What California's AI transparency rules require of businesses
Disclosure obligations now attach to automated systems that interact with people or make consequential decisions. The duties are narrower than the debate suggests.
California regulates artificial intelligence through several narrow statutes rather than one broad act, which is why compliance questions rarely have a single answer.
Bot disclosure
Where an automated account communicates with a person in California to incentivise a purchase or influence a vote, and does so in a way likely to mislead about its artificial identity, disclosure is required. The disclosure must be clear and conspicuous.
The obligation targets deception rather than automation. A chat widget obviously presented as automated support is not the target; one presented as a named human agent is.
Training data transparency
Developers of certain generative systems made available to Californians face obligations to publish documentation about the datasets used — sources, whether personal information is included, whether the data is licensed.
This is a developer obligation, not a deployer one. A business using a third-party model is generally not the one publishing that documentation, but should ask its vendor whether the vendor has.
Automated decisions under privacy law
Where automated processing is used to make decisions producing significant effects — employment, credit, housing, essential services — privacy regulations create access and opt-out rights, and require meaningful information about the logic involved.
“If a model decides who gets an interview, that is a regulated decision, not an internal tool.”
Practical points
- Inventory where automated systems touch consumers. Most businesses underestimate this.
- Label automated interfaces plainly.
- Ask vendors for their documentation in writing and keep it.
- Keep a human review path for consequential decisions, and be able to describe it.
