The law took effect January 1. The audits started in May.
California SB 942 has been on the books since the start of 2026, covering AI-generated audio, video, and image content. According to legal monitoring from JD Supra, the California AG has now begun auditing “covered providers”, which means the enforcement phase is active, not pending. That changes the compliance posture for every AI content company serving California users.
Here’s what SB 942 requires. Covered providers must include provenance metadata in AI-generated content. Legal analysts note that this is interpreted to include metadata that persists through subsequent modifications, meaning a watermark or metadata tag that disappears when a user edits or compresses the content doesn’t meet the standard. That’s not a trivial technical requirement. It means provenance infrastructure needs to be embedded in the generation process itself, not applied as a post-processing layer that a downstream workflow can strip.
The audit is the mechanism that tests whether “covered provider” compliance is real or nominal. Most companies that built SB 942 compliance programs in late 2025 wrote policies. They documented processes. Some deployed C2PA-compatible content credentials or similar technical standards. What the AG’s audit will probe is whether those technical systems actually work at the output layer, whether content leaving the platform carries the metadata the statute requires.
California SB 942, From Effective Date to Enforcement
There’s a complication worth naming. A proposed federal bill, the “Protecting Consumers From Deceptive AI Act,” introduced April 2026, would, if enacted, potentially establish NIST-led standards that might preempt state-level requirements like SB 942. Legal analysts have noted this scenario, though the federal bill remains at introduction stage and no preemption timeline has been established. That’s a speculative long-term scenario. It doesn’t affect the current compliance obligation, and it doesn’t affect what the AG’s audit will find next week or next month.
The federal preemption question is actually the more important long-term consideration: SB 942 itself is one of the California statutes within the broader federal/state AI authority conflict playing out this week. The DOJ is formally reviewing California SB 53; SB 942 operates in the same compliance environment. Organizations managing California AI law compliance are now tracking both the AG audit track under SB 942 and the federal preemption track against California’s broader AI regulatory framework.
The real question for compliance leads isn’t whether SB 942 survives federal preemption, it’s whether their technical infrastructure will satisfy an audit that’s happening right now, regardless of what federal preemption may eventually resolve.
Unanswered Questions
- Does your provenance metadata survive the file formats and compression workflows your users actually use downstream?
- If the federal Protecting Consumers From Deceptive AI Act advances, will NIST-led standards be more or less demanding than SB 942's current requirements?
- What does 'adequate' provenance metadata look like under AG audit scrutiny, and has any public enforcement action defined that standard yet?
What to watch
The AG audit’s findings will signal enforcement priority and rigor. Watch for any public enforcement actions or settlements, which will define what “adequate” provenance metadata looks like in practice. Also track the federal Protecting Consumers From Deceptive AI Act for committee movement, if it advances, it creates the clearest signal yet that NIST-led standards will eventually set the national floor.
Audit readiness means one thing above all others: can you demonstrate, to a regulator reviewing your output files, that provenance metadata is present and persists through the formats and workflows your users actually engage with?