California AI Training Data Transparency Act (AB 2013)

The California AI Training Data Transparency Act (AB 2013) requires developers of public generative AI systems to post a summary of their training data on their website. The summary covers twelve topics, from data sources to personal information and synthetic data. It applied from 1 January 2026, and every new release or substantial update needs fresh documentation.

For a lab, most of those twelve answers depend on facts only the data supplier knows. This guide walks through what the law asks, who it covers, where the legal challenge stands, and what to get from a supplier before the data goes into training.

What does AB 2013 require?

It requires a high-level summary of the datasets used to develop a generative AI system. The developer posts it on its own website. The text sits in section 3111 of the California Civil Code.

A developer here is anyone who designs, builds or substantially modifies a generative AI system for public use. A substantial modification includes retraining and fine-tuning. So a team that fine-tunes an open model and offers it to the public has duties too.

The documentation is due before each release, not once. The text of Civil Code section 3111 ties it to "each time thereafter" a system or a substantial modification goes public. That's why it works best as a living record, not a one-off filing.

The documentation must include "a high-level summary of the datasets used in the development of the generative artificial intelligence system or service".

Which systems and dates are covered?

Any generative AI system or service released on or after 1 January 2022 and publicly available to Californians. Developers had to post documentation for those by 1 January 2026.

The look-back matters. A model launched in 2023 and still live in 2026 needed a disclosure too. Paid and free systems are treated the same.

Three kinds of systems are exempt:

• Security and integrity. Systems whose sole purpose is to help keep systems secure.
• Aircraft. Systems whose sole purpose is operating aircraft in national airspace.
• Defence. Systems built for national security, military or defence purposes and offered only to a federal entity.

Everything else open to the public is in scope. That includes chat assistants, image generators and coding tools.

What are the 12 items in an AB 2013 disclosure?

The law lists twelve topics. The middle column shows who usually holds the answer when the data is licensed from an outside supplier.

Seven of the twelve rest wholly or partly on the supplier. If a delivery arrives without those facts, the lab has to reconstruct them later. That's slow and often impossible.

Items 7 and 8 use California's privacy law definitions. Personal information is data that can be linked to a person or household. Aggregate consumer information is data about groups that can't reasonably be linked to anyone.

What should a lab ask a data supplier because of AB 2013?

Ask for the facts behind the seven supplier items, in writing, with each delivery. The cleanest way is a datasheet that ships with the files.

1. Origin. Which organisations produced the data, and under what agreement the supplier holds it.
2. Volume. Record counts per source and type, before and after the supplier's filtering.
3. Record types. What a record is (a thread, a ticket, a commit) and which labels it carries.
4. Rights. Whether third-party copyright or trademarks are present, and how the licence covers them.
5. Personal data. What was removed or replaced, by which method, and what residual risk remains.
6. Processing. Every cleaning step, with its purpose, in the order applied.
7. Collection window. First and last dates of the records, and whether new data will follow.

Our datasheet template for licensed datasets has a field for each of these. The de-identification checklist covers what evidence to ask for under point 5. And if the data is chat, the Slack thread dataset schema shows where dates and counts live in each record.

Put it in the contract

A promise to "provide documentation" is too vague. Name the fields, the format and the deadline. Add a duty to update the datasheet if the supplier later finds an error. The procurement guide covers the other clauses a licence should carry.

Keep your own log

Items 2, 6, 11 and 12 are yours. Record the date each dataset first enters a training run. Note any synthetic data you generate from it. A simple log per model version saves a scramble before each release.

What do published AB 2013 disclosures look like?

Short, and general. OpenAI and Anthropic both posted documents titled after section 3111, according to a January 2026 client alert from the law firm Goodwin. Neither named specific datasets. Both described broad categories, such as publicly available information and synthetic data.

That reflects a gap in the law. It asks for a "high-level summary" but doesn't define how high. There's no official guidance yet on where a summary ends and a trade secret begins.

For a lab buying licensed enterprise data, that gap cuts both ways. You can describe a supplier's data in general terms. But you still need the underlying facts, in case a regulator or court asks what "licensed business records" actually means.

Is AB 2013 being challenged in court?

Yes. xAI sued California's Attorney General on 29 December 2025. It argues the law takes trade secrets without compensation, compels speech and is too vague.

On 4 March 2026 Judge Jesus G. Bernal denied xAI's request to block the law while the case runs. The court's order found xAI hadn't shown it was likely to win on any of the three claims. xAI appealed to the Ninth Circuit, where oral argument is set for 18 November 2026.

Until a court rules otherwise, the law applies. xAI itself published what it called a "high-level, limited disclosure" on 30 December 2025, the day after it sued.

How does AB 2013 compare with the EU AI Act summary?

They ask similar questions for different audiences. The EU AI Act requires providers of general-purpose AI models to publish a summary of the content used for training. AB 2013 applies to any public generative system offered to Californians, large or small.

A lab selling in both markets can build one internal record and publish two views of it. Our hub on EU AI Act training data documentation sets out what to ask suppliers for the European side.

What does AB 2013 not require?

It doesn't require model weights, source code or architecture details. It doesn't require a lab to publish the data itself. And it doesn't set a format, so each developer chooses its own layout.

It also doesn't ban any kind of training data. The law is about telling the public what went in, not about what may go in. Rules on personal data and copyright still come from other laws.