California Revamps AI Transparency Requirements

Just weeks after the California AI Transparency Act (CATA) took effect, California passed SB 1000, which significantly reshapes the state’s framework for identifying and verifying AI‑generated content. CATA was enacted in 2024 through SB 942 and subsequently amended in 2025 by AB 853, which expanded CATA to include requirements for large online platforms, GenAI hosting platforms, and capture-device manufacturers.

Enacted on September 30, 2026, SB 1000 both widens the universe of businesses subject to CATA and overhauls compliance obligations, requiring both businesses subject to the earlier version of CATA and those who were not previously subject to take note. The bill is an urgency measure that takes effect immediately.

Expanding the Scope of Covered Providers

SB 1000 substantially broadens the definition of a “covered provider” under CATA, meaning that businesses that were previously not subject to the law may now be required to comply with CATA:

• Eliminates one-million-user threshold. Existing law limits the definition to persons that create, code, or otherwise produce a GenAI system with more than one million monthly visitors or users that is publicly accessible in California. SB 1000 eliminates the one-million-user threshold, extending CATA’s requirements to any person that creates, codes, or otherwise produces a GenAI system that is publicly accessible in California.
• Media and entertainment exemption narrowed. CATA exempted products, services, websites, and applications that provide exclusively non-user-generated video games, television, streaming, movie, or interactive experiences. SB 1000 narrows that exemption to cover exclusively non-user-generated video games.

Changes for Companies Already Complying with CATA

For providers already subject to CATA, SB 1000 makes several significant changes: replacing CATA’s core detection mechanism, rewriting the provenance disclosure rules, and swapping out the current framework governing third-party licensees. Many existing compliance measures will need to be revisited.

From AI Detection to Disclosure Verification

CATA required covered providers to make an “AI detection tool” available to users at no cost. SB 1000 replaces this with a “disclosure verification tool” and makes several substantive changes to the existing requirements. SB 1000 would modify existing CATA requirements for covered providers as follows:

• In assessing whether content was created or altered by the provider’s GenAI system, the disclosure verification tool excludes alterations consisting only of a “minor modification,” such as cropping, resizing, or changes to color.
• Providers are expressly allowed to satisfy the disclosure verification tool requirement through a qualifying third-party tool.
• Providers are permitted to impose reasonable limitations on access to prevent misuse of the tool for malicious purposes.
• CATA prohibits an AI detection tool from outputting personal provenance data. SB 1000 instead generally prohibits a disclosure verification tool from outputting personal information detected in content, unless the person to whom it pertains expressly consents following specified notice.
• SB 1000 broadens restrictions on providers’ handling of personal information derived from users of the tool or content processed by it, prohibiting its collection, use, retention, sale, sharing, or other disclosure beyond what is strictly necessary to comply with CATA.
• Providers are prohibited from conditioning access to their GenAI systems or verification tools on the provision of personal information beyond what is strictly necessary for compliance.

What remains unchanged: Providers must continue to make the tool available at no cost and enable users to assess whether image, video, or audio content was created or altered by the provider’s GenAI system. The tool must continue to output detected system provenance data, allow users to upload content or provide a URL, and support technology that allows users to invoke the tool without visiting the provider’s website. Providers also remain required to collect user feedback regarding the tool’s efficacy and incorporate relevant feedback into efforts to improve it.

Revised Provenance Disclosure Requirements

SB 1000 eliminates CATA’s requirement that covered providers offer users the option to include a manifest disclosure in qualifying content created or altered by their GenAI systems.

SB 1000 retains CATA’s latent disclosure requirement, but makes the following changes:

• The requirement applies, to the extent technically feasible, to qualifying content created or altered by a GenAI system, except by minor modification.
• The disclosure must now additionally indicate whether the GenAI system created or altered the content and, beginning January 1, 2029, whether the system is designed primarily to function as assistive technology.
• The disclosure must be permanent or extraordinarily difficult to remove or tamper with, compatible with the provider’s disclosure verification tool, and compliant or interoperable with widely recognized industry standards.
• SB 1000 also revises the definition of “provenance data” to mean information about the origin and modification history of digital content that is in a format compliant or interoperable with widely adopted specifications adopted by an established standards-setting body.

What remains unchanged: Covered providers must still embed latent disclosures in covered image, video, and audio content to the extent technically feasible. Those disclosures must still convey the provider’s name, the name and version information of the GenAI system, the time and date of creation or alteration, and a unique identifier, either directly or through a link to a permanent website.

New Framework for Third-Party Licensees

SB 1000 replaces CATA’s existing license-revocation framework with a notice, remediation, and reporting process for third-party licensees. Under the revised framework:

• When licensing a GenAI system to a third party, a covered provider is required to notify the licensee of its obligations under CATA.
• If the provider knows that an identifiable licensee modified the system so that it no longer complies with CATA, the provider has 72 hours to either terminate the licensee’s authorization to use the system or notify the licensee of its noncompliance and reporting obligations.
• A licensee receiving notice has 96 hours to bring the system into compliance or cease using or making it available, including any copy or modified version, and report the action taken to the provider.
• If the licensee fails to provide the required report or reports that it did not take either action, the provider is required to report the licensee’s noncompliance to the California Attorney General.
• Covered providers are not required to monitor, investigate, or otherwise inquire into a third-party licensee’s use or modification of a licensed GenAI system.

What remains unchanged: Covered providers remain responsible for taking action when they know that a third-party licensee has modified a licensed GenAI system in a manner that results in noncompliance with CATA.

Temporary Assistive Technology Exemption

SB 1000 temporarily exempts GenAI systems designed to primarily function as assistive technology from CATA until January 1, 2029. Covered providers that falsely represent a system as qualifying for the exemption face a $50,000 civil penalty per violation, with each day constituting a separate violation. The special penalty provision also expires January 1, 2029.

Enforcement and Timing

CATA’s general enforcement framework remains largely intact, but SB 1000 provides that a civil action brought before the bill’s effective date may not be maintained if the alleged conduct does not violate CATA after SB 1000 takes effect.

SB 1000 took effect immediately upon enactment. It does not change the operative dates of the requirements added by AB 853 for large online platforms, GenAI hosting platforms, and capture-device manufacturers. Those requirements take effect January 1, 2027, for large online platforms and GenAI hosting platforms, and January 1, 2028, for capture‑device manufacturers.

What Companies Should Do Now

Companies should consider taking the following steps:

• GenAI providers: Assess whether they qualify as covered providers following the elimination of CATA’s one-million-user threshold. Evaluate whether current AI detection and provenance mechanisms satisfy the revised disclosure verification and latent disclosure requirements, including the new interoperability and privacy provisions.
• Companies that license GenAI systems: Review processes for addressing known third-party licensee noncompliance, including the new notice, remediation, and attorney general reporting requirements.

Maya Vishwanath, an AI Analyst at Morrison Foerster, contributed to this alert.