Does California's AI Transparency Act apply to my AI image, video or audio app now that SB 1000 removed the user threshold, and what does it make me embed and keep?

What should I check, step by step?

1. Check scope: does your product generate or alter images, video or audio, and can people in California use it? The user threshold no longer applies, so small apps count. Apart from systems designed primarily as assistive technology (exempt until January 1, 2029), the only exemption left is for exclusively non-user-generated videogames.

2. If you build on someone else's model, work out who the covered provider is for each feature, and read your license. Providers must tell licensees about their obligations, and a licensee that's notified of noncompliance has 96 hours to fix it or stop and report back.
3. Embed a latent disclosure in every generated or altered file: your name, system name and version, time and date, a unique identifier, and whether the content was created or altered. A link to a permanent website can carry the details.
4. Use a widely recognized provenance standard (for example C2PA Content Credentials) and make sure the disclosure survives your own export pipeline. The law requires it to be permanent or extraordinarily difficult to remove or tamper with, to the extent technically feasible.
5. Publish a free disclosure verification tool, or point users to a compliant third-party tool from inside your product. It must accept uploads or URLs, offer an API and output any system provenance data it finds.
6. Keep personal information out of the disclosure and the tool. The tool can't output personal information unless the person expressly consents after a plain-language notice, and you can't collect or keep personal data from tool users beyond what the law strictly needs.
7. Keep your own per-generation record: the unique identifier, a hash of the exported file, the system version and the time. If the embedded data is stripped later, that record is how you show what your system made and when.
8. Re-test after each model or pipeline release. The disclosure has to name the version that created the content, so a release that changes the version string or the export step needs checking.
9. Don't call a general product assistive technology to buy time. The exemption until 2029 only covers systems designed primarily for that, and falsely claiming it carries a $50,000-per-violation penalty.
10. Plan for 2027 and 2028: large online platforms must detect and display provenance data from January 1, 2027, and capture device manufacturers have duties from January 1, 2028. Talk to a lawyer about your product.

What did SB 1000 change in California's AI Transparency Act?

SB 942 created the California AI Transparency Act in 2024, originally operative January 1, 2026. AB 853, signed on October 13, 2025, delayed it to August 2, 2026 and added duties for large online platforms, generative AI hosting platforms and capture device manufacturers.

• SB 1000 (Becker), Chapter 861 of the Statutes of 2026, was approved by the Governor on September 30, 2026 and took effect immediately as an urgency statute. According to the Legislative Counsel's digest, it deleted the user threshold from the definition of covered provider, renamed the AI detection tool a disclosure verification tool, deleted the requirement to offer users the option of a manifest (visible) disclosure, added whether the system created or altered the content to the latent disclosure, and delayed the Act for systems designed primarily as assistive technology.
• It also changed the license rule. If a provider knows that an identifiable licensee modified a licensed system so that it no longer complies, the provider must, within 72 hours of discovering it, either end the license or notify the licensee, who then has 96 hours to bring it into compliance or stop using it and report which it did. A provider that gets no report, or a report that the licensee did neither, must tell the Attorney General. The law says providers don't have to monitor or investigate licensees.

What must a latent disclosure contain under California's AI Transparency Act?

Section 22757.3 requires the latent disclosure, to the extent technically feasible, in any image, video or audio content created or altered by the system, except by minor modification. Minor modifications are listed: brightness, contrast or color changes, sharpening, saturating, resizing, scaling, cropping, format conversion, and denoising or removing background noise in audio.

• The disclosure must convey the provider's name, the system's name and version, the time and date of creation or alteration, a unique identifier and whether the system created or altered the content, plus, from January 1, 2029, whether the system is designed primarily as assistive technology. It must be compatible with the provider's verification tool and compliant or interoperable with widely recognized industry standards.
• Section 22757.2 requires the free verification tool to let a user check whether content was created or altered by the provider's system, output any system provenance data it detects, be publicly accessible (with reasonable limits allowed to prevent security risks or misuse), accept an upload or URL, and support an API so it can be called without visiting the provider's website. Providers must collect feedback on how well it works.
• Although the Act's definition of a generative AI system mentions text, the latent disclosure and verification duties apply to image, video and audio content.

What are the penalties under California's AI Transparency Act?

Each violation carries a civil penalty of $5,000, each day of violation counts as a separate violation, and the action is brought by the Attorney General, a city attorney or a county counsel, who can recover reasonable fees and costs. Morgan Lewis notes the Act doesn't create a private right of action. SB 1000 also says actions filed before it took effect can't continue if the conduct is allowed under the amended law.

• From January 1, 2027, large online platforms (more than 2,000,000 unique monthly users) must detect provenance data in content they distribute, show users whether it's available, and not knowingly strip it, and generative AI hosting platforms may not knowingly offer systems that don't place the required disclosures. From January 1, 2028, capture device manufacturers have their own duties.

Why keep your own record of AI-generated images if they carry provenance data?

Embedded provenance data can be lost when files are re-encoded, screenshotted or uploaded to services that strip metadata, and the law only requires it to be hard to remove to the extent technically feasible. If a regulator, platform or customer asks whether a file came from your system, your own record of each generation is a second line of evidence.

• A hash of the exported file, made at the time, matches only that exact file. It can show that a copy someone sends you is byte-for-byte what you produced, and when you recorded it, but it won't match a cropped or re-encoded copy. That's what the embedded disclosure and your verification tool are for.