California Signed 13 AI Bills in One Day. SB 1000 Deleted the Million-User Threshold.

On September 30, Governor Gavin Newsom's office announced that he had signed 13 AI-related bills covering workers, healthcare, transparency, and deepfakes, plus an executive order. The most consequential of the batch for anyone building generative AI is SB 1000, which takes effect immediately through an urgency clause.

SB 1000 does not start a new clock. It amends the California AI Transparency Act, which was already operative on August 2. The amendment changes who that law binds.

What changed

The covered-provider definition loses its one-million-average-monthly-user threshold. Under the old law, a developer of a publicly accessible generative AI system only became a covered provider once it crossed that line. SB 1000 removes the threshold entirely, so a developer of a publicly accessible image, audio, or video generation product available to California residents is covered regardless of user numbers.

Smaller text-to-image services, voice cloning services, and video generation services that sat below the million-user line under the previous framework lose that position and acquire the full set of duties. For a category of startups that assumed they were too small to be regulated, that assumption just expired.

The second change replaces the free "AI detection tool" duty with a duty to offer a "disclosure verification tool." That is a meaningfully different engineering requirement. Detection means analyzing a file after the fact and guessing whether it was generated. Verification means giving a user a tool they can run against a file to check for provenance signals the provider embedded in the first place.

The amendment also reaches content that a generative AI system has materially modified, in addition to content it generated from scratch. Providers that built detection tools under the prior law now face work to move from after-the-fact detection of their own outputs to a verification tool that a third party can operate.

The fine print that matters

The Assembly Committee on Privacy and Consumer Protection analysis records several qualifications. Latent disclosure duties bind only to the extent technically feasible. A provider may direct users to a compatible third-party verification tool instead of building its own. A license must be revoked within 72 hours of the provider finding that a licensee has stripped out the latent disclosure capacity.

There are exclusions for video game, television, streaming, and film platforms that carry only content their users did not generate. Systems whose primary function is assistive technology are exempt until January 1, 2029, with a $50,000-per-violation penalty for falsely claiming the exemption. The general penalty stays at $5,000.

That asymmetry is worth noticing. Claiming an exemption you do not qualify for is ten times more expensive than an ordinary violation, which suggests regulators expect the exemption line to be contested.

The rest of the package

Two companion bills signed the same day extend the theme. AB 2713 bars large online platforms, defined as those with more than two million unique monthly users, from knowingly stripping system provenance data or digital signatures where technically feasible, beginning January 1, 2027. SB 1111 makes a digital replica part of a person's voice or likeness under California's likeness-rights civil action, and makes using one to impersonate someone a form of false impersonation under a new Penal Code section.

Earlier in September, Newsom signed SB 813, which establishes a framework for independent verification organizations that evaluate AI systems for legal compliance, and AB 1405, which creates California's first registration framework for AI auditors. Together they point at a formal ecosystem for third-party AI assessment.

Not everything survived. Newsom vetoed AB 1542, SB 903, and AB 2575, citing overbroad provisions and implementation cost. He rejected SB 903 in part over imprecise definitions that could have hampered how psychotherapy professionals work. On AB 1542, which would have replaced heightened consent protections for sensitive personal data with a categorical prohibition, he questioned removing consumers from the process entirely and said the implementation costs were not addressed in the state budget.

There is also a practical question about timing. The transparency duties attach at availability, but the 72-hour revocation window and the provenance rules for large platforms begin on different dates. A product team planning a launch has to track three or four effective dates at once, and the penalties differ by provision. SB 1000's own urgency clause makes the first of them immediate, which leaves no runway for providers that had been operating below the old threshold.

The employment side of the package

The same day's announcement covered more than transparency. On workplace decisions, the package says employers may not rely only on AI for discipline or termination, and must disclose when a mass layoff, relocation, or termination is caused by an AI system. Workplace surveillance tools are banned in workplace bathrooms. Those provisions sit alongside SB 947 and SB 951, the automated-decision and technological-displacement bills that drew public praise from the California Federation of Labor Unions.

On healthcare, doctors and licensed providers keep their professional judgement when AI or clinical decision tools are used, and developers of clinical decision tools must take reasonable steps to reduce known or predictable bias. AB 1979 and SB 503 carry that theme. The package also touches gene synthesis, requiring equipment manufacturers and providers to follow safety guidelines, verify customers, and check what genetic material they send out.

Each of those areas has its own trade group, its own compliance stack, and its own timeline. A company that ships a clinical decision tool now has a bias-mitigation duty, a provider that runs a video generation service has a provenance duty, and an employer that uses automated screening has a disclosure duty. The connective tissue is that California is building obligations around deployment, rather than waiting for a single federal framework.

That is the strategic bet behind the volume. With federal legislation stalled, states have become the venue where AI rules actually get written, and California now has more enacted measures than any other state. Companies that operate nationally have to plan for the strictest state they serve, which makes California's choices into de facto national policy for many products.

What builders should do

The practical fallout is engineering and contracts. Model distribution teams face license-term work to preserve disclosure capacity and to define what happens when a licensee strips it. Product teams that relied on a detection tool now need a verification path, which usually means embedding provenance signals at generation time rather than trying to infer them later.

The threshold removal also changes planning. A startup that assumed it would not be covered until it had a million users should now treat compliance as a launch requirement, not a scale milestone. The duties attach at availability to California residents.

California now has 21 enacted AI measures, more than any other state. The pattern across the day's bills is consistent: transparency obligations widening, provenance treated as a property that must survive distribution, and enforcement authority concentrated in state agencies and the Attorney General. For anyone shipping generated images, audio, or video to US users, the state with the most detailed rulebook just made it more detailed.