California AB 2013 enforcement begins

California’s AB 2013, the nation’s most consequential state-level AI training data disclosure law, entered enforcement this week. Organisations that trained generative AI systems on California residents’ data face new disclosure obligations.

AB 2013 requires organisations that trained generative AI systems to disclose, on request by a California resident, the categories of personal information used in training and whether the resident’s data was used.

The law applies to organisations that:

  • Trained a generative AI system available to California residents.
  • Used personal information of California residents in training.
  • Had annual gross revenue over $1M OR processed data of 100,000+ California residents.

The disclosure requirement is “categories” — not individual records. An organisation can respond with “we used browsing history, search queries, and email content” without identifying specific records.

The AG enforcement is complaint-driven. California residents can file complaints with the AG, who has discretion to enforce. Penalties are up to $2,500 per violation under the CCPA framework.

Practical implications:

  1. Document your training data. If you can’t tell a California resident what categories of their data were used, you can’t comply. The clock starts ticking on the first request.

  2. Build a response process. AB 2013 requests must be honoured within 45 days. The first request will be a fire drill. Have a process in place before then.

  3. Update your privacy notices. The AG has indicated that organisations should be proactively disclosing the categories of data used in training. A buried privacy notice isn’t enough.

  4. Watch for class action. California’s plaintiff bar is already circling. Expect copycat lawsuits in other states by Q1 2026.

AB 2013 is the most aggressive US state-level AI law in effect. New York, Texas, and Illinois are watching closely. A patchwork of state laws is emerging, and the federal AI legislation is unlikely to preempt them anytime soon.

The federal AI disclosure bill (S. 4142) is stuck in committee. The executive order on AI safety is mostly voluntary. The state-level laws are where the action is. If you’re operating in the US AI market, AB 2013 compliance is now part of the baseline.