California expands AI disclosure law to smaller public providers

California has broadened the reach of its AI Transparency Act, removing the former threshold that limited its obligations to providers of publicly accessible generative-AI systems with more than 1 million monthly visitors or users. Senate Bill 1000 also expands the law’s provenance requirements to cover material altered by generative AI, alongside material created by it. Gov. Gavin Newsom signed the urgency measure on Sept. 30, and it took effect immediately. The governor’s office said the legislation was intended to strengthen transparency so Californians can identify AI-generated material. The change means any person producing a publicly accessible generative-AI system within California is subject to the act’s requirements. The former threshold had confined the law principally to larger providers; the wider scope is expected to encompass smaller SaaS platforms, startups, open-source model providers and enterprise-facing tools. The underlying California AI Transparency Act took effect Aug. 2. It had required covered providers to offer a free tool for determining whether an image, video or audio file was generated by their model, as well as requiring latent disclosures embedded in AI-generated audiovisual content. SB 1000 renames that mechanism the disclosure verification tool. It must enable users to assess whether image, video or audio was created or altered by the provider’s system, unless the change was a minor modification. Providers may instead direct users to a compliant third-party tool compatible with the latent disclosures in their content. The bill permits providers to restrict access to the tool where needed to prevent demonstrable security or integrity risks, or malicious misuse. It also limits providers’ handling of personal information from tool users or processed content to what is strictly necessary for compliance. The law drops the prior option for users to include a manifest disclosure in generated content. It retains latent disclosures, but extends them to content created or altered by a generative-AI system. Minor modifications are excluded, including routine changes such as cropping, resizing, colour or brightness adjustments, file-format conversion, sharpening, audio denoising and background-noise removal. Embedded disclosures must continue to identify the provider, the system, version information, the time and date of creation or alteration, and a unique identifier. SB 1000 adds a field specifying whether the system created or altered the content. It also updates the definition of provenance data to cover a digital item’s origin and modification history in a format compliant or interoperable with widely adopted specifications from an established standards-setting body. The legislation also revises compliance rules for third-party licensees. According to Morrison Foerster’s analysis, it replaces the prior licence-revocation framework with a notice, remediation and reporting process. The bill preserves the act’s general civil penalty of $5,000 per violation, enforceable by the state attorney general, city attorneys or county counsel, with each day of a continuing breach treated separately. It creates a substantially higher $50,000-per-violation penalty for providers that falsely claim a generative-AI system is primarily assistive technology; each day of noncompliance is likewise a separate violation. SB 1000 also includes a safe harbour for pending cases. A civil action filed before the measure took effect cannot continue if the alleged conduct no longer violates the revised act. Systems primarily designed as assistive technology are not subject to the act until Jan. 1, 2029. The legislation defines assistive technology as an item, equipment, product system or directly assisting service that increases, maintains or improves the functional capabilities of people with disabilities. From that date, latent disclosures must also state whether the generative-AI system is designed primarily for that purpose.