EveryAILaw.com

Requirements at a glance

This regulation imposes 20 specific requirements for Transparency & Disclosure across 3 provisions:

• Latent disclosure — Include a latent disclosure in AI-generated image, video, or audio content (or any combination) created by the covered provider's GenAI system, permanent or extraordinarily difficult to remove where technically feasible (§ 22757.3(b))
• Latent disclosure contents — Where technically feasible and reasonable, convey directly or by link to a permanent website: provider name; GenAI system name and version number; time and date of creation or alteration; a unique identifier (§ 22757.3(b)(1))
• Self-detectable and standards-aligned — The latent disclosure must be detectable by the provider's own AI detection tool and consistent with widely accepted industry standards (§ 22757.3(b)(2)-(3))
• Manifest disclosure option — Offer the user the option to include a manifest disclosure identifying content as AI-generated — clear, conspicuous, medium-appropriate, understandable to a reasonable person, and permanent or extraordinarily difficult to remove (§ 22757.3(a))
• Free AI detection tool — Make an AI detection tool available at no cost that lets a user assess whether image, video, or audio content was created or altered by the provider's GenAI system (§ 22757.2(a))
• Tool output limits — The tool must output detected system provenance data and must not output personal provenance data (§ 22757.2(a)(2)-(3))
• Tool accessibility — The tool must be publicly accessible (subject to reasonable limits against demonstrable security or integrity risks), accept uploaded content or a URL, and support an API so it can be invoked without visiting the provider's website (§ 22757.2(a)(4)-(6))
• Feedback loop — Collect user feedback on the tool's efficacy and incorporate relevant feedback into efforts to improve it (§ 22757.2(b))
• Data minimisation — Do not collect or retain personal information from tool users, except opt-in contact details for feedback used only to improve the tool; do not retain submitted content longer than necessary; do not retain personal provenance data from submitted content (§ 22757.2(c))
• Licensee contract duty — Contractually require third-party licensees of the GenAI system to maintain its capability to include the latent disclosure (§ 22757.3(c)(1))
• 96-hour revocation — On knowledge that a licensee modified the system so it can no longer include the latent disclosure, revoke the license within 96 hours (§ 22757.3(c)(2)); the licensee must then cease using the system (§ 22757.3(c)(3))
• Provenance detection — Large online platforms must detect whether content distributed on the platform carries provenance data compliant with widely adopted specifications (§ 22757.3.1)
• User interface disclosure — Provide a user interface disclosing whether system provenance data is available for the content (§ 22757.3.1)
• Provenance inspection — Allow users to inspect available system provenance data (§ 22757.3.1)
• No stripping — Must not strip system provenance data or digital signatures, to the extent technically feasible (§ 22757.3.1)
• Hosting compliance — GenAI system hosting platforms must not knowingly make available a GenAI system that fails to place the required disclosures (§ 22757.3.2)
• User option — Provide the user with the option to include a latent disclosure in captured content (§ 22757.3.3(a)(1))
• Disclosure contents — The latent disclosure conveys the capture device manufacturer's name, the device name and version number, and the time and date of the content's creation or alteration (§ 22757.3.3(a)(1)(A)-(C))
• Default embedding — Embed latent disclosures in content captured by the device by default (§ 22757.3.3(a)(2))
• Feasibility limit — Compliance is required only to the extent technically feasible and compliant with widely adopted specifications adopted by an established standards-setting body (§ 22757.3.3(b))