Training Data Disclosures for Generative AI: AB 2013 Compliance Guide

You built a powerful model. It generates text, images, or code that feels almost human. But if you released it in California after January 1, 2026, you might be missing something critical on your website. Not a bug fix. Not a feature update. A disclosure.

California Assembly Bill No. 2013 (AB 2013) is a state law requiring developers of generative AI systems to publish high-level summaries of their training data. It went into effect on January 1, 2026. If you didn't post this documentation, you're already out of compliance.

This isn't just bureaucratic noise. It’s the first binding transparency mandate specifically targeting generative AI in the US. The law forces companies to answer questions users have been asking for years: What data did you use? Did you scrape copyrighted books? How much personal information is in there?

Let's break down what you actually need to do, how to protect your trade secrets while complying, and why xAI is suing over it.

What AB 2013 Actually Requires

Forget vague "transparency principles." AB 2013 lists exactly what must be disclosed. If you design, code, produce, or substantially modify a generative AI system available to Californians, you fall under this law. This applies whether your tool is free or paid.

The core requirement is simple: publish a summary of your training data on your public website. You must do this when you release a new model or make significant updates to an existing one. The law doesn't ask for your raw datasets. It asks for context.

Here are the 12 specific categories you must cover:

• Sources and owners of the data.
• Number of data points (approximate ranges are fine).
• Types of data (text, image, audio, etc.).
• Whether the dataset includes copyrighted material.
• Whether the dataset includes trademarks or patents.
• Whether the dataset includes personal information.
• Time period during which data was collected.
• Dates the dataset was first used in development.
• General sources and characteristics of the data.
• How datasets relate to the system's intended purpose.
• Whether synthetic data were used.
• Whether aggregate consumer information is involved.

Note the retroactive scope. If you launched a model in 2023 and updated it in 2025, you likely need to disclose now. The deadline passed on January 1, 2026. If you missed it, you're scrambling.

The Trade Secret Tension

Here’s where it gets tricky. Your competitive advantage often lies in *how* you curated your data. Maybe you filtered out low-quality Reddit posts. Maybe you licensed specific news archives. Revealing too much could expose your secret sauce.

Legal experts advise a "high-level" approach. You don't need to list every URL you scraped. You can say "publicly available web content" instead of "Common Crawl subset X." You can say "licensed third-party media" instead of naming the exact vendor if that relationship is confidential.

Major AI labs have adopted this strategy. They group data into broad buckets:

• Publicly available internet data.
• Non-public data from partners.
• User-generated data (with opt-outs).
• Human evaluator feedback.
• Synthetic data generated by other models.

This satisfies the statute without handing competitors your entire data pipeline. But be careful. Vague answers like "various sources" might not pass scrutiny if they lack specificity. The goal is clarity for consumers, not obfuscation.

Who Is Exempt?

Not every AI model needs a disclosure page. AB 2013 carves out specific exemptions. You don't need to comply if your system is designed exclusively for:

• Security purposes.
• System integrity maintenance.
• Aircraft operation.
• National security applications.

If your generative AI powers a chatbot for customer service or an image generator for marketers, you’re in. If it’s running behind-the-scenes fraud detection logic with no user-facing output, you might be out. Check your use case carefully.

Why Companies Are Fighting Back

Compliance isn't universal. Some developers argue the law goes too far. xAI, the developer of Grok, filed a federal lawsuit to block AB 2013. Their argument? Compelled disclosure violates the Fifth Amendment (taking of property) and the First Amendment (forced speech).

This lawsuit matters. If courts rule against AB 2013, other states might hesitate to pass similar laws. For now, though, the law stands. Until a court says otherwise, assume you must comply.

Critics also point out practical flaws. Researchers like Guha et al. (2023) warn that disclosures only work if people understand them. If your summary is buried in a PDF full of jargon, users won't read it. This leads to "disclosure fatigue," where transparency becomes a checkbox exercise rather than a meaningful insight.

How to Write a Good Disclosure

Don't treat this as a legal footnote. Treat it as trust-building. Users want to know if your model hallucinated because it learned from biased forums or outdated textbooks.

Follow these best practices:

1. Be Specific but Safe: Instead of "web data," try "English-language web pages from 2010-2023."
2. Highlight Copyrights: Explicitly state if you included copyrighted books or music. This addresses major concerns from artists and authors.
3. Address Personal Info: State clearly if you processed PII (Personally Identifiable Information). Mention any anonymization steps.
4. Update Regularly: Set a calendar reminder. Every major model version needs a refreshed disclosure.
5. Make It Findable: Put the link in your footer or "About Us" page. Don't hide it deep in terms of service.

Standardization helps. While California doesn't mandate a template, following the EU AI Act’s structure can future-proof you. The EU requires similar technical documentation. Aligning both saves effort later.

Broader Implications for AI Strategy

AB 2013 is just the start. It signals a shift toward accountability. Investors now look at data provenance as a risk factor. If you can't prove where your data came from, you face higher legal liability.

Consider building a "Data Card" for each model. This internal document tracks sources, cleaning methods, and biases. When regulators or journalists ask questions, you’ll have answers ready. This turns compliance into a competitive asset.

Other jurisdictions are watching. New York, Illinois, and Colorado are drafting their own AI rules. Many will mirror California’s focus on transparency. By complying early, you prepare for a patchwork of regulations without rebuilding your process every year.

Key Takeaways

• Deadline Passed: AB 2013 required disclosures by January 1, 2026. Check your site now.
• Retroactive Scope: Models released since 2022 may need updates.
• Trade Secrets Protected: You don't need to reveal proprietary filtering techniques, just general categories.
• Litigation Risk: xAI’s lawsuit challenges the law, but compliance remains mandatory until ruled otherwise.
• Trust Signal: Clear disclosures build user confidence and reduce regulatory risk.