California AB 2013 training-data transparency requirements

Who is a developer

Section 3110(b): a developer is a person, partnership, state or local government agency, or corporation that designs, codes, produces, or substantially modifies an AI system or service for use by members of the public. Affiliates and a hospital’s medical staff members are carved out of “members of the public.” If you only wrap someone else’s hosted API and do not design, code, produce, or substantially modify the system, you may not be the developer — but fine-tuning, a new release, or a material change in functionality is a substantial modification (3110(d)) and can make you one.

Which systems

Generative AI (3110(c)) is AI that can generate derived synthetic content — text, images, video, audio — that emulates the structure and characteristics of its training data. The duty attaches to a system or service, or a substantial modification, released on or after 1 January 2022 and made publicly available to Californians, whether or not anyone pays.

The twelve dataset fields

Section 3111(a) requires a high-level summary of the datasets used in development, including: (1) sources or owners; (2) how the datasets further the intended purpose; (3) number of data points, which may be ranges, with estimates for dynamic sets; (4) types of data points (labels, or general characteristics if unlabeled); (5) whether the datasets include copyright, trademark, or patent-protected data, or are entirely public domain; (6) whether the datasets were purchased or licensed; (7) personal information as defined in Civ. Code § 1798.140(v); (8) aggregate consumer information as defined in § 1798.140(b); (9) any cleaning, processing, or other modification by the developer and why; (10) collection time period, including a notice if collection is ongoing; (11) dates the datasets were first used in development; (12) whether the system used or continuously uses synthetic data generation, with an optional description of why.

Exemptions in 3111(b)

A developer does not have to post the documentation for a generative system whose sole purpose is security and integrity (as defined by cross-reference to § 1798.140), whose sole purpose is operation of aircraft in the national airspace, or that was developed for national security, military, or defense purposes and is made available only to a federal entity. A chatbot that also happens to filter spam is not a “sole purpose” security system.

Questions teams ask

Is there a state filing, or just a website post?

Section 3111 says the developer shall post the documentation on the developer’s internet website. It does not create a California AG registration portal in the statute we last checked.

We released the model in 2021 and have not modified it. Are we in?

The duty is limited to systems or substantial modifications released on or after 1 January 2022. A frozen 2021 release that you have not substantially modified is outside that clause — confirm you have not shipped a new version, fine-tune, or material functionality change.

Does wrapping OpenAI or Anthropic make us the developer?

Only if you design, code, produce, or substantially modify the system for public use. A thin prompt wrapper is usually not a substantial modification. A fine-tune, a new release, or a change that materially changes functionality or performance can be. Read 3110(b) and (d).

Related pages

• Does AB 2013 apply to my SaaS? Training-data disclosure fields
• AB 2013 training-data disclosure template