California AB 2013 Compliance for AI Product Teams: Training Data Transparency in 2026
TL;DR
California AB 2013, the Generative AI Training Data Transparency Act, took effect January 1, 2026, and requires public documentation of training data for covered generative AI systems. SB 942 (the AI Transparency Act) followed on August 2, 2026, adding content provenance and detection tool requirements. The EU gets most of the AI regulation attention, but these two California laws already apply to any company serving California users. This guide covers what each law requires, who is covered including teams that fine-tune third-party models, and a practical compliance action plan for AI product teams. This is not legal advice: consult counsel before making compliance decisions.
The AI PM Minute
One tactic to make you a sharper AI PM, twice a week. 60 seconds to read. Free.
No fluff. Unsubscribe anytime.
What AB 2013 Actually Requires
AB 2013 requires companies that develop generative AI systems for California users to publicly post documentation about their training data. The documentation must be posted on a website accessible to the public, not just made available on request. The key disclosures are:
Training data sources
A general description of the datasets used, including whether they were licensed, synthetic, scraped, or generated from user interactions. The law does not require disclosing the full dataset, only a description of its sources and composition.
Copyright and patent disclosure
Whether the training data includes copyrighted or patented material, even if only as training inputs. This is explicit in the statute and is the provision that most legal teams flag first.
Personal information disclosure
Whether the training data includes personal information as defined under California law, including under CCPA. If it does, the documentation must say so.
Data collection methods
Whether the training data was obtained through web scraping, licensed agreements, synthetic generation, or user-generated content. This is about method of collection, not individual sources.
Known limitations
Known limitations of the training data that could affect the system's output quality, fairness, or accuracy. This one is intentionally broad and requires judgment about which limitations are material.
Enforcement is primarily through California's Unfair Competition Law, which means the Attorney General, district attorneys, and city attorneys can bring actions. xAI filed a lawsuit in December 2025 arguing that the law unconstitutionally compels disclosure of proprietary information. That litigation is ongoing as of November 2026 and has not suspended enforcement obligations.
Who Is Covered: Broader Than Most Teams Assume
The coverage question is where most product teams underestimate their exposure. The law covers companies that develop generative AI systems, but the definition of "develop" is interpreted more broadly than simply training a model from scratch.
Training your own model from scratch
Clearly covered. You are the developer and the training data documentation requirement applies directly.
Fine-tuning a third-party foundation model
Likely covered if the modification is considered substantial. The law uses the term 'substantially modify.' What counts as substantial is not defined and is currently unsettled. Conservative interpretation: any domain-specific fine-tune qualifies.
Using a foundation model via API without modification
Likely not covered for the underlying model. The model provider's disclosure obligations apply to their system, not yours. However, you should confirm the provider has met their own AB 2013 obligations before building on their platform.
Using a foundation model with a custom system prompt only
Not a substantial modification. System prompt configuration does not trigger developer obligations under a reasonable reading of the statute.
Synthetic data generation pipelines used in production
If you use AI to generate synthetic training data for another model you deploy, that pipeline is part of your training data stack and may require disclosure.
Embedding models trained on proprietary data
Embedding models used in production RAG pipelines that were trained on your proprietary corpus likely qualify if the corpus contains copyrighted or personal data.
The fine-tune gray area
The most common scenario that teams are unsure about is a fine-tuned model using proprietary customer data. Legal counsel from multiple firms recommends treating any fine-tune as "substantially modified" until the law is interpreted through enforcement actions or litigation. The conservative path: document your fine-tuning datasets and publish the disclosure even if you are uncertain whether it is required.
SB 942: The AI Transparency Act Layer
SB 942 (amended by AB 853) is a separate law that became enforceable on August 2, 2026. It addresses AI outputs, not training data. The two laws together cover both what goes in (AB 2013) and what comes out (SB 942).
AI-generated content disclosure
Applies to: Covered providers of large generative AI systems
Requirement: Users must be able to tell when they are interacting with AI-generated content, except where it is obvious from context. Chatbots must identify themselves as AI.
PM implication: Any product feature where AI generates content that could be mistaken for human-created content needs a disclosure mechanism. This includes AI-generated customer support responses, AI-drafted documents, and AI-generated product descriptions.
Detection tool requirement
Applies to: Providers of large generative AI systems (threshold-based, not all AI products)
Requirement: Must offer a publicly accessible tool that allows anyone to detect whether a given piece of content was generated by your system. The detection tool must be available without charge.
PM implication: If your product is a large generative AI system by the statute's definition, you need a detection API or tool on your roadmap. This is a product build, not just a documentation exercise.
Provenance metadata
Applies to: Providers of large generative AI systems
Requirement: AI-generated content must include embedded provenance metadata where technically feasible. This is what the C2PA content credential standard is designed to implement.
PM implication: Coordinate with engineering on C2PA implementation or an equivalent provenance standard. This is a technical requirement that must be built into the content generation pipeline, not added retroactively.
Navigate AI Regulation With Confidence
The AI PM Masterclass covers the regulatory landscape every AI PM needs to understand, including how to build compliance into product strategy rather than bolting it on after launch.
What to Watch: The xAI Lawsuit and Evolving Enforcement
xAI filed a legal challenge to AB 2013 in December 2025 on First Amendment grounds, arguing that forced disclosure of proprietary training data constitutes compelled speech. The case was pending as of November 2026. A ruling in xAI's favor could narrow or eliminate the disclosure requirements. A ruling against them would signal aggressive enforcement is coming.
xAI wins: law narrowed or struck
Disclosure requirements may be reduced or eliminated. Teams that have published documentation would still benefit from the trust signal it creates, but the legal obligation may disappear.
Recommended stance: Continue compliance planning. Do not delay roadmap items waiting for the ruling.
xAI loses: enforcement accelerates
Attorney General and local prosecutors gain clear authority to pursue non-compliant companies. Enforcement actions typically start with large, visible companies to establish precedent.
Recommended stance: Prioritize compliance for any product serving California users at scale. Document your training data inventory now.
A second thing to watch: California SB 1047 successor bills. SB 1047 was vetoed by Governor Newsom in 2024, but the California legislature has continued introducing safety-focused AI bills. The current session has multiple bills in committee that would add model evaluation, incident reporting, and emergency shutdown requirements for large AI developers. These are relevant for teams building at the frontier, not for typical product teams.
What AB 2013 Does Not Require
Knowing the limits of the law helps teams avoid over-complying in ways that create competitive disadvantages or inadvertently disclose proprietary information.
Disclosing the full dataset
You need to describe the data, not publish it. The law requires a summary of sources and composition, not the actual training corpus.
Disclosing your model architecture or weights
AB 2013 covers training data only. Model architecture, hyperparameters, and weights are not covered.
Obtaining individual consent for training data use
The law requires disclosure, not consent. If you have separate obligations under CCPA or GDPR to obtain consent for personal data used in training, those are separate requirements.
Real-time or per-request disclosure
The documentation must be publicly posted, not surfaced on every API call or in every user session. A webpage or policy document is sufficient for the AB 2013 requirement.
Certifying that training data is 100% licensed
The law requires you to disclose whether copyrighted or patented material was used, not to certify that all data is clean. You may still use training data that includes copyrighted material and comply by disclosing it.
PM Compliance Action Plan: What to Do Now
This is a starting framework. Work with your legal team on the specifics before publishing any documentation.
Step 1: Inventory your AI systems
- •List every generative AI system your product ships or relies on that could constitute a 'developed' system under AB 2013.
- •Classify each one: trained from scratch, substantially fine-tuned, or using a third-party model via API without modification.
- •For each covered system, identify whether a training data disclosure already exists (from the model provider if you use a third-party model, or from your own team).
Step 2: Document your training data
- •For each covered system, write a training data summary covering: sources, collection method, copyright and patent status, personal information status, and known limitations.
- •Have legal review the summary for trade-secret exposure before publishing. The law requires disclosure, but you can describe sources in general terms without naming specific datasets.
- •Create a versioned document that you can update as your models are updated.
Step 3: Publish the documentation
- •Post the training data documentation on a publicly accessible page on your website.
- •Link to it from your privacy policy and terms of service.
- •Update it whenever you train or substantially modify a covered system.
Step 4: Assess SB 942 obligations
- •Determine whether your system meets the 'large generative AI system' threshold for SB 942.
- •If yes, audit your product for AI content disclosure: are there user-facing features where AI-generated content could be mistaken for human content?
- •Add a detection tool and C2PA provenance metadata to your roadmap if required.
Not legal advice
This guide is a framework for product team planning, not a legal opinion. AB 2013 and SB 942 are both new laws with unsettled enforcement. The analysis above reflects publicly available practitioner guidance as of November 2026. Consult qualified California counsel before making compliance decisions.
Build AI Products That Can Navigate a Regulated World
The AI PM Masterclass covers AI regulation, compliance strategy, and how to build products that clear legal and procurement review. Taught live by a Sr. Director PM with real-world enterprise AI experience.
Related Articles
Before you go: get the AI PM Minute
One tactic to make you a sharper AI PM, twice a week. 60 seconds to read. Free.
No fluff. Unsubscribe anytime.