You Fine-Tuned a Model for Your Product. What Does California's AB 2013 Ask You to Post About Your Training Data?

Your product runs on a generative AI model, and at some point your team trained, tested or fine-tuned it. California Civil Code section 3111 asks the developer of a generative AI system to post documentation about the data used to train it. The statute's first posting deadline was January 1, 2026, and a federal court case challenging it is pending on appeal.

This post walks through what the statute says in its own words, what the court record shows today, and the questions a California-facing AI company can settle now. It is written for founders and product leads at companies that build or modify AI features.

The short answer

AB 2013, approved September 28, 2024, adds Title 15.2 to the California Civil Code, "Artificial Intelligence Training Data Transparency."¹ Section 3111 was amended effective January 1, 2026; this post uses the amended text.² Section 3111 provides: "On or before January 1, 2026, and before each time thereafter that a generative artificial intelligence system or service, or a substantial modification to a generative artificial intelligence system or service, released on or after January 1, 2022, is made publicly available to Californians for use, regardless of whether the terms of that use include compensation, the developer of the system or service shall post on the developer's internet website documentation regarding the data used by the developer to train the generative artificial intelligence system or service."²

In summary:

1. The duty belongs to a "developer," a term the statute defines broadly.
2. The trigger is a generative AI system or service, or a substantial modification of one, released on or after January 1, 2022, being made publicly available to Californians, subject to the statute's definitions and exclusions.
3. The required content is a high-level summary of the datasets, organized into twelve listed items.
4. A federal court denied a request to block the statute, and a challenge to it is on appeal.

Who is a "developer"

Section 3110(b) defines a developer to include a person, partnership, state or local government agency, or corporation that designs, codes, produces or substantially modifies an AI system or service for public use. For this definition, members of the public exclude an affiliate as defined in section 1799.1a(c)(1)(A), and a hospital's medical staff member.²

Two other definitions matter to a company that builds on someone else's model:

• "Substantially modifies" means "a new version, new release, or other update to a generative artificial intelligence system or service that materially changes its functionality or performance, including the results of retraining or fine tuning."²
• Section 3110(f)'s definition of training a generative AI system or service includes testing, validating and fine-tuning by the developer of the AI system or service.²

Fine-tuning is expressly included in the training definition, while substantial modification requires an update that materially changes functionality or performance. Whether a company's work brings it within the developer definition requires applying all relevant statutory conditions to its activities.² The statute defines "generative artificial intelligence" as "artificial intelligence that can generate derived synthetic content, such as text, images, video, and audio, that emulates the structure and characteristics of the artificial intelligence's training data."²

Whether a particular company, product or modification meets these definitions depends on the facts. This post does not answer that for any product.

What the documentation covers

Section 3111(a) calls for a "high-level summary of the datasets used in the development of the generative artificial intelligence system or service," including twelve listed items:²

1. The sources or owners of the datasets.
2. A description of how the datasets further the intended purpose of the system or service.
3. The number of data points, which "may be in general ranges," with "estimated figures for dynamic datasets."
4. The types of data points; for labeled datasets this means the types of labels used, and for unlabeled datasets, the general characteristics.
5. Whether the datasets include data protected by copyright, trademark or patent, or are entirely in the public domain.
6. Whether the datasets were purchased or licensed by the developer.
7. Whether the datasets include personal information, as defined in Civil Code section 1798.140(v).
8. Whether the datasets include aggregate consumer information, as defined in section 1798.140(b).
9. Whether the developer cleaned, processed or otherwise modified the datasets, and the intended purpose of those efforts.
10. The time period during which the data were collected, including a notice if collection is ongoing.
11. The dates the datasets were first used during development.
12. Whether the system or service used, or continuously uses, synthetic data generation in its development. The developer "may include a description of the functional need or desired purpose of the synthetic data."

The twelve items are not an exhaustive list. Section 3111 was amended effective January 1, 2026; this post uses the amended text.²

What the statute leaves out

Section 3111(b) excludes three categories of generative AI systems or services from the documentation requirement: those whose sole purpose is helping ensure security and integrity; those whose sole purpose is operating aircraft in the national airspace; and those developed for national security, military or defense purposes and made available only to a federal entity. For the first exclusion, security and integrity has the meaning specified in section 1798.140(ac), applied to any developer or user rather than only to businesses defined in section 1798.140(d).²

The chaptered text of AB 2013 contains no enforcement or penalty provision of its own. How the statute is enforced is outside this post.

The court case

A challenge to AB 2013 is in the federal courts. This procedural summary was prepared October 20, 2026, from district and appellate docket records retrieved that day; the latest entry in the district record is dated March 25, 2026, and the latest in the appellate record is dated September 10, 2026. The entries reviewed show the following:³⁴

• December 29, 2025. X.AI LLC filed a complaint against California Attorney General Rob Bonta in the U.S. District Court for the Central District of California, X.AI LLC v. Bonta, No. 2:25-cv-12295. The docket lists the nature of suit as "Constitutional - State Statute."³
• January 16, 2026. X.AI moved for a preliminary injunction.³
• March 4, 2026. The court denied the motion for a preliminary injunction (Dkt. 35).³
• March 16 to 23, 2026. X.AI appealed the denial (Dkt. 37). The parties stipulated to stay the district court case pending the appeal, and on March 23 the court entered an order on the stipulation and closed the case on its docket (Dkt. 41).³
• March 17, 2026. The Ninth Circuit opened the appeal as No. 26-1591. In the appellate docket reviewed for this post, a September 6, 2026 notice schedules oral argument for November 18, 2026. That notice also says the panel may instead submit the case on the briefs. The reviewed docket contains no decision resolving the appeal.⁴

This account is limited to the docket entries listed. It does not describe the court's reasoning or the parties' claims, treat the preliminary-injunction denial as a final resolution of the merits, or predict the outcome. Later orders may affect the statute's application. Before relying on this post, check both the district court and Ninth Circuit dockets for subsequent orders and changes to the argument schedule.

Seven questions to settle now

None of these is a legal conclusion. Each is a process question a California-facing AI company can answer on its own facts.

1. Which products are generative? List the features that produce text, images, audio or video, and which of them Californians can use. The statute reaches use "regardless of whether the terms of that use include compensation," so a feature offered at no charge belongs on the list.
2. What did your team do to the model? Separate what the model provider did from what your team did: fine-tuning, retraining, testing, validating. Section 3110(f) expressly includes testing, validating and fine-tuning in its training definition.
3. Can you answer the twelve items? Take one product and try to write one sentence for each item in section 3111(a). Note which items you cannot answer today.
4. What does your provider tell you? If your product sits on a third-party model, ask what the provider says about its training data and what rights your contract gives you to that information. See our AI vendor contract questions and our post on API and model dependency terms.
5. Do your data licenses allow it? Item 6 asks whether datasets were purchased or licensed, and item 1 asks for their sources or owners. Check whether the licenses you hold allow you to describe them. A contractual restriction is an issue to identify and obtain advice on resolving; it is not a statutory exemption and does not by itself remove an applicable posting duty. See our post on data licensing in AI contracts.
6. Who owns the update cycle? The duty recurs "before each time" a substantial modification is made available. Decide who checks each new release or fine-tune against the definition and who updates the page.
7. Does everything you say line up? A posted summary sits next to your privacy policy, your customer contracts and your answers to security questionnaires. See our posts on customer contract terms for AI products, commitment drift in security questionnaires and California privacy policy updates.

What this post does not cover

This post does not address how AB 2013 is enforced, whether a particular company is a "developer" under it or a particular system, service or modification is covered, the merits of the pending challenge, other states' or countries' rules about training data, or copyright, fair use and trade secret questions about training data. It does not determine whether your product is covered; that requires a review of the facts and the current law. The authorities cited here are AB 2013, its 2025 amendment by AB 1170 and the docket entries listed below. For the wider picture, see our AI governance guide for business, our AI legal checklist for startups and our post on protecting intellectual property in an AI startup.

How we can help

Accord & Shield Legal drafts and reviews AI-related contract terms and company policies for technology companies in Arizona, California and Texas. To better understand the scope of your matter, you can schedule an initial consultation. The consultation is evaluation-only; no legal advice is provided. Representation begins only after an engagement agreement is signed and any required retainer is received. Please do not send confidential or sensitive documents before we confirm that we can assist.

This article is general information, not legal advice. Reading it does not create an attorney-client relationship. How any of these points applies to your company depends on your products, your data and your facts; consult an attorney about your situation.