California AB 3211 (Digital Content Provenance Standards)

• Authority: California
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Defunct
• Most recent activity date: 2024-11-30

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• False or misleading information
• Pollution of information ecosystem
• Disinformation, surveillance, and influence at scale
• Fraud, scams, and targeted manipulation
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Exposure to toxic content
• Compromise of privacy
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on misinformation (3.1, 3.2), malicious actors (4.1, 4.3), AI system security (2.2), and lack of transparency (7.4). Coverage is concentrated in content authenticity, provenance tracking, and preventing misuse of synthetic content.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Agriculture, Mining, Construction & Manufacturing
• Information

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Scientific Research & Development Services
• Arts, Entertainment & Recreation
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

The document primarily governs the Information sector (AI providers, online platforms, social media) and Manufacturing sector (recording device manufacturers). It applies cross-sector requirements for any entity developing or deploying generative AI systems or large online platforms in California.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding California state statute with mandatory obligations, enforcement mechanisms including administrative penalties up to $100,000, and oversight by the Department of Technology.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: California State Legislature; The people of the State of California
• Summary: The document is a California state legislative act, as indicated by the opening phrase 'The people of the State of California do enact as follows' and the legislative findings and declarations section.

Target

• Entity Types: AI_Developer, AI_Deployer, AI_Infrastructure_Provider
• Entities: Generative AI providers; Large online platforms; Generative AI hosting platforms; Recording device manufacturers
• Summary: The statute explicitly targets multiple categories of entities: generative AI providers who create AI systems, large online platforms that disseminate content, generative AI hosting platforms that make AI systems available, and recording device manufacturers.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: California Department of Technology
• Summary: The Department of Technology is explicitly designated as the enforcement body with authority to assess administrative penalties and receive adversarial testing reports.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: California Department of Technology; Accredited academic institutions
• Summary: The Department of Technology receives adversarial testing reports and administers the chapter. Accredited academic institutions have the right to request summaries of adversarial testing exercises, providing an independent monitoring function.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Deploy and Operate and Monitor stages of the AI lifecycle, with requirements for provenance data application at deployment and ongoing monitoring through transparency reports. It also addresses Build and Use Model through adversarial testing requirements and Verify and Validate through testing protocols.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems
• Generative AI

Technical Scope Summary

The document explicitly focuses on generative AI systems and synthetic content, with detailed definitions and requirements. It does not mention frontier AI, general purpose AI, task-specific AI, foundation models, or compute thresholds. The scope is specifically limited to generative AI capable of producing photorealistic synthetic content.