An example of how to comply with California's AI Transparency Act using JPEG Trust

What the law requires

The principal duties apply to a covered provider — a producer of a publicly accessible generative AI system available to people in California with more than one million monthly users. JPEG Trust itself is a compliance technology provider rather than the regulated party.

Latent vs manifest disclosure

The Act draws a sharp line between the hidden, mandatory machine-readable disclosure and the visible label that providers must offer to users. JPEG Trust should support both — not hidden metadata alone.

Phased timeline

Obligations roll out in three waves. The provider duties begin alongside EU AI Act Article 50; platform and device duties follow.

How JPEG Trust supports it

The four mandatory latent-disclosure fields map cleanly onto C2PA / CAWG assertions that JPEG Trust already embeds and verifies.

Python example: embed AI provenance

from jpegtrust import embed_image, create_profile, save_profile

# 1. Create a California latent-disclosure profile
profile = create_profile(template="ai-labelling", name="CA AI Transparency Act")
save_profile(profile, "ca_transparency.yml")

# 2. Embed the latent-disclosure fields. ca_metadata.json holds the
#    declaration assertions, for example a c2pa.actions.v2 action with
#      "action": "c2pa.created",
#      "when": "2026-08-02T14:30:00Z",                             # date and time
#      "softwareAgent": {"name": "AcmeDiffusion", "version": "3.2"}  # system
#    and a cawg.identity or CreativeWork assertion naming the provider.
embed_image(
    "ai_output.jpg",
    "ca_metadata.json",
    "disclosed_output.jpg",
    digital_source_type="trainedAlgorithmicMedia"
)

Backing the public detection tool and API

A browser extension alone will not satisfy the detection-tool requirement. A covered provider also needs a public verification service with an API — which JPEG Trust can back, returning a privacy-filtered, machine-readable result.

# Covered providers must expose a public detection API.
# JPEG Trust can back that endpoint with signature verification:
jpegtrust verify disclosed_output.jpg ca_transparency.yml --format json

# Returns the machine-readable verification report, including
#   "status", "ai_label" (e.g. "trainedAlgorithmicMedia"),
#   "passed", "failed", "passed_checks", "total_checks" and "c2pa"

How JPEG Trust can verify a disclosed image

Downstream consumers — platforms, newsrooms, regulators — can check an image against the California profile to confirm the latent disclosure is present and valid.

Who is responsible for what

The covered provider remains the regulated party. JPEG Trust supplies the technical components for the disclosure and verification duties.

Limitations

• JPEG Trust does not host the public-facing detection service or its retention and feedback policies — the provider must operate those.
• Training-data transparency under AB 2013 is a separate obligation that provenance on output images cannot satisfy.
• C2PA alignment is conceptually strong, but the statute does not name C2PA; do not claim automatic legal compliance.
• Whether a visible label is "clear and conspicuous" is a legal determination, not a technical one.

Get started

JPEG Trust is available as a Python package, a browser-based tool, and an HTTP API. Choose the integration that fits your workflow.