EveryAILaw.com

Requirements at a glance

This regulation imposes 23 specific requirements for Transparency & Disclosure across 3 provisions:

• Latent disclosure — To the extent technically feasible, include latent disclosure in image, video, audio, or combined content created or altered by the provider's GenAI system, except by minor modification (§ 22757.3(a)); defined minor modifications include brightness, contrast, color, sharpening, saturation, resizing, scaling, cropping, format conversion, and denoising and removal of background noise in audio (§ 22757.1(l))
• Latent disclosure contents — Convey directly or through a permanent website the provider name, system name/version, creation or alteration time/date, unique identifier, and whether the system created or altered the content; from 2029-01-01 also state whether the system is designed primarily as assistive technology (§ 22757.3(a)(1))
• Persistence and interoperability — Disclosure must be permanent or extraordinarily difficult to remove or tamper with, compatible with the provider's disclosure verification tool, and compliant or interoperable with widely recognized industry standards (§ 22757.3(a)(2)-(4))
• Free disclosure verification tool — Provide a free tool assessing whether image, video, audio, or combined content was created or altered, except by minor modification, by the provider's GenAI system; output detected system provenance data (§ 22757.2(a)(1)-(2))
• Personal-information output — Do not output detected personal information unless the user to whom the personal information pertains expressly consents in clear, conspicuous plain language to including personal information specified by that user in the content, after notice of what may be output and the permanent digital footprint that cannot be retracted from circulated copies (§ 22757.2(a)(3))
• Tool accessibility — Make the tool publicly accessible subject to reasonable security, integrity, or malicious-misuse limits; accept uploads or URLs; support technology including an API for invocation without visiting the provider's website (§ 22757.2(a)(4)-(6))
• Feedback loop — Collect efficacy feedback and incorporate relevant feedback into improvement attempts (§ 22757.2(b))
• Personal-information limits — Do not collect, use, retain, sell, share, or otherwise make available personal information from tool users or processed content beyond what is strictly necessary for compliance, except information used solely to communicate with an opted-in user. Do not condition GenAI system or tool access on information beyond what is strictly necessary (§ 22757.2(c)-(d))
• Third-party tool option — A third-party tool may satisfy these duties if compliant with § 22757.2, compatible with the provider's latent disclosures, and clearly and conspicuously accessible through its GenAI system interface (§ 22757.2(e))
• Licensee notification — Notify third-party licensees of their chapter obligations when granting a license (§ 22757.3(b)(1))
• 72-hour response — On knowledge that an identifiable licensee modified a system out of compliance, terminate authorization within 72 hours or notify the licensee within 72 hours of noncompliance and the AG-reporting requirement (§ 22757.3(b)(2))
• Licensee cure and reporting — A notified licensee must make the system compliant or cease using or making it available, including copies or modifications, and report its chosen action to the provider within 96 hours. The provider must report to the AG if no report arrives or the report indicates neither required action was taken (§ 22757.3(b)(3)-(4))
• Monitoring limit — The licensee-response subdivision does not require monitoring, investigation, or inquiry into licensee use or modification (§ 22757.3(b)(5))
• Assistive-technology representation — Do not falsely represent that a GenAI system is designed primarily as assistive technology (§ 22757.3(d)); the chapter's pre-2029 assistive-technology exclusion and temporary separate penalty must be read alongside this prohibition
• Provenance detection — Large online platforms must detect whether content distributed on the platform carries provenance data compliant with widely adopted specifications (§ 22757.3.1)
• User interface disclosure — Provide a user interface disclosing whether system provenance data is available for the content (§ 22757.3.1)
• Provenance inspection — Allow users to inspect available system provenance data (§ 22757.3.1)
• No stripping — Must not strip system provenance data or digital signatures, to the extent technically feasible (§ 22757.3.1)
• Hosting compliance — GenAI system hosting platforms must not knowingly make available a GenAI system that fails to place the required disclosures (§ 22757.3.2)
• User option — Provide the user with the option to include a latent disclosure in captured content (§ 22757.3.3(a)(1))
• Disclosure contents — The latent disclosure conveys the capture device manufacturer's name, the device name and version number, and the time and date of the content's creation or alteration (§ 22757.3.3(a)(1)(A)-(C))
• Default embedding — Embed latent disclosures in content captured by the device by default (§ 22757.3.3(a)(2))
• Feasibility limit — Compliance is required only to the extent technically feasible and compliant with widely adopted specifications adopted by an established standards-setting body (§ 22757.3.3(b))