If your business uses AI to make images or video for social media, something changes on January 1, 2027. Instagram, YouTube, TikTok, X and the other large platforms will have to read the provenance data inside your files and show viewers whether the content was made by AI or captured on a camera. You won't be the one breaking the law if they don't. But your customers will see the label, and the question it raises lands on you: what does your own website say about the same content?
This post explains the law in plain English, who it actually binds, and what a small business should do before the labels appear.
The law in three tiers
California's AI Transparency Act (Business and Professions Code section 22757 and following, from SB 942, amended by AB 853 in 2025) works on the whole chain that AI content moves through. Our law page tracks the text and dates.
| Who | What they must do | From |
|---|---|---|
| AI providers with over 1 million monthly users (OpenAI, Google, Adobe and similar) | Embed a hidden, machine-readable provenance disclosure in every generated image, audio clip and video; offer a free detection tool; offer an optional visible label | August 2, 2026 |
| Large online platforms with over 2 million monthly users (social media, file sharing, mass messaging, search) | Detect standards-based provenance data in content they distribute; show viewers whether it was AI-made or camera-captured and let them inspect the data; not strip the data or its digital signature | January 1, 2027 |
| Camera and phone makers selling in California | Embed provenance in captured photos and video, on by default | January 1, 2028 |
Enforcement is by the California Attorney General and city and county attorneys at $5,000 per violation, with each day counted separately. There is no private right of action. The platform duties are in section 22757.3.1 of the Business and Professions Code.
Who it binds, and who it doesn't
The obligated parties are the AI companies, the platforms and the device makers. A dental practice, a home care agency or a law firm posting an AI-made image is not a covered provider or a large online platform. The Act does not require you to label anything.
So why does it matter to you? Because from 2027 the label will be applied for you, in public, by the platform, whether you chose it or not. The provenance data is put there by the tool you used, and the platform is required to read it and say so. A customer who sees "made with AI" under your before-and-after photo, your product shot or your video testimonial will form a view. Better that the view matches what your own website and ads say.
What happens to your files today
Most AI image and video tools from the large providers already embed provenance data, usually in the C2PA "content credentials" format, and have had to since August 2026. That data travels with the file. Two things routinely happen to it:
- Your website or CMS strips it. Many upload pipelines resize images and throw away metadata. The image on your site then says nothing about how it was made, which is not illegal for you, but means your own site is silent where the platforms will speak.
- The platform keeps it and shows it. From 2027 that is the rule for the big platforms. Screenshots and re-uploads may lose it, but content you upload directly will carry it.
The AI content register in BotNotice reads this data on the images and video on your site, so you can see which of your published files declare an AI origin and which are silent.
What to do before 2027
- Take an inventory. Know which images and video on your site, in your ads and in your social feeds were made or substantially altered by AI. The register does this automatically for your website.
- Decide your own label. You are not required to label, but a customer who sees a platform label and then finds nothing on your site will notice the gap. A short, honest note ("image created with AI") is enough. Our disclosure examples page has wording.
- Keep the provenance data. Ask whoever runs your site whether uploads preserve metadata. Keeping it costs nothing and matches the Act's "do not strip" principle, which our law page lists as a duty to adopt even where it is not yet yours.
- Be careful with people. AI images of real staff, patients or customers, and AI voices, raise separate issues under state right-of-publicity and deception rules, well beyond this Act. The state-by-state index shows which rules reach you.
- Keep a record. If a customer or regulator ever asks what you disclosed and when, a dated record answers it. Our page on how the disclosure record works explains the version BotNotice keeps.
Frequently asked questions
I'm not in California. Does any of this apply?
The platforms are bound wherever their users are, so the labels will appear on your posts regardless of where your business sits. The Act's duties fall on the platforms and providers, not on you, in any state.
Will the label say "fake"?
No. The Act requires the platform to show whether provenance data exists and what it says: that the content was generated or altered by a named AI system, or captured by a named device. It is a statement of origin, not a judgment.
If I edit an AI image in Photoshop, is it still labeled?
If the editing tool preserves or updates the content credentials, yes, and the credentials will show the history of changes. If the tool strips them, the platform has nothing to read. Either way, the honest position is to say what you used.
Do I have to add a visible label to AI images on my own website?
Not under this Act. Some advertising and deception rules, and a few state laws for specific uses, can require it. When in doubt, a plain note costs nothing and removes the argument.
Not legal advice. The statute text linked from our law page is the authority, and the operative dates above are the ones written into it as of September 2026.
