California AI Transparency Act (SB 942): What's Required After SB 1000
California's AI Transparency Act became operative August 2, 2026, and SB 1000 rewrote it on September 30, 2026. Who's covered now, what to disclose, and the penalties.
Draft a Website Terms Of UseCalifornia's AI Transparency Act (SB 942) became operative on August 2, 2026. Seven weeks later, SB 1000 (Stats. 2026, ch. 861) rewrote it as an urgency statute effective September 30, 2026. The 1,000,000-user threshold is gone, the "AI detection tool" is now a "disclosure verification tool", and the optional visible disclosure has been deleted. What's left is a free verification tool and a latent, machine-readable disclosure in AI-generated image, video, and audio content, backed by $5,000-per-day penalties.
Key takeaways
- SB 942 (Cal. Bus. & Prof. Code § 22757 et seq.) became operative August 2, 2026, after AB 853 pushed its original January 1, 2026 start date. SB 1000 amended it effective September 30, 2026.
- A "covered provider" is now anyone that creates, codes, or otherwise produces a generative AI system publicly accessible in California. SB 1000 deleted the 1,000,000-monthly-user threshold.
- Two obligations are live: a free disclosure verification tool, and a latent (machine-readable) disclosure embedded in AI-generated images, video, and audio. SB 1000 deleted the duty to offer users a visible ("manifest") disclosure option.
- GenAI systems designed primarily as assistive technology are outside the Act until January 1, 2029, and falsely claiming that status costs $50,000 per violation.
- A second wave hits January 1, 2027: "large online platforms" (2,000,000+ unique monthly users) must detect and surface provenance data in their interface under AB 853.
- Violations cost $5,000 per violation, each day counted separately, plus the prevailing plaintiff's attorney's fees.
What changed in SB 1000?
SB 1000 amends Business and Professions Code §§ 22757.1 through 22757.5 and adds § 22757.4.1. Because it's an urgency statute, it took effect the day the Governor signed it, September 30, 2026. The changes that matter most:
| Before SB 1000 | After SB 1000 |
|---|---|
| Covered provider: a GenAI system with over 1,000,000 monthly visitors or users | Covered provider: any person that creates, codes, or otherwise produces a GenAI system publicly accessible in California (§ 22757.1(e)) |
| "AI detection tool" | "Disclosure verification tool" (§ 22757.2) |
| Users must be offered an option to add a manifest (visible) disclosure | Deleted |
| Latent disclosure: provider, system and version, time and date, unique identifier | Adds whether the GenAI system created or altered the content (§ 22757.3(a)(1)(E)) |
| No assistive-technology carve-out | The Act doesn't apply to a GenAI system designed primarily as assistive technology before January 1, 2029 (§ 22757.5(b)); from that date the latent disclosure must say whether the system is one (§ 22757.3(a)(1)(F)) |
| — | Falsely representing that a GenAI system is designed primarily as assistive technology is prohibited (§ 22757.3(d)), with a $50,000-per-violation penalty until January 1, 2029 (§ 22757.4.1) |
SB 1000 also says a civil action brought before its effective date can't continue if the alleged conduct doesn't violate the Act as amended (§ 22757.4(c)).
What does the California AI Transparency Act require now?
The Act targets one narrow problem: making it possible to tell whether content was made by a person or a machine.
First, a covered provider must make a free disclosure verification tool available (§ 22757.2). The tool has to let a user check whether image, video, or audio content was created or altered (beyond minor edits like cropping or resizing) by the provider's GenAI system, output any system provenance data it finds, accept an upload or a URL, and be callable through an API. It must be publicly accessible, though the provider may limit access to address security risks or misuse. It can't output personal information unless the user it belongs to expressly consents, and the provider can't keep personal information from the tool beyond what compliance strictly requires. A provider can meet this duty by directing users to a compliant third-party tool that reads its disclosures and is clearly accessible from its interface.
Second, to the extent it's technically feasible, the provider must include a latent disclosure in image, video, or audio content its system creates or alters (§ 22757.3(a)). The disclosure has to convey, directly or through a permanent link, the provider's name, the system's name and version, the time and date, a unique identifier, and whether the system created or altered the content. It must be permanent or extraordinarily difficult to remove, compatible with the provider's verification tool, and consistent with widely recognized industry standards.
None of this requires disclosing what the AI was trained on or how it works. It requires disclosing that AI touched the content, and building tooling that lets someone verify that claim independently of the provider's own word.
Who counts as a "covered provider" now?
Before SB 1000, scope turned on one number: 1,000,000 monthly visitors or users. That number is gone. A covered provider is now "a person that creates, codes, or otherwise produces a generative artificial intelligence system that is publicly accessible within the geographic boundaries of the state" (§ 22757.1(e)).
| Scenario | Covered? | What to do |
|---|---|---|
| A publicly accessible GenAI image, video, or audio tool, any size | Yes, covered provider | Deploy the free verification tool (or direct users to a compliant third-party tool) and embed latent disclosures |
| A small, publicly accessible GenAI writing assistant | Covered provider by definition | The tool and latent-disclosure duties are written around image, video, and audio content; check how they apply to text-only output |
| A business embedding a third party's GenAI API in its product | Depends on who produced the system | Confirm contractually which party is the covered provider |
| A GenAI system designed primarily as assistive technology | Not until January 1, 2029 | Don't claim the status unless it's accurate: a false claim carries $50,000 per violation |
| A social media platform with 2M+ unique monthly users distributing others' AI content | Covered as a "large online platform" under AB 853 from January 1, 2027 | Build provenance detection into your content pipeline before the 2027 deadline |
| A B2B SaaS tool with no publicly accessible GenAI system | Not covered | No action needed under the Act |
The distinction between "producing the AI system" and "using someone else's AI system" matters here in the same way it does under the EU AI Act's provider/deployer split. The entity that created, coded, or produced the generative AI system is the one on the hook, not every business that touches its output downstream.
What happens when a covered provider licenses its system?
When a covered provider licenses its GenAI system to a third party, it must tell the licensee about the licensee's obligations under the Act (§ 22757.3(b)). If the provider knows an identifiable licensee modified the system so it no longer complies, it has 72 hours to either terminate the license or notify the licensee of the noncompliance. A notified licensee has 96 hours to fix the system or stop using it and report back, and the provider must report a licensee that doesn't to the Attorney General. The provider doesn't have to monitor or investigate how licensees use the system.
What happens on January 1, 2027 under AB 853?
AB 853, the same bill that pushed SB 942's start date to August 2026, adds an obligation aimed at distribution rather than generation. Starting January 1, 2027, a "large online platform" (a public-facing social media platform, file-sharing platform, mass-messaging platform, or stand-alone search engine with more than 2,000,000 unique monthly users, excluding plain broadband or telecom services) must detect whether the content it distributes carries provenance data, and disclose that status through its own user interface.
In plain terms: the generator discloses at the source, and starting in 2027 the distributor has to surface that disclosure to its own users too. SB 1000 didn't change that date.
The duties are set out in § 22757.3.1. A large online platform must:
- detect whether provenance data that follows widely adopted specifications of an established standards-setting body is embedded in or attached to the content it distributes;
- provide a user interface that discloses whether system provenance data is available, and that makes clearly and conspicuously available whether provenance data exists, the name of the GenAI system or capture device that created or substantially altered the content (if applicable), and whether digital signatures are available; and
- let users inspect the available provenance data, either directly in the interface, by downloading the content with its attached data, or through a link to a website or application showing it.
Separately, to the extent technically feasible, a large online platform may not knowingly strip that provenance data or a digital signature from content uploaded or distributed on it (§ 22757.3.1(b)). The section is operative January 1, 2027.
What must capture-device makers do from 2028? (§ 22757.3.3)
AB 853 also reaches the hardware that records content. A "capture device" is a device that can record photographs, audio, or video, including still and video cameras, mobile phones with built-in cameras or microphones, and voice recorders (§ 22757.1). A "capture device manufacturer" is a person who produces a capture device for sale in California, other than someone exclusively engaged in assembling one.
For any capture device the manufacturer first produced for sale in California on or after January 1, 2028, § 22757.3.3(a) requires the manufacturer to:
- give the user the option to include a latent disclosure in the content the device captures, conveying the manufacturer's name, the device's name and version number, and the time and date the content was created or altered; and
- embed latent disclosures in captured content by default.
Subdivision (b) limits the duty: a manufacturer must comply only to the extent it is technically feasible and compliant with widely adopted specifications adopted by an established standards-setting body. The section was added by AB 853 (Stats. 2025, ch. 674) and is operative January 1, 2028. The same penalty rules apply: $5,000 per violation, with each day of violation counted separately (§ 22757.4).
If you make or white-label cameras, phones, recorders, or apps that capture media, start asking your suppliers now how they will embed provenance data, and write the answer into your supply agreements.
What are the penalties for non-compliance?
The Act sets a civil penalty of $5,000 per violation, collected in a civil action by the Attorney General, a city attorney, or a county counsel (§ 22757.4). Each day a covered provider, large online platform, or capture device manufacturer is in violation counts as a separate violation, and a prevailing plaintiff recovers reasonable attorney's fees and costs. Falsely representing that a GenAI system is designed primarily as assistive technology carries a separate $50,000-per-violation penalty until January 1, 2029 (§ 22757.4.1).
How should this change your AI platform terms of use?
Now that the user threshold is gone, any publicly accessible GenAI product should check its AI platform terms of use. They should say, plainly:
- That a free disclosure verification tool exists and where to find it, or which compliant third-party tool you direct users to
- That a latent, machine-readable disclosure is embedded in AI-generated image, video, and audio content
- What personal information, if any, the verification tool can output, and how users consent to it
- Who is responsible for disclosure when your AI output is embedded in, or redistributed through, a partner's platform. This is the same allocation question the EU AI Act's Article 25 provider/deployer split forces on AI supply chains, under California's own statute
- If you license your system, that licensees are told about their obligations under the Act
Common mistakes to avoid
- Relying on the old 1,000,000-user threshold. SB 1000 deleted it effective September 30, 2026. "We're too small" is no longer a defense on its own.
- Still calling it an "AI detection tool." The statute now says "disclosure verification tool." Update your terms, help pages, and API docs so they match.
- Building a manifest-disclosure toggle because the old law required it. SB 1000 deleted that duty. A visible label can still be good practice, but it doesn't replace the latent disclosure.
- Leaving "created or altered" out of the latent disclosure. SB 1000 added it to the required fields.
- Claiming assistive-technology status loosely. The carve-out runs only until January 1, 2029, and a false claim carries $50,000 per violation.
- Confusing the Act with the EU AI Act's Article 50. Both require disclosing AI-generated content, but they're separate statutes with separate thresholds, mechanisms, and enforcement bodies. See how Article 50's disclosure duty differs in scope.
- Ignoring the January 1, 2027 platform-side obligation because "we don't generate the content." If you distribute AI content at scale as a large online platform under AB 853, the detection-and-disclosure duty reaches you too.
- Leaving disclosure obligations out of vendor and partner agreements. If a partner embeds your GenAI output in their product, your terms of service and any partner agreement should state who owns compliance for that combined output.
Sources
- SB 1000 (Stats. 2026, ch. 861), chaptered text, amending Cal. Bus. & Prof. Code §§ 22757.1–22757.5 and adding § 22757.4.1, California Legislative Information: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1000
- California Business and Professions Code § 22757 et seq. (California AI Transparency Act, SB 942), California Legislative Information: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB942
- Cal. Bus. & Prof. Code §§ 22757.1, 22757.3.1, 22757.3.3 and 22757.4 (current text, Division 8, Chapter 25), California Legislative Information: https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=BPC&division=8.&title=&part=&chapter=25.&article=
- AB 853 (2025), amendments extending SB 942's operative date and adding large-online-platform obligations, California Legislative Information: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853
- California Enacts AI Transparency Law Requiring Disclosures for AI Content (2024, describes the original SB 942), Jones Day: https://www.jonesday.com/en/insights/2024/10/california-enacts-ai-transparency-law-requiring-disclosures-for-ai-content
- California Amends Artificial Intelligence Transparency Act and Passes AI Defenses Act (2025, describes AB 853), Hintze Law: https://hintzelaw.com/blog/2025/10/19/california-amends-artificial-intelligence-transparency-act-and-passes-ai-defenses-act
- California AI Transparency Act Amendments Signed Into Law (2025, describes AB 853), Troutman Privacy + Cyber + AI: https://www.troutmanprivacy.com/2025/10/california-ai-transparency-act-amendments-signed-into-law/
This article is general information, not legal advice. Laws vary by jurisdiction. Pactlio generates professional drafts for review — have a licensed attorney review anything important.
Frequently Asked Questions
What is the California AI Transparency Act (SB 942)?▾
SB 942, codified at California Business and Professions Code § 22757 et seq., requires generative-AI providers to offer a free disclosure verification tool and to embed a latent, machine-readable disclosure in AI-generated image, video, and audio content. It became operative August 2, 2026, and SB 1000 (Stats. 2026, ch. 861) amended it effective September 30, 2026.
What did SB 1000 change?▾
SB 1000 deleted the 1,000,000-monthly-user threshold from the definition of covered provider, renamed the AI detection tool a disclosure verification tool, deleted the duty to offer users a visible (manifest) disclosure option, and added whether the system created or altered the content to the latent disclosure. It also delays the Act for GenAI systems designed primarily as assistive technology until January 1, 2029. It's an urgency statute, so it took effect when the Governor signed it on September 30, 2026.
Who counts as a 'covered provider' now?▾
After SB 1000, a covered provider is a person that creates, codes, or otherwise produces a generative AI system that is publicly accessible within California. There's no longer a user-count threshold, so smaller GenAI providers can be covered too.
When did SB 942 take effect?▾
SB 942 was enacted in 2024 with an original January 1, 2026 operative date. AB 853, signed October 13, 2025, pushed that date to August 2, 2026. SB 1000 then amended the Act as an urgency statute, effective September 30, 2026.
What does a covered provider have to do?▾
Two core duties: (1) make a free, publicly accessible disclosure verification tool available that lets users check whether image, video, or audio content was created or altered by the provider's GenAI system; and (2) to the extent technically feasible, include a latent disclosure in that content naming the provider, the system and version, the time and date, a unique identifier, and whether the system created or altered the content.
What changes for large online platforms starting January 1, 2027?▾
Under AB 853, 'large online platforms' (public social media, file-sharing, mass-messaging, or search platforms with over 2,000,000 unique monthly users) must detect whether distributed content carries provenance data and disclose that status through their user interface, effective January 1, 2027.
What are the penalties for violating the Act?▾
A civil penalty of $5,000 per violation, collected in a civil action by the Attorney General, a city attorney, or a county counsel, and each day a covered provider is out of compliance counts as a separate violation. Falsely claiming a GenAI system is designed primarily as assistive technology carries $50,000 per violation until January 1, 2029. A prevailing plaintiff also recovers reasonable attorney's fees and costs.
Does the Act apply to my small AI-powered product or app?▾
It can. Since SB 1000 removed the 1,000,000-user threshold, size alone no longer takes a publicly accessible GenAI system out of scope. The tool and latent-disclosure duties are written around image, video, and audio content, so check how they apply to what your system actually produces.
How should I update my AI platform terms of use?▾
Name the disclosure verification tool you provide (or the compliant third-party tool you direct users to), explain the latent disclosure embedded in image, video, and audio output, and state who is responsible for disclosure when your AI output is embedded in a partner's platform or when you license your system to a third party.