SB 942’s Five Latent-Disclosure Fields, in Plain English

“Latent” means hidden in the content itself

Start with the word. A latent disclosure is not a label your audience sees. It is provenance information carried inside an image, video or audio file itself — embedded in the content, meant to be read back later by a detection tool, not by a person glancing at a caption.

That distinction used to have a sibling. Earlier versions of California’s AI Transparency Act let providers offer a visible — “manifest” — disclosure instead. SB 1000 deleted that option. If you are working from a pre-September 2026 guide that tells you a visible label is an alternative, that guide is out of date. The latent disclosure is now the duty, and it has five required fields.

Who owes this, and since when

The duty falls on a “covered provider”: a person that creates, codes, or otherwise produces a generative AI system that is publicly accessible within California (Business & Professions Code § 22757.1(e)). Read that again and notice what is missing — any threshold. The original Act limited the definition to systems with more than a million monthly visitors or users; SB 1000 deleted that threshold entirely. No user count, revenue figure or company size takes a provider out of the definition.

The provider duties have been operative since 2 August 2026. They attach to image, video and audio content the system created or altered — with a carve-out for minor modifications such as brightness, contrast, sharpening, resizing, cropping, format conversion or denoising, which do not count. And if the line between “we built this system” and “we merely embed or resell someone else’s” is unclear in your case, that is a needs-legal-review answer, not a guess — the checker below is built to say exactly that.

The five fields, one by one

Section 22757.3(b) lists what the latent disclosure must convey, to the extent technically feasible. Five items:

Fields 1 to 4 are identity and bookkeeping: who, what, when, which one. Field 5 is the one people miss, because it is the newest — summaries written before SB 1000 list only four fields, and a disclosure built to those summaries is now one field short.

What else “latent” demands

The fields are only half the requirement. The same paragraph sets three quality bars for how the disclosure is carried. It must be permanent or extraordinarily difficult to remove. It must be detectable by the Act’s disclosure verification tool. And it must be consistent and interoperable with widely accepted industry standards for provenance — the statute’s own example is the C2PA Content Credentials approach.

The companion tool matters: under § 22757.2, a covered provider must also offer a free, publicly accessible verification tool that lets anyone assess whether image, video or audio was created or altered by its system — by upload or URL, with API support — or direct users to a compliant third-party tool clearly reachable from its interface. Fields nobody can read back would be theatre; the tool makes them evidence.

If you license your system to others, § 22757.3(c) requires you to contractually require licensees to maintain the disclosure capability. The post-SB 1000 mechanics are brisk: learn that an identifiable licensee has modified the system into noncompliance, and you have 72 hours to terminate its authorisation or notify it; the licensee must then comply or stop, and report back within 96 hours; unresolved cases go to the Attorney General.

The cost of getting it wrong

The civil penalty is $5,000 per violation, and each day counts as a discrete violation, so an unaddressed gap accumulates daily rather than sitting still. Actions are brought by the Attorney General, a city attorney or county counsel — there is no private right of action, which limits who can sue but not what it can cost.

Keep the calendar straight, too: large online platforms and GenAI hosting platforms have their own duties from 1 January 2027, capture device manufacturers from 1 January 2028, and a temporary exemption for systems designed primarily as assistive technology runs until 1 January 2029 — falsely claiming it costs $50,000 per violation.

A plain-English self-check

1. Do we create, code or otherwise produce a GenAI system that is publicly accessible in California? If yes, assume “covered provider” is possibly your label — size is no defence since SB 1000.
2. Does it create or alter image, video or audio content, beyond minor modifications? Text alone is not where these disclosure duties attach.
3. Does our output carry all five fields — provider name, system name and version, time and date, unique identifier, and created-or-altered?
4. Would the disclosure survive ordinary handling — permanent or extraordinarily difficult to remove — and can a verification tool actually detect it?
5. Is our free verification tool live and reachable, and do our licensee contracts require the capability to be maintained?

Any “not sure” in that list — above all on the provider boundary — is a needs-legal-review result. This guide explains the fields; it is not legal advice, and no checklist can tell you that you are compliant.