California Governor Signs AB 2013 Requiring Generative AI Transparency

California's AB-2013, signed into law recently by Governor Gavin Newsom, requires companies developing generative AI systems to publish detailed summaries of the data used to train their models. These disclosures must include information on data ownership, how the data was sourced or licensed, and whether the datasets contain copyrighted or personal information. Although the law applies to AI systems released after January 2022, compliance isn’t required until January 2026, giving companies time to adjust their data practices. For tech startups, this law represents both an opportunity to build trust and a potential legal minefield.

Documentation Requirements

Before a GenAI system or service is released or substantially modified, the developer must post a “high-level” summary of the data used to train the system, including, at minimum:

1. The sources or owners of the datasets.
2. A description of how these datasets further the intended purpose of the system or service.
3. The number of data points included in the datasets, as a general range or with an estimated figure for dynamic datasets.
4. A description of the types of “data points” within the datasets, meaning either the types of labels used or, in datasets without labeling, the general characteristics of the datasets.
5. Whether the datasets included any data protected by copyright, trademark, or patent or are entirely in the public domain, and whether the datasets were purchased or licensed by the developer.
6. Whether the datasets included personal information or aggregate consumer information.
7. Whether there was any cleaning, processing, or other modification to the datasets by the developer and the intended purpose of those efforts.
8. The time period during which the data in the datasets were collected and a notice if the data collection is ongoing.
9. The dates the datasets were first used during the development of the system or service.
10. Whether the system or service used or continuously uses “synthetic data generation” in its development, including a description of the functional need or desired purpose of the synthetic data in relation to the intended purpose of the system or service.

What does this mean?

AB 2013 requires any “developer” that makes any generative “artificial intelligence” technology available to California residents to publicly disclose on its website documentation that provides, among other requirements, a summary of the datasets used in the development and training of the AI technology or service. The deadline for disclosure is January 1, 2026.

AB 2013 applies both to original developers of generative AI technology or service and any person or entity meeting the definition of “developer” that makes any “substantial modification” to a generative AI technology or service released after January 1, 2022. “Substantially modify,” as defined by the bill, includes new versions, releases, retraining, and fine-tuning that materially changes functionality or performance. Such broad reach could have implications for certain service providers or collaborators that engage in material retraining and/or fine-tuning of an existing generative AI model within the scope of their license.

Notably, AB 2013 does not apply to generative AI technology that is (1) solely designed to ensure security and integrity, (2) solely intended for the operation of aircraft within the national airspace, or (3) developed for national security, military, or defense purposes, and is made available only to a federal entity.

AB 2013 is part of a sweeping package of AI-related bills recently signed into law in California, including requiring state agencies to include disclaimers when using generative AI to communicate with the public (SB 896), banning the use of “deepfakes” in election communications close to a general election day (AB 2839), and combatting online disinformation by requiring large platforms to block or label deceptive election-related content during specified periods before and after an election (AB 2655).

The transparency requirements for generative AI imposed by AB 2013 bears similarity to the EU AI Act. In particular, under the EU law, generative AI will have to comply with transparency requirements and EU copyright law by (1) disclosing that the content was generated by AI; (2) designing the model to prevent it from generating illegal content; and (3) publishing summaries of copyrighted data used for training.

Further, content that is either generated or modified with the help of AI—images, audio, or video files (e.g., deepfakes)—must be clearly labeled as AI-generated so that users are aware when they come across such content. Generative AI developers operating in both jurisdictions may be able to leverage compliance with transparency requirements in the European Union to meet new requirements in California, although they should consult counsel to confirm.

Conclusion

California’s AI legislation is a positive sign, as it demonstrates that one of the world’s most important technology innovation centers is paying acute attention to both the use and potential misuse of AI. The state is willing to require public disclosures regarding the use of generative AI and to regulate specific, targeted risks, such as election misinformation and deepfakes. However, whether more stringent AI safety regulations remains to be seen.

References

Morgan Lewis, October 2024

For a comprehensive list of recently passed California AI bills, read Governor Newsom’s September 29, 2024 press release.