California’s AI Disclosure Law (SB 1000): What Every Creator Must Know

The short answer: California’s SB 1000 was signed on September 30, 2026, and took effect immediately. It rewrites the state’s AI Transparency Act so that any publicly accessible generative AI system in California — not just those with over 1 million monthly users — must embed hidden provenance data in AI-generated images, video, and audio, and offer a free tool that lets anyone check whether a file came from its system. Violations carry civil penalties of $5,000 per violation, with each day of noncompliance counting separately. If you create content with AI tools, build AI features into your own products, or distribute AI-made media, this law affects the files you handle every day. This article explains exactly how — and it is for information only, not legal advice.

What SB 1000 is (and where it came from)

The California AI disclosure law SB 1000 — authored by Senator Josh Becker and chaptered as Chapter 861 of the Statutes of 2026 — amends the California AI Transparency Act (CATA), which was originally enacted through SB 942, signed by Governor Gavin Newsom in September 2024. The original law was the first of its kind in the United States: it required providers of large generative AI systems to embed machine-readable provenance metadata in the images, video, and audio their systems produced, and to give users a free AI detection tool.

In 2025, AB 853 amended the act, pushing the first obligations’ operative date to August 2, 2026 and adding duties for large online platforms and capture-device makers. That operative date is notable: the European Commission’s transparency obligations under Article 50 of the EU AI Act also began applying on August 2, 2026, meaning the same companies face machine-readable synthetic-media disclosure duties on both sides of the Atlantic at the same time.

Just weeks after the law took effect, California rewrote it again. SB 1000 passed the legislature on August 27, 2026 as an urgency statute — meaning it took effect immediately upon the governor’s signature on September 30, 2026, with no grace period. Analysis from law firms that track the bill describes it as a “fix-it” bill that is actually a major expansion. Here is the timeline:

The 1-million-user threshold is gone

The single biggest change is also the simplest. Under SB 942, a “covered provider” was a person that creates, codes, or otherwise produces a generative AI system with more than 1 million monthly visitors or users, publicly accessible in California. That threshold kept small companies out of scope.

SB 1000 deletes the threshold entirely. A covered provider is now simply any person that creates, codes, or otherwise produces a generative AI system that is publicly accessible within California. That is a dramatic expansion: startups, mid-market SaaS companies, individual developers shipping an AI feature, and open-source projects with a public-facing interface can now fall within scope.

For creators, the practical consequence is indirect but real. Before SB 1000, only the biggest tools — the household-name image, voice, and video generators — were required to embed provenance data. Now, the small niche AI tool you use for thumbnails, voiceovers, or upscaling may be a covered provider too, which means your exported files may carry embedded AI-origin metadata you did not expect.

What the law actually requires

Under the amended law, covered providers shall include a latent (hidden, machine-readable) disclosure in any image, video, or audio content created or altered by their generative AI system. The disclosure must convey:

• The provider’s name
• The name and version information of the generative AI system
• The time and date of creation or alteration
• A unique identifier
• Whether the content was created or altered by AI

The disclosure must be permanent or extraordinarily difficult to remove or tamper with, must be compatible with the provider’s verification tool, and must be compliant or interoperable with widely recognized industry standards — a description that points squarely at the C2PA ecosystem, the Coalition for Content Provenance and Authenticity, whose cryptographically signed metadata is the leading technical specification for this kind of embedded provenance.

Note what is not covered: text. CATA targets image, video, and audio content only — the categories where synthetic origin is hardest for a person to detect and where misuse (deepfakes, synthetic voice fraud, AI-generated political imagery) is most acute. AI-written articles, scripts, and captions are outside the statute’s disclosure duties.

What the law no longer requires

Two of SB 942’s headline requirements are gone or transformed:

1. Visible watermarks are out. The original law had a “manifest disclosure” obligation: covered providers had to offer users the option to add a visible, human-readable label — essentially a watermark reading “AI-generated” — to content. SB 1000 eliminates that requirement entirely. No visible label is required under this law. (Separate laws may require visible notices in particular contexts; for example, California’s SB 1050 addresses advertisements featuring synthetic performers.)

2. The “AI detection tool” is now a “disclosure verification tool.” This is more than a name change. Covered providers must still offer a free tool, but it is now framed around verifying disclosures: it must let users assess whether content was created or altered by the provider’s system and output the detected system-provenance data. Importantly, providers can now satisfy this duty by directing users to a compliant third-party tool, as long as it is compatible with their latent disclosures and clearly accessible through the provider’s own interface. That gives small providers a realistic compliance path without building detection infrastructure from scratch.

3. Stronger privacy limits on the tool itself. Providers are now prohibited from collecting, using, retaining, selling, or sharing personal information derived from users of the verification tool — or from content processed by it — beyond what is strictly necessary to comply with the law. If you use a provider’s tool to check whether a file is AI-made, your information is protected by statute.

The “minor modifications” carve-out

SB 1000 adds a defined list of everyday edits that do not count as “altering” content for purposes of the statute, so they do not trigger fresh disclosure obligations:

• Brightness and contrast adjustments
• Sharpening
• Saturation adjustments
• File resizing and scaling
• Cropping
• File format conversions
• Audio denoising

This matters for your editing workflow. Normal color grading, resizing a thumbnail, converting a WAV to MP3, or removing background hiss does not, by itself, create a new disclosure obligation under the law. Heavier manipulation — compositing, inpainting, AI-assisted object removal, voice conversion — falls outside this carve-out.

If you build or license AI tools: the 72-hour clock

SB 1000 replaces the original law’s license framework with a faster notice-and-remediation chain that creators who build products on licensed AI models should understand:

• When licensing a GenAI system to a third party, the covered provider must notify the licensee of its obligations under the act.
• If the provider knows that an identifiable licensee modified the licensed system so it no longer complies, the provider has 72 hours to terminate, revoke, or suspend the licensee’s authorization — or to notify the licensee of its noncompliance and reporting obligations.
• A licensee that receives notice has 96 hours to bring the system into compliance or stop using it (including any copies or modified versions) and report the action taken to the provider.
• If the licensee fails to report back or reports that it did nothing, the provider must report the noncompliance to the California Attorney General.

There is one practical concession: providers are explicitly not required to monitor, investigate, or inquire into how licensees use or modify their systems. They do not have to police licensees — but once they know about a problem, they must act within 72 hours.

SB 1000 also revises the definition of “provenance data” to mean information about a file’s origin and modification history in a format compliant or interoperable with widely adopted specifications from an established standards-setting body — another alignment with C2PA-style standards.

Penalties and enforcement

The penalty structure is designed to accumulate quickly. A covered provider that fails to comply faces a civil penalty of $5,000 per violation, and each day of noncompliance is treated as a separate, discrete violation. A provider that fails to deploy a compliant verification tool for 30 days faces a theoretical exposure of $150,000 from that single deficiency alone — before considering the number of affected users or content pieces.

Enforcement authority rests with the California Attorney General, as well as city attorneys and county counsels, who can bring civil actions on behalf of California residents. Prevailing plaintiffs are entitled to attorney’s fees and court costs on top of the per-violation penalties. For licensees that strip provenance data, enforcers can also seek injunctive relief to compel compliance or halt the use of a non-compliant system entirely.

There is a separate, temporary penalty provision: a $50,000-per-violation penalty for falsely claiming that a system is primarily assistive technology (a temporary provision that expires January 1, 2029). SB 1000 adds a definition of assistive technology — tools that increase, maintain, or improve the functional capabilities of individuals with disabilities — and requires latent disclosures to flag whether the system primarily functions as assistive technology. One analysis notes that the act does not apply to systems primarily designed as assistive technology before January 1, 2029. Interpretations of this corner of the law are still developing, so check the chaptered text before relying on it.

What this means for you as a creator

Read carefully: the law regulates providers of generative AI systems, not individual creators directly. Making a video with an AI tool does not by itself make you a “covered provider.” But in four specific ways, this law now touches your daily work:

1. Your exported files may carry provenance metadata you didn’t put there

With the 1-million-user threshold gone, far more tools are covered providers. When you generate an image, clip, or voiceover, the output file may include embedded metadata naming the provider, the model, the timestamp, and a unique ID. If you then send that file to a client, upload it to a platform, or enter it in a contest, that metadata travels with it. Know what your tools embed. For example, if you generate avatar videos or synthetic voiceovers for client work, checking what provenance data ships in the export is now part of professional due diligence. Our coverage of AI avatar conversation tools and AI avatar generators covers the kinds of tools where this matters most.

2. Preserve the original file

Platforms and verifiers read the provenance data inside the file. Every re-encode, re-export, or screen recording can strip it. If you might need to prove a file’s origin — for a copyright dispute, a platform appeal, or a client question — keep the exact final file that left the tool, and know how to check it with the provider’s disclosure verification tool.

3. If you ship an AI feature, you may be a covered provider now

This is the change most creators will miss. If you built an app, plugin, chatbot, or web tool with a generative image, voice, or video feature that is publicly accessible to California users — even a small one — the old “we’re too small to matter” defense is gone. Embedding compliant latent disclosures and providing (or linking to) a free verification tool is now an operational cost of shipping the feature. The same applies if you license a model from a bigger provider and modify it: the 72-hour / 96-hour notice-and-remediation chain described above can land on you.

4. Platforms will start showing provenance data — plan for January 2027

Separately, AB 2713 (signed the same day as SB 1000) revises the duties of “large online platforms” — defined by a separate test of more than 2 million unique monthly users. Starting January 1, 2027, qualifying platforms must let users see whether provenance data or a digital signature is available on content and inspect it, and they are barred from knowingly stripping compliant provenance data where technically feasible. Expect major platforms to surface “AI-generated” indicators derived from this metadata in their interfaces next year.

Creator checklist: five things to do now

1. Audit your tool stack. List the AI tools you use for images, video, and audio. Check each provider’s documentation for provenance/C2PA support and for its disclosure verification tool. If a provider you rely on offers neither, that is now a business risk — for them and for you.
2. Keep original exports. Archive the exact file each AI tool produces, before your edit. Think of it as the negative that proves provenance.
3. Learn your verifier. Run one of your own exports through the relevant provider’s disclosure verification tool so you know what it shows — and what a platform will show about your content.
4. Do not strip provenance data. Workflows that scrub metadata (certain optimizers, format hoppers, some CDN pipelines) can remove the embedded disclosures. Platforms will be barred from knowingly stripping compliant provenance data; don’t let your own pipeline do it accidentally. For video creators, this also matters when choosing generation tools — see our guide to free AI video generation options and evaluate how each handles provenance.
5. If you ship AI features, get counsel. The expanded covered-provider definition, the latent-disclosure requirements, and the licensee remediation chain are technical legal duties. This article is informational only — have a lawyer assess whether your product is in scope.

Related laws to watch

SB 1000 did not arrive alone. Governor Newsom signed more than 20 AI-related bills this session. Three others matter most for creators:

• AB 2713 — companion amendments for large online platforms (2M+ monthly users): revised duties to detect, display, and preserve provenance data, operative January 1, 2027.
• SB 1050 — requires a clear and conspicuous disclosure when an advertisement “prominently” includes a synthetic performer, using wording substantially similar to “this performance features a synthetic performer” or “no human performer is depicted.”
• SB 53 — the Transparency in Frontier Artificial Intelligence Act, in effect since January 1, 2026, targeting the largest foundation-model developers with transparency reports and safety-incident reporting.

If the terminology in this area is new to you — GenAI, C2PA, latent vs. manifest disclosure — our AI glossary for beginners explains the key terms in plain language.

FAQ

When did SB 1000 take effect?

SB 1000 was signed on September 30, 2026, and took effect immediately, because it was passed as an urgency statute. There was no grace period.

Does California’s AI disclosure law still have a 1-million-user threshold?

No. SB 1000 deleted the “more than 1 million monthly visitors or users” condition from the covered-provider definition. Any person who creates, codes, or otherwise produces a generative AI system publicly accessible in California is now covered. (A separate 2-million-monthly-user test applies to “large online platforms” under AB 2713.)

Does every AI-generated video now need a visible “AI-generated” label?

Not under this law. SB 1000 eliminated the old requirement that providers offer users the option to include a visible (manifest) disclosure. The law now focuses exclusively on hidden, machine-readable latent provenance data. Other laws may require visible notices in specific contexts — for example, SB 1050 for advertisements featuring synthetic performers.

Does the law cover AI-generated text?

No. The California AI Transparency Act covers image, video, and audio content only. Text outputs are not subject to the disclosure or verification-tool requirements.

Is the disclosure verification tool a universal deepfake detector?

No. The tool answers a narrower question: whether a file was created or altered by that particular provider’s generative AI system, within the minor-modification exception. A negative result from one provider’s tool does not prove no AI system was involved.

Do simple edits like cropping or format conversion trigger new disclosure duties?

No. SB 1000’s “minor modifications” carve-out covers brightness/contrast adjustments, sharpening, saturation, resizing, scaling, cropping, format conversions, and audio denoising. These do not count as “altering” content under the statute.

I’m a creator outside California. Does this affect me?

The law is a California statute enforced by California authorities. But AI providers generally do not build California-only compliance pipelines — provenance embedding is typically applied to outputs globally — and platforms surface provenance data to all users. In practice, if you use covered tools, your files carry the metadata wherever you work.

What are the penalties for violating SB 1000?

A general civil penalty of $5,000 per violation, with each day of violation treated as a discrete violation, enforced by the California Attorney General, city attorneys, or county counsels. A separate temporary provision sets $50,000 per violation for falsely claiming a system is primarily assistive technology, expiring January 1, 2029. These are statutory penalty amounts, not estimates of what any particular case will cost.

Sources

• Eversheds Sutherland via JD Supra, “California Modifies AI Transparency Law Weeks After It Took Effect: What SB 1000 Changes And Why It Matters” — jdsupra.com
• Morrison Foerster, “California Revamps AI Transparency Requirements” (Oct. 1, 2026) — mofo.com
• Ngram, “California AI Transparency Act 2026: SB 1000 & AB 2713” — ngram.com
• Wilson Sonsini, “California Enacts Over Two Dozen Key Privacy and AI Bills into Law in 2026 Legislative Session” — wsgr.com
• Covington / Inside Global Tech, “California Governor Signs Over 20 AI-related Bills into Law” (Oct. 6, 2026) — insideglobaltech.com
• AI Laws by State, “California AI Transparency Act (SB 942): 2026 Compliance Guide” (penalty structure) — ailawsbystate.com

Note: This article is for informational purposes only and is not legal advice. AI disclosure law is developing quickly; consult a qualified attorney about how SB 1000 applies to your situation.