California changed its AI transparency rules again on September 30, 2026.
Senate Bill 1000, or SB 1000, was enacted as an urgency measure. That means it took effect immediately.
The headline is simple:
The one-million-user threshold is gone.
Under the amended California AI Transparency Act, a “covered provider” can now include any person or company that creates, codes, or produces a generative AI system that is publicly accessible in California.
That can bring smaller companies into scope.
You do not need to be a major technology platform. You may only need to be building or publicly offering a generative AI system.
The law also replaces the old “AI detection tool” requirement with a “disclosure verification tool.” It tightens the rules for embedded provenance disclosures and adds new deadlines when third-party licensees fail to comply.
This is not just an engineering update.
It is a governance problem.
What changed under SB 1000?
The California AI Transparency Act was originally enacted through SB 942 and became operative on August 2, 2026.
SB 1000 changes several important parts of that framework.
1. The user threshold is gone
The earlier law focused on GenAI systems with more than one million monthly visitors or users.
SB 1000 removes that test.
Now, the key question is not:
“Are we big enough to be covered?”
It is:
“Are we creating or producing a GenAI system that is publicly accessible in California?”
That is a much broader question.
A company developing its own public-facing AI product should assume this deserves legal review. A company simply using an outside AI tool internally may have a different analysis, but its vendor contracts, data practices, and internal controls still matter.
2. Detection is becoming verification
The law no longer centers on an “AI detection tool.”
It now requires a “disclosure verification tool.”
That distinction matters.
Detection tries to guess whether content was created by AI. Verification checks for embedded provenance information showing whether content was created or altered by an AI system.
The tool must generally allow users to assess whether qualifying image, video, or audio content was created or materially altered by the provider’s system. It must be available without charge and support the relevant provenance information.
A provider may use a qualifying third-party tool, but that does not remove the provider’s responsibility to understand how the tool works.
3. Provenance disclosures must be harder to remove
SB 1000 keeps the requirement for latent, machine-readable disclosures in qualifying AI-generated or AI-altered content, where technically feasible.
Those disclosures must now be:
- Permanent or extraordinarily difficult to remove or tamper with.
- Compatible or interoperable with widely adopted standards.
- Compatible with the provider’s disclosure verification tool.
- Clear about whether the system created or altered the content.
The disclosure must also continue to convey information such as the provider, system and version, creation or alteration date and time, and a unique identifier.
The old option to offer a separate visible “manifest” disclosure has been removed from the CATA framework.
For founders, the takeaway is practical:
Your product record, technical documentation, and content workflow need to agree with each other.
If your product team says one thing, your vendor contract says another, and your public explanation says something else, you have a governance problem.
Why this is a founder issue, not just an engineering issue
It is tempting to send SB 1000 straight to the engineering team.
That is a mistake.
Engineering may own the implementation. It should not be left to decide the company’s legal position alone.
Someone needs to decide:
- Which systems the company creates or operates.
- Whether those systems are publicly accessible in California.
- What counts as generated content versus altered content.
- Which provenance standard or format the company uses.
- What the company tells users and customers.
- Which vendor is responsible for which part of the process.
- Where the compliance record is stored.
- Who responds if a customer, regulator, partner, or licensee raises an issue.
Those are governance questions.
The important record is not only the code. It is the decision trail around the code.
If someone asks six months from now why a system was treated as outside scope, can your company produce the answer quickly?
Can it show the relevant product description, contract, technical assessment, policy, approval, and review date?
If not, the company is relying on memory.
Memory is not a governance system.
The third-party licensee deadlines are short
SB 1000 adds a notice and remediation framework for covered providers that license their GenAI systems to third parties.
If a provider knows that an identifiable licensee modified the system in a way that makes it noncompliant, the provider generally has 72 hours to terminate the licensee’s authorization or notify the licensee about the noncompliance and reporting obligations.
The licensee then generally has 96 hours to bring the system into compliance, stop using or making it available, and report back to the provider.
If the licensee fails to report the required action, or reports that it did not take the required action, the provider must report the noncompliance to the California Attorney General.
The law does not require providers to constantly monitor or investigate every licensee. But once the provider knows about a qualifying problem, the clock matters.
This is why contract language matters.
Your license agreement should address:
- Compliance with California AI transparency requirements.
- Preservation of disclosure capabilities.
- Notice of material system changes.
- Cooperation with remediation.
- Reporting obligations.
- Suspension or termination rights.
- Allocation of regulatory costs and claims.
Five moves to make now
1. Inventory your AI systems this week
Create a simple list.
Include AI systems your company:
- Builds.
- Fine-tunes.
- Operates.
- Embeds into a product.
- Licenses to customers.
- Uses through a vendor.
For each one, record whether it is public-facing, whether it creates or alters image, video, or audio content, and who owns the relationship.
Do not wait for a perfect technical map. Start with a usable one.
2. Identify your disclosure layer within two weeks
Ask your product and engineering teams:
- What provenance information is created?
- Where is it embedded?
- Can it be removed?
- What standard does it use?
- Can users verify it?
- Does the system distinguish creation from alteration?
- What happens after a downstream edit or export?
Document the answers.
If the answer is “we are not sure,” that is the first issue to fix.
3. Review AI vendor contracts within 30 days
Your vendors may supply the model, hosting layer, watermarking tool, verification tool, or content workflow.
Review the agreements for:
- Compliance commitments.
- Audit and information rights.
- Security and privacy obligations.
- Indemnity.
- Notice of legal changes.
- Data use and retention.
- Cooperation with investigations.
- Suspension rights.
- Responsibility for provenance failures.
Do not assume “the vendor handles compliance” is enough. Put the allocation in writing.
4. Write a one-page internal AI policy
Keep it short.
Your policy should answer:
- Which AI tools are approved?
- What information cannot be entered?
- Who can approve a new tool?
- When is human review required?
- Which outputs need disclosure?
- Where are AI decisions and records stored?
- Who handles incidents or legal requests?
A one-page policy that people follow is better than a 30-page policy nobody reads.
5. Name an owner and set a quarterly review
Assign one person to own the AI governance record.
That person does not need to be a full-time lawyer or engineer. They do need enough authority to bring the right people together.
Every quarter, review:
- New AI tools.
- Product changes.
- Vendor changes.
- Public claims.
- Provenance and disclosure performance.
- Customer complaints.
- New California requirements.
- Open remediation items.
Do not miss the surrounding California timeline
SB 1000 is part of a broader transparency stack.
California’s AB 2013 training-data disclosure obligations were due on or before January 1, 2026. Companies developing covered public-facing GenAI systems should confirm that their training-data documentation is posted, current, and updated when required.
AB 853 adds separate obligations beginning January 1, 2027, for certain large online platforms and GenAI hosting platforms. Requirements for certain capture-device manufacturers begin January 1, 2028.
These laws do not all apply to every company.
That is exactly why your company needs a clear scope analysis instead of a generic checklist.
Also note the temporary assistive-technology exemption under SB 1000. It applies only in the circumstances described by the law and lasts until January 1, 2029. Falsely claiming the exemption can trigger a $50,000 civil penalty per violation, with each day treated separately under the framework.
An exemption should be documented, not assumed.
Where fractional general counsel fits
This is the kind of work that falls between departments.
Engineering understands the system. Operations understands the workflow. Sales understands the customer promise. The founder understands the business risk.
A fractional general counsel helps turn those separate pieces into one operating record.
That can include:
- Mapping which rules may apply.
- Reviewing product and vendor contracts.
- Creating a practical AI use policy.
- Assigning decision owners.
- Building a review calendar.
- Preparing a response process for notices and remediation.
- Keeping the company’s public claims aligned with what the product actually does.
You do not need to build a large legal department before building a responsible AI governance process.
You do need to make the decisions visible, owned, and easy to retrieve.
If you want help pressure-testing your AI governance structure, email contact@thechiefcounsel.com.
This article is for informational purposes only and does not constitute legal advice. California AI requirements are evolving, and whether a specific law applies depends on the facts, product structure, business model, and current statutory language. Consult qualified legal counsel about your company’s situation.