Shine the Light: California Passes New Transparency Law for Generative AI

The California legislature just passed a law that will require developers of generative AI that is made publicly available to Californians to provide transparency regarding the data used to train that AI. If signed by Governor Newsom, Assembly Bill 2013 would be the most comprehensive law in the United States regarding AI data transparency. It would require developers of generative AI, including governmental entities that provide such AI to the public, to provide a high-level disclosure of the datasets used to train that generative AI.

The law was originally drafted to apply more generally to AI, but was narrowed to apply only to “generative artificial intelligence,” which is defined as artificial intelligence¹ that can generate derived synthetic content, such as text, images, video, and audio, that emulates the structure and characteristics of the artificial intelligence’s training data. The most well-known example of the generative AI programs is ChatGPT.

The law would apply to a generative artificial intelligence system, or a substantial modification to a generative artificial intelligence system or service, that is made publicly available to Californians for use. It would require any developer to post on the developer’s internet website certain documentation regarding the data used by the developer to train the generative artificial intelligence system or service², including, but not be limited to, all of the following:

1. The sources or owners of the datasets;
   
   
2. A description of how the datasets further the intended purpose of the artificial intelligence system or service;
   
   
3. The number of data points included in the datasets, which may be in general ranges, and with estimated figures for dynamic datasets;
   
   
4. A clear definition description of each category associated to the types of data points within the datasets, including the format of data points and sample values. For purposes of this paragraph, the following definitions apply:
   
   
   1. As applied to datasets that include labels, “types of data points” means the types of labels used;
      
      
   2. As applied to datasets without labeling, “types of data points” refers to the general characteristics;
5. Whether the datasets include any data protected by copyright, trademark, or patent, or whether the datasets are entirely in the public domain;
   
   
6. Whether the datasets were purchased or licensed by the developer;
   
   
7. Whether the datasets include personal information, as defined in the CCPA;
   
   
8. Whether the datasets include aggregate consumer information, as defined in the CCPA;
   
   
9. A description of whether there was any cleaning, processing, or other modification to the datasets by the developer, including the intended purpose of those efforts in relation to the artificial intelligence system or service;
   
   
10. The time period during which the data in the datasets were collected, including a notice if the data collection is ongoing;
    
    
11. The dates the datasets were first used during the development of the artificial intelligence system or service; and
    
    
12. Whether the generative artificial intelligence system or service used or continuously uses synthetic data generation in its development, a developer may include a description of the functional need or desired purpose of the synthetic data in relation to the intended purpose of the system or service.

The disclosure requirements must be made on or before January 1, 2026, and apply to each time any generative artificial intelligence system or service or substantial modification of such system or service is released on or after January 1, 2026.

The obligations apply to developers of the generative AI, which is any person, partnership, state or local government agency, or corporation that designs, codes, produces, or substantially modifies an artificial intelligence system or service for use by members of the public.

The disclosure requirements do not apply to a generative artificial intelligence system or service whose sole purpose is (a) to help ensure security and integrity, such as to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions or ensure the physical safety of a natural person; (b) the operation of aircraft in the national airspace; or (c) developed for national security, military, or defense purposes that is made available only to a federal entity.