aggregate consumer information as defined in Civ. Code § 1798.140 (§ 3111(a)(7)-(8))
- Cleaning and processing — Describe any cleaning, processing, or other modification of the datasets, and its intended purpose in relation to the system (§ 3111(a)(9))
- Collection period — Give the time period during which the data were collected, with notice if collection is ongoing, and the dates the datasets were first used in development (§ 3111(a)(10)-(11))
- Synthetic data — State whether the system used or continuously uses synthetic data generation in development; a functional-need description may be included (§ 3111(a)(12))
- Substantial modification trigger — A new version, release, or update that materially changes functionality or performance — including results of retraining or fine tuning — re-triggers the posting duty (§ 3110(d))
- Exemptions — No documentation is required for systems whose sole purpose is security and integrity as defined in Civ. Code § 1798.140(ac), whose sole purpose is operating aircraft in the national airspace, or that are developed for national security, military, or defense purposes and made available only to a federal entity (§ 3111(b))
Training Data Documentation #
The disclosure runs to training inputs rather than outputs, which makes it the counterpart to the provenance duties in the California AI Transparency Act: one documents what went into the model, the other marks what comes out. It bites on every substantial modification — a new version, release, update, retraining, or fine-tune that materially changes functionality or performance — so it is a recurring release-gate obligation, not a one-time filing. There is no penalty provision and no named enforcer in the chapter.
Requirements
| Requirement | Details |
|---|---|
| Posting duty | Post training-data documentation on the developer's own website before each time the system, service, or a substantial modification is made publicly available to Californians (§ 3111) |
| Dataset sources | Identify the sources or owners of the datasets, and describe how they further the intended purpose of the system (§ 3111(a)(1)-(2)) |
| Dataset size and shape | State the number of data points, which may be given in general ranges with estimates for dynamic datasets, and describe the types of data points — label types where labelled, general characteristics where not (§ 3111(a)(3)-(4)) |
| IP status | State whether the datasets include data protected by copyright, trademark, or patent, or are entirely in the public domain (§ 3111(a)(5)) |
| Provenance of acquisition | State whether the datasets were purchased or licensed (§ 3111(a)(6)) |
| Personal information | State whether the datasets include personal information or aggregate consumer information as defined in Civ. Code § 1798.140 (§ 3111(a)(7)-(8)) |
| Cleaning and processing | Describe any cleaning, processing, or other modification of the datasets, and its intended purpose in relation to the system (§ 3111(a)(9)) |
| Collection period | Give the time period during which the data were collected, with notice if collection is ongoing, and the dates the datasets were first used in development (§ 3111(a)(10)-(11)) |
| Synthetic data | State whether the system used or continuously uses synthetic data generation in development; a functional-need description may be included (§ 3111(a)(12)) |
| Substantial modification trigger | A new version, release, or update that materially changes functionality or performance — including results of retraining or fine tuning — re-triggers the posting duty (§ 3110(d)) |
| Exemptions | No documentation is required for systems whose sole purpose is security and integrity as defined in Civ. Code § 1798.140(ac), whose sole purpose is operating aircraft in the national airspace, or that are developed for national security, military, or defense purposes and made available only to a federal entity (§ 3111(b)) |
Penalties
| Violation | Fine |
|---|---|
| No statutory penalty | The chapter creates no civil penalty, no private right of action, and names no enforcing authority; exposure runs through general California unfair competition and consumer protection law rather than the statute itself |