Who does California SB 942 apply to?

Since SB 1000 took effect on September 30, 2026, any person that creates, codes or otherwise produces a generative AI system publicly accessible in California is a covered provider. There is no user threshold.

Does SB 942 cover AI-generated text?

No. The disclosure and verification tool duties cover image, video and audio content, or any combination of them, created or altered by the provider's system.

What are the penalties for SB 942 violations?

A civil penalty of $5,000 per violation, collected in a civil action by the Attorney General, a city attorney or a county counsel. Each day a provider is in violation counts as a separate violation, and a prevailing plaintiff recovers attorney's costs and fees.

California SB 942 compliance checklist after SB 1000

The US Capitol dome and columned side wing against a blue sky Image: Pexels, used under the Pexels License.

This checklist is for teams that build or sell a generative AI feature producing images, video or audio. California's AI Transparency Act (Business and Professions Code sections 22757 to 22757.6, enacted as SB 942 in 2024) has applied since August 2, 2026. On September 30, SB 1000 rewrote who it covers and what it asks, effective the same day. Our news piece on SB 1000 and Midjourney explains the change; this page is the working list.

Screenshot: SB 1000 bill history, California Legislative Information, October 15, 2026.

Step 1: are you a covered provider?

California Business and Professions Code section 22757.1 as amended by SB 1000, defining covered provider without a user threshold Screenshot: Business and Professions Code section 22757.1, California Legislative Information, October 15, 2026.

You create, code or otherwise produce a generative AI system (the statute's words), alone or as a feature of a larger product.
It's publicly accessible in California. There's no user count any more: SB 1000 deleted the old threshold.
It generates or alters image, video or audio content. Text-only output has no duty under this law.
It isn't a product that provides exclusively non-user-generated videogames (excluded).
It isn't designed primarily as assistive technology for people with disabilities. Those systems are out of scope until January 1, 2029, and a false claim of that status carries its own, much larger penalty.

Ticked all five? You're covered.

Step 2: put a hidden disclosure in every output

Section 22757.3 requires a latent disclosure "to the extent it is technically feasible" in image, video or audio content your system creates or alters (minor modifications such as cropping, resizing or format conversion don't count as alteration).

The disclosure carries, directly or through a link to a permanent website: your name as provider; the system's name and version information; the time and date of creation or alteration; a unique identifier; whether the system created or altered the content.
From January 1, 2029 it also says whether the system is designed primarily as assistive technology.
It's "permanent or extraordinarily difficult to remove or tamper with".
It's "compliant or interoperable with widely recognized industry standards". The statute names no standard; OpenAI and Adobe, for example, attach C2PA Content Credentials to their generated images.
You've written down any output type where you decided a disclosure wasn't technically feasible, and why.

A visible "AI-generated" label doesn't tick any of these boxes. The old duty to offer users a visible label was deleted by SB 1000.

Step 3: offer a free verification tool

Section 22757.2 calls it a disclosure verification tool. It must:

be free to the user;
tell a user whether image, video or audio content was created or altered by your system;
accept an upload or a URL;
be callable through an API without visiting your website;
output the system provenance data it detects, and no personal information unless the person concerned consented after the notice the statute describes;
be publicly accessible, with limits only to address security risks or malicious misuse.

And around it:

collect user feedback on how well the tool works and use it when you improve it;
don't make access to your system or the tool depend on personal data beyond what compliance needs.

A compliant third-party tool counts if it reads your disclosures and is clearly reachable from your interface.

Step 4: fix your licensing terms

When you license your system to a third party, tell the licensee about its duties under the Act.
If you learn an identifiable licensee modified the system so it no longer complies, revoke its authorization within 72 hours or notify it within 72 hours.
If the licensee doesn't report back within 96 hours that it fixed the system or stopped using it, report it to the Attorney General.

What the penalty looks like

California Business and Professions Code section 22757.4, setting the civil penalty per violation and who can sue Screenshot: Business and Professions Code section 22757.4, California Legislative Information, October 15, 2026.

The penalty is $5,000 per violation, sought in a civil action by the Attorney General, a city attorney or a county counsel. Each day of violation is a separate violation, and the winning side recovers attorney's costs and fees. Those three offices are the only plaintiffs the statute names. There's no notice-and-cure period in the chapter.

The US Capitol dome behind green trees and clouds Image: Pexels, used under the Pexels License.

What this checklist doesn't cover

Large online platforms (over 2 million unique monthly users) and capture device makers have their own duties under the same chapter. They aren't in this list.
Chatbot disclosure is a different body of law; see our state chatbot disclosure guide.
The EU side: Article 50 of the EU AI Act has its own marking rules; see the Article 50 checklist.

Correction, October 15, 2026: an earlier version said the Act covers only providers with one million or more monthly California users (SB 1000 deleted the threshold on September 30, 2026) and that it covers text. It also listed three duties the Act doesn't contain: a public transparency disclosure page, chatbot self-identification and a personal-use exemption from labelling. It said visible labels satisfy the law, that only the Attorney General enforces it (city attorneys and county counsel can too) and that providers get 30 days to cure after notice (the chapter has no cure period). The EU comparison table repeated those errors and was removed.