Not legal advice, just a plain-English map of what each law actually requires and where people are most likely to misjudge their own exposure.
Quick disclaimer before anything else: this is not legal advice. It’s a plain-English map of what two laws actually say, written by someone who read the primary sources, not a lawyer reviewing your specific situation. If either law might genuinely touch your business, the next step is a real conversation with counsel, not a blog post.
With that out of the way: on August 2, 2026, two AI transparency laws became applicable on the same calendar day, one European, one Californian, drafted by different governments for different reasons, sharing almost nothing except the subject and, apparently, the date. Article 50 of the EU AI Act is about telling people when they’re talking to a machine or looking at synthetic content. SB 942, California’s AI Transparency Act, is about large AI providers offering a way to detect and label the content their tools generate. Different mechanisms, different targets, same Tuesday.
The coincidence is genuinely interesting and worth naming, but it’s also easy to read too much into it. These aren’t two halves of one coordinated policy. They don’t reference each other, and complying with one says nothing about the other. What they share is that both are now live, both carry real obligations, and most of the coverage of either one has been either too technical to act on or vague enough to be useless.
| EU AI Act, Article 50 | California SB 942 | |
|---|---|---|
| What it covers | AI systems that interact with people, synthetic content (image/audio/video/text), deepfakes, emotion recognition | Detection and labeling tools for AI-generated image, video and audio specifically |
| Who’s obligated | Providers (build the system) and deployers (use it), depending on the duty. No size threshold on most duties. | “Covered providers”: generative AI systems with over 1,000,000 monthly users or visitors, publicly accessible in California |
| Effective date | August 2, 2026 | Phased: Aug 2, 2026 (covered providers); Jan 1, 2027 (large platforms); Jan 1, 2028 (capture devices) |
| Penalty | Set under each member state’s own enforcement regime, not specified as one EU-wide figure in Article 50 itself | $5,000 per violation, counted per day of continued noncompliance |
The biggest practical difference: Article 50 has almost no size floor. SB 942 has a specific, checkable one.
Article 50 isn’t one rule. It’s four separate disclosure duties bundled under one article, and they land on different parties depending on which one applies:
If you provide an AI system that interacts directly with people, a chatbot, a voice assistant, anything a person might reasonably mistake for a human, you have to design it so the person is told they’re talking to a machine, unless that’s already obvious from the context.[1] If you provide a system that generates synthetic audio, image, video or text, the output has to carry a machine-readable mark showing it was AI-generated, as far as that’s technically feasible. That marking duty sits with whoever builds the generative tool, not usually with the business using it day to day.
Two more duties land on deployers specifically, the people using an AI system rather than building it, and neither has a size threshold. If you publish or share a deepfake, content that’s been AI-generated or manipulated to resemble a real, identifiable person, place or event in a way that would falsely look authentic, you have to disclose that it’s artificial. And if you deploy AI to generate text on a matter of public interest and publish it without meaningful human editorial review, you have to disclose that too.
Under Article 50, the duties that carry no size threshold fall on whoever deploys the content, not just whoever built the AI. A small business is a deployer far more often than it’s a provider.
Worth being precise here, because it’s where people tend to overclaim: not every AI-generated marketing image is a “deepfake” under this law. The deepfake duty is specifically about content resembling a real, identifiable person, place or event. A generated stock-style photo of a generic office scene isn’t caught by that definition. A manipulated video that looks like a real customer or a real executive is.
SB 942 works differently. Instead of a disclosure duty that reaches anyone deploying AI, it puts a specific, technical set of obligations on a specific, narrow group: “covered providers,” defined as generative AI systems with more than 1,000,000 monthly users or visitors, publicly accessible to people in California.
If you clear that threshold, three things become mandatory.[2] You have to maintain a free tool that lets anyone check whether a piece of image, video or audio content was created or altered by your system. You have to offer a visible, “manifest” disclosure option for AI-generated media. And where it’s technically feasible, you have to embed a “latent,” machine-readable provenance mark in the content itself, the kind that survives a screenshot even if the visible label doesn’t.
The phasing matters too. Covered providers were on the hook from August 2, 2026. Large online platforms and generative AI hosting platforms have to start detecting and preserving that provenance data, not stripping it out, from January 1, 2027. Capture device manufacturers, cameras and phones, effectively, have to build latent-disclosure options in by default starting January 1, 2028. A penalty of $5,000 applies per violation, and every day a covered provider stays out of compliance counts as a separate violation.[2]
One scope detail worth flagging clearly: SB 942 is about image, video and audio. It doesn’t specifically target chatbots or text-based systems the way Article 50 does. A generative text tool with a million California users isn’t automatically a “covered provider” under this particular law, even though it might well be a “provider” with real obligations under Article 50 if it interacts with EU users.
A pending bill worth watching, not acting on yet: SB 1000 would remove SB 942’s 1,000,000-user threshold entirely, which would pull far more businesses into “covered provider” status if it passes. It hasn’t, as of this writing, so treat it as a reason to keep watching this space, not as current law.
Here’s the pattern in how people get this wrong, and it runs in a consistent direction: they check SB 942’s 1,000,000-user threshold, correctly conclude they’re nowhere near it, and stop there, assuming that settles both laws. It settles one of them. Article 50’s deployer-side duties, the deepfake disclosure and the public-interest AI-text disclosure, don’t ask how many users you have. They ask what you published and whether it’s the kind of content the law covers.
| Question | If yes |
|---|---|
| Do you build or sell a generative AI model or tool, rather than just use one? | You may be a “provider” under both laws; the marking and detection duties are yours, not your customers’ |
| Do you run a chatbot or AI assistant that talks to EU visitors? | Article 50’s “tell them it’s AI” duty likely applies to you as a deployer |
| Have you published AI-generated video or images depicting a real, identifiable person, place or event? | Article 50’s deepfake disclosure duty likely applies, no size threshold |
| Have you published AI-written text on a public-interest topic without a human editor reviewing it first? | Article 50’s public-interest-text disclosure duty likely applies |
| Does your own generative AI tool clear 1,000,000 monthly California users? | SB 942’s detection-tool and disclosure duties likely apply to you directly |
Most small businesses will hit at least one “yes” in the top four rows and none in the bottom one. That’s the exposure pattern this article is about.
None of this means every small business is suddenly a compliance target. It means the honest self-check has to include the no-threshold questions, not stop at the one number that’s easiest to check and easiest to clear.
Say a small business runs a customer-support chatbot built on a third-party AI platform, publishes a few AI-assisted product photos each month, and occasionally uses AI to draft a blog post. None of that puts them anywhere near SB 942’s million-user threshold. Two things still apply.
| What the business does | What applies | Who’s actually responsible |
|---|---|---|
| Runs a third-party AI chatbot for EU-facing customer support | Article 50’s “tell them it’s AI” duty | Usually the platform vendor, as provider, builds the disclosure in; the business, as deployer, has to not turn it off |
| Publishes AI-assisted generic product photos | Likely nothing under either law, if the images don’t depict a real, identifiable person or place falsely | N/A |
| Publishes an AI-manipulated video resembling a real person | Article 50’s deepfake disclosure duty | The business, as deployer, has to disclose it |
| Publishes an AI-drafted post on a public-interest topic with no human review | Article 50’s public-interest-text disclosure duty | The business, as deployer, has to disclose it |
The chatbot and the generic product photos are usually the least of the exposure. The unreviewed public-interest post and the realistic manipulated video are where the actual duty lands.
The through-line: reputable AI vendors, chatbot platforms, image generators, tend to already build in the disclosures they’re required to provide as providers, since that’s their own obligation, not yours to build. Your job as the business using their tool is narrower and more specific: don’t disable a disclosure that’s already there, and handle the two deployer-side duties, deepfakes and unreviewed public-interest text, yourself, since no vendor can do that part for you.
Don’t assume your AI tool’s compliance covers yours. Ask directly what disclosures it builds in, and confirm you haven’t switched any of them off.
None of this requires a legal team on retainer to start. A short, concrete checklist gets most small businesses most of the way there:
One more time, because it matters more here than in most of what we write: this is not legal advice. It’s a starting map, not a compliance program. If your business genuinely touches EU users, publishes synthetic media at scale, or operates a generative AI tool anywhere near SB 942’s threshold, the next step is a conversation with a lawyer who can look at your actual facts, not another article.
Start smaller than that if it turns out neither law clearly applies yet. Run the self-check table above once, this month, note what you’re actually exposed to, and revisit it when the next phased deadline, January 1, 2027, gets closer.
Article 50 is the transparency section of the EU AI Act. It requires providers of AI systems that interact directly with people to make sure people are told they’re talking to a machine, requires providers of generative AI tools to mark synthetic output as AI-generated where technically feasible, and requires deployers, the people using AI rather than building it, to disclose deepfakes and AI-generated text published on public-interest topics without human review. It became applicable on August 2, 2026. This is a plain-English summary, not legal advice.
SB 942 requires “covered providers,” generative AI systems with more than 1,000,000 monthly users or visitors accessible in California, to maintain a free tool letting people check whether image, video or audio content came from their system, offer a visible disclosure option for AI-generated media, and embed a machine-readable provenance mark where technically feasible. It phases in obligations for large platforms in 2027 and capture device manufacturers in 2028, with a $5,000 per-violation, per-day penalty for covered providers who don’t comply.
SB 942’s specific obligations apply only to “covered providers” clearing the 1,000,000 monthly user threshold, which the overwhelming majority of small businesses using AI tools don’t meet. That threshold doesn’t mean a small business has no exposure to AI transparency law at all, though: the EU AI Act’s Article 50 has separate deployer-side duties, around deepfakes and unreviewed public-interest AI text, that carry no size threshold and can apply regardless of company size.
If the chatbot interacts with people in a way that isn’t already obvious as AI, and it reaches users in the EU, Article 50 requires that people be told they’re interacting with a machine. In practice, this duty usually falls on whoever provides the underlying AI system to build the disclosure in; if you’re using a third-party chatbot platform, check whether that disclosure is already built in by default, and don’t switch it off.
Article 50 of the EU AI Act became applicable August 2, 2026. SB 942 phases in over three stages: covered providers were obligated starting August 2, 2026, large online platforms and generative AI hosting platforms face provenance-detection duties starting January 1, 2027, and capture device manufacturers must build in latent-disclosure defaults starting January 1, 2028.
The EU AI Act Article 50 requirements in this guide are checked against the regulation’s own operative article text, reproduced by artificialintelligenceact.eu, and cross-referenced for the applicability date. The SB 942 requirements and phased dates are checked against a law-focused compliance tracker, aicomplianceatlas.com, after California’s own legislative information site blocked automated access; the same dates were independently corroborated by two other legal-industry sources found in the same research pass. This guide is not legal advice and doesn’t cover every provision of either law; a business with real exposure should consult a qualified attorney about its specific facts.
Weekly tips. Real examples. Practical help for busy professionals.
We care about your data, check out our privacy policy.