Do we post this in the product or on the corporate site?

On the developer’s internet website. A /legal/training-data page linked from the product footer is the usual pattern. The template page is a starting file.

What if a field is unknown?

The statute lists the fields; it does not create an “unknown” checkbox. If you cannot name a source or a date, that is a gap in your own records — the readiness report will flag it as an engineering gap, not as a legal conclusion.

Does AB 2013 apply to my SaaS? Training-data disclosure fields

AB 2013 is a website-documentation duty, not an in-product banner. If you are the developer of a generative system released on or after 1 January 2022 and you make it publicly available to Californians, Civil Code § 3111 wants a high-level summary of the datasets you used — twelve numbered fields — posted on or before 1 January 2026 and again before each substantial modification.

Educational resource only — not legal advice. scm.cc publishes a readiness report and engineering gap analysis for AI features. It does not give legal advice, represent you before a regulator, or state that a product is ready to ship under any law. This page is educational product guidance, not legal advice. It is not a readiness report, not an engineering gap analysis of your systems, and not a determination that any product meets a legal duty. Confirm current official text before you ship.

Last checked against official sources: 2026-10-11.

A yes/no path for a SaaS team

1. Do you design, code, produce, or substantially modify a generative AI system or service for members of the public (3110(b), (c), (d))? 2. Was that system or a substantial modification released on or after 1 January 2022? 3. Is it publicly available to Californians, paid or free? If all three are yes, post the § 3111 summary. If you only call a third-party API and have not substantially modified the system, you are usually not the developer — document that decision.

How to fill the fields without leaking a trade secret

The statute asks for a high-level summary, ranges, and yes/no flags (personal information, aggregate consumer information, purchased or licensed, synthetic data). It does not ask for raw dumps or prompt logs. “Licensed web-scale crawl, 2023–2025, includes personal information, not entirely public domain” is the register the statute is written in. “Dataset v3.4 internal path” is not.

When to update

Before each substantial modification made available to Californians. 3110(d) defines that as a new version, new release, or other update that materially changes functionality or performance, including the results of retraining or fine tuning. A copy edit to your marketing site is not a trigger. A new fine-tune is.

Questions teams ask

Do we post this in the product or on the corporate site?: On the developer’s internet website. A /legal/training-data page linked from the product footer is the usual pattern. The template page is a starting file.
What if a field is unknown?: The statute lists the fields; it does not create an “unknown” checkbox. If you cannot name a source or a date, that is a gap in your own records — the readiness report will flag it as an engineering gap, not as a legal conclusion.

Back to the AI law hub

Primary sources

Official text wins. Last checked 2026-10-11. This page is educational product guidance, not legal advice. It is not a readiness report, not an engineering gap analysis of your systems, and not a determination that any product meets a legal duty. Confirm current official text before you ship.