California SB 942: the Free Provenance Detection Tool

加州 SB 942 法案：免费溯源检测工具

SB 942 is usually summarised as a watermarking law. Half of it is. The other half tells you to build and operate a public service that answers the question “did your system make this?” about a file a stranger uploads — free, at whatever volume arrives, with an API. That is a product, not a metadata field, and it is the part that takes engineering time.

SB 942 法案通常被概括为一项水印法案。这只说对了一半。另一半要求你构建并运营一项公共服务，用于回答陌生人上传的文件“是否由你的系统生成”这一问题——该服务必须免费、能够处理任何流量，并提供 API。这是一个产品，而不仅仅是一个元数据字段，这正是需要投入工程时间的部分。

Who is a covered provider

谁是受监管的提供商

SB 942, the California AI Transparency Act, was enacted in 2024 and added a new chapter to the California Business and Professions Code. It does not apply to everyone shipping a model. It reaches a covered provider: broadly, a person who creates, codes or otherwise produces a generative AI system that is publicly accessible in California and has above a stated monthly user threshold — one million, on the enacted text. Below that line the chapter does not bite at all, which is why the practical population of covered providers is small and consists almost entirely of companies you can name.

《加州人工智能透明度法案》（SB 942）于 2024 年颁布，并在《加州商业和职业法典》中增加了新章节。它并不适用于所有发布模型的公司。它针对的是“受监管的提供商”：广义上指在加州公开提供生成式 AI 系统，且月用户数超过规定阈值（根据已颁布文本为 100 万）的个人或实体。低于该门槛则不受此章节约束，这就是为什么实际受监管的提供商群体很小，且几乎全部由知名大公司组成。

The threshold is doing real work and it is worth reading the operative definition rather than a summary of it, because “monthly visitors or users” is not the same measure as monthly active accounts, and a system embedded in somebody else’s consumer product can cross it without the provider tracking that number in the form the statute uses. This page describes what the statute requires. It is not legal advice, and whether your system is a covered generative AI system under the chapter is a question about your product and your user numbers that you should put to counsel on your own facts.

这一阈值设定至关重要，建议阅读具体的法律定义而非摘要，因为“月访问者或用户”与“月活跃账户”的衡量标准不同。如果一个系统嵌入在其他人的消费产品中，它可能会在提供商未按法规要求追踪该数据的情况下跨越这一门槛。本文档描述了法规的要求，但这并非法律建议。你的系统是否属于该章节下的受监管生成式 AI 系统，取决于你的产品和用户数据，你应该根据自身情况咨询法律顾问。

What the tool has to do

工具必须实现的功能

The detection duty is stated separately from the disclosure duty, and it has its own list of acceptance criteria. Read as a specification, the tool must: Be free and publicly accessible. Not free for customers, not free behind a sign-up. There is no fee limb and no rate-limiting limb in the statute, which means capacity planning is your problem rather than the reader’s.

检测义务与披露义务是分开陈述的，并有其独立的验收标准。作为技术规范，该工具必须：免费且公开可访问。不能仅对客户免费，也不能要求注册后才能使用。法规中没有关于收费或限流的条款，这意味着容量规划是你的责任，而非用户的问题。

Accept content and return an assessment of whether the content was created or altered by the provider’s own system. Note the scope: your system, not generative AI in general. You are not being asked to build a universal detector, and a page that says you are has misread the chapter.

接收内容并返回该内容是否由提供商自身系统创建或修改的评估结果。请注意范围：是“你的系统”，而非通用的生成式 AI。你不需要构建一个通用的检测器，任何声称你需要这样做的页面都是对该章节的误读。

Output system provenance data where it finds a disclosure — the identifying information the latent disclosure carries, which on the enacted text includes the provider’s name, the name and version of the system, and the time and date the content was created or altered.

在发现披露信息时输出系统溯源数据——即潜在披露信息所携带的识别信息。根据已颁布的文本，这包括提供商名称、系统名称及版本，以及内容创建或修改的时间和日期。

Support an application programming interface, so the check can be performed by another service rather than only by a human with a browser.

支持应用程序编程接口（API），以便检测可以由其他服务执行，而不仅仅是由人类通过浏览器进行。

Report its own uncertainty. The result is expressed as the extent to which it is likely that the content was created or altered by the system, not as a yes or a no. That last criterion is the one people skip and it changes the interface design. A detector that returns a boolean is out of specification; the statute contemplates a confidence-bearing answer, which means you have to decide what a low-confidence answer looks like and what a user is told when the file has been re-encoded past recognition.

报告自身的不确定性。结果应以内容由该系统创建或修改的可能性程度来表示，而不是简单的“是”或“否”。最后这一标准常被人们忽略，但它会改变界面设计。返回布尔值的检测器不符合规范；法规要求的是带有置信度的回答，这意味着你必须决定低置信度的回答是什么样子的，以及当文件被重新编码到无法识别时应告知用户什么。

The line it must not cross

不可逾越的红线

The chapter also tells the tool what not to emit. It must not output personal provenance data — the information that would identify the individual user who generated the content, as opposed to the system that generated it. This is the provision that stops the detection tool becoming a deanonymisation service, and it constrains the latent disclosure too: whatever you embed has to be sufficient to identify the system and the moment, and insufficient to identify the person.

该章节还规定了工具不得输出的内容。它不得输出个人溯源数据——即能够识别生成内容的个人用户的信息，而非生成内容的系统信息。这一条款防止了检测工具成为去匿名化服务，同时也限制了潜在披露信息：你嵌入的任何内容必须足以识别系统和时间，但不足以识别个人。

If you have ever designed a watermark that encodes a per-request identifier for abuse investigation, this is a direct conflict with the public tool, and the resolution is architectural. The identifier can exist in your own logs keyed to an opaque token in the disclosure; the public tool resolves the token to system-level facts only. Building one payload and one lookup path for both audiences is how a provider ends up shipping something out of compliance.

如果你曾设计过用于滥用调查的、编码了单次请求标识符的水印，这与公共工具存在直接冲突，解决方法在于架构设计。标识符可以存在于你自己的日志中，并与披露信息中的不透明令牌相关联；而公共工具仅将令牌解析为系统级事实。为两类受众构建同一个负载和查询路径，会导致提供商最终交付的产品不合规。

Why this is the hard half

为什么这是困难的一半

The disclosure duty is bounded work: you emit a manifest and you embed a latent signal, both qualified in the statute by technical feasibility. The detection duty is unbounded, because the input is whatever the public uploads. A screenshot of a generated image, a video re-encoded twice by two social platforms, an image cropped to a face, a PNG converted to JPEG at quality 60 — every one of these destroys embedded metadata, and most of them degrade a robust watermark.

披露义务是有限的工作：你发布一份清单并嵌入一个潜在信号，两者在法规中都以“技术可行性”为前提。而检测义务是无限的，因为输入内容是公众上传的任何东西。生成图像的截图、被两个社交平台二次编码的视频、裁剪到人脸的图像、转换为 60 质量的 JPEG 的 PNG 文件——所有这些都会破坏嵌入的元数据，且大多数会削弱稳健的水印。

So the tool’s real behaviour is a two-tier answer. Where the manifest survives, you can state provenance with high confidence and echo the system provenance fields. Where it does not, you are relying entirely on the latent signal, and the honest output is a probability with a stated basis. There is a third case worth designing for explicitly: content your system did generate, from which every signal has been stripped. The tool cannot distinguish that from content your system never touched, and saying so plainly in the interface is better than a negative that reads as a denial.

因此，该工具的实际行为应是两级回答。当清单存在时，你可以高置信度地说明溯源并回显系统溯源字段。当清单不存在时，你完全依赖潜在信号，诚实的输出应是一个带有依据的概率。还有第三种情况值得明确设计：你的系统确实生成了内容，但所有信号都被剥离了。工具无法将其与你的系统从未触及的内容区分开来，在界面中明确说明这一点，比给出一个看起来像是“否认”的否定回答要好。

The related duty on licensees is the other operational surprise. Where a third party licenses the system and modifies it so that it no longer includes the required disclosures, the chapter requires the licence to be revoked within a short window — 96 hours on the enacted text — and requires the provider to stop supplying the licensee until capability is restored. That is a contractual and monitoring obligation that has to exist in your licence agreements before it is needed, not after. See the general shape of AI contract clauses for where it sits.

对被许可方的相关义务是另一个运营上的意外。如果第三方获得系统许可并对其进行修改，导致其不再包含必要的披露信息，该章节要求在短时间内（已颁布文本为 96 小时）撤销许可，并要求提供商停止向被许可方提供服务，直到恢复相关功能。这是一种合同和监控义务，必须在需要之前就写入你的许可协议中，而不是事后补救。请参考 AI 合同条款的一般格式以了解其位置。

Dates, amendments and enforcement

日期、修订与执行

SB 942 as enacted carried a 1 January 2026 operative date. It was amended in the 2025 session by AB 853, which moved compliance dates and extended related duties beyond the original covered-provider clause.

SB 942 法案颁布时规定的生效日期为 2026 年 1 月 1 日。该法案在 2025 年会议期间通过 AB 853 进行了修订，调整了合规日期，并将相关义务扩展到了最初的受监管提供商条款之外。