What does California AB 2013 mean for a company that licenses data to AI developers?
Short answer. AB 2013, the Generative Artificial Intelligence Training Data Transparency Act, took effect on January 1, 2026. It requires developers of generative AI offered to Californians to post documentation about the data used to train their systems, including the sources or owners of the datasets and whether they were licensed. A company licensing records to such a developer should agree in the license how its data will be described in that public summary.
General information, not legal advice.
What the law requires
The law added Title 15.2 to the California Civil Code, starting at Section 3110. It applies to a developer of a generative AI system or service made publicly available to Californians, and to substantial modifications of one, for systems released on or after January 1, 2022. Before the system is offered, and again after a substantial change, the developer posts documentation on its own website about the data used to train it.
Section 3111 lists what the documentation covers. The items include the sources or owners of the datasets, how the datasets serve the purpose of the system, the number of data points, a description of the types of data, whether the datasets include material protected by copyright, trademark or patent, whether the datasets were purchased or licensed, whether they contain personal information or aggregate consumer information, any cleaning or processing done, the time period of collection, the dates the datasets were first used, and whether synthetic data was used.
How developers have responded
Several large developers have posted disclosures since the law took effect. Law firm reviews describe them as high level: they name categories of sources, such as public web data, licensed data and data from users, rather than listing each licensor. The statute speaks of a high-level summary, and it does not spell out how detailed each item must be.
An AI developer has challenged the law in federal court, arguing among other things that it forces the release of trade secrets. That challenge was still being decided when this page was written. Enforcement details are also thin, since the statute itself sets no specific penalty, so practice is still forming.
What it means for the company licensing records
A company's records may appear in a developer's public summary in some form, at least as part of a category such as licensed business data. Whether the company itself is named depends on how the developer writes the summary, and the law does not settle that. Many sellers want their name kept out, because a public mention tells competitors what was licensed.
The way to handle it is in the license. The two sides can agree how the dataset will be described, whether the company may be named, and what counts as confidential. A developer has to meet the statute, so the license cannot forbid disclosure the law requires, but it can set the wording and require notice before anything naming the company is published.
Related points to raise early
Two of the listed items connect to other parts of the deal. The question of personal information links to de-identification: if identifiers are removed before delivery, the developer can describe the set accordingly. The question of intellectual property links to ownership: records that include client or vendor material raise questions the developer may have to describe, which is another reason to sort those records out first.
Because the law covers substantial modifications too, a developer that uses licensed records to fine-tune an existing system may need to post documentation for that change. A seller can ask the developer how it plans to describe the data and when the posting is expected. Counsel for each side should read the statute against the draft license.
Follow-up questions
Does AB 2013 apply to my company as the seller?
The duty falls on the developer that offers the generative AI system to Californians. A company supplying records is not the developer, but its data is what gets described, so the license should cover it.
Will our company name be published?
Not necessarily. The law asks for sources or owners of datasets in a high-level summary, and published disclosures so far describe categories. Ask the developer how it will describe the set and agree it in writing.
Does the law apply outside California?
It applies to systems made available to Californians, which includes most large public systems wherever the developer sits. Other places have their own rules, such as the EU AI Act summary of training content.
Didn't find your question? Ask us directly.