AB 853 from Jan 2027: keep originals, not just uploads

California AB 853 makes its provenance duties for large online platforms operative on January 1, 2027. The practical step for a team generating video with Sume is to keep the original output file and its job record, because a platform can only reason about provenance for files you can still produce. This is a planning note, not legal advice; read the bill text at California Legislative Information for the actual duties.

What the sources say, and what they do not

The date comes from the bill text read on 2026-10-03, which also defines who is covered and what must be shown. This post does not restate those duties. It only covers the part you control: what you keep after a generation finishes.

Keep the original, not a re-export

Sume mirrors generated outputs into Sume-owned media URLs before exposing them, and the docs tell integrations to store the Sume URL rather than raw provider URLs. A completed video job returns the file through unsigned_urls or the content endpoint, so you can download it once and keep it in your own storage.

Re-encoding in an editor or an upload pipeline produces a different file. If a platform later asks where a clip came from, the untouched download plus its job id is a cleaner answer than a re-export.

curl "https://api.sume.com/v1/videos/$JOB_ID/content?index=0" \
  -H "Authorization: Bearer $SUME_API_KEY" \
  --output "originals/$JOB_ID.mp4"

# or with the CLI, for any Developer API job
sume jobs download "$JOB_ID" --output-dir ./originals

Store a small record next to each file

Sume does not document a provenance manifest on its outputs, so do not assume one is embedded. Keep your own sidecar record instead. The job object already carries what you need to reconstruct the request.

• The job id and the model id the job reported.
• The prompt and the input URLs you sent, exactly as submitted.
• The completed timestamp from the job status.
• A hash of the downloaded file, computed on your side.
• The request id from any error you saw while submitting.

Do not rely on the URL alone

The docs describe artifact URLs as opaque and say not to parse them for ids. Treat them as a way to download, not as a durable identity. Your own storage key and the job id are the stable pair.

If you also upload clips to a platform, keep a mapping from the platform's post id to your stored original. That mapping is what you will want when a disclosure or provenance question arrives.

Checklist before January 2027

Run through this once for each pipeline that publishes generated video.

• Download the original file the moment a job completes.
• Write the sidecar record with job id, model, prompt and file hash.
• Keep both for as long as the clip is live on any platform.
• Read the bill text and your counsel's guidance for your own obligations.