California Signed More Than 20 AI Laws by September 30. One Erased a One Million User Threshold the Day It Was Signed. Here Is Which Ones Reach a Small Business.

1. What did California sign by September 30, 2026?

Law firm tallies identify more than 20 AI related laws enacted during California’s 2026 legislative session, and only a handful of them touch the average small business. September 30, 2026 was the deadline for Governor Gavin Newsom to act on the bills passed before September 1, and the Governor’s September 30 announcement covers the final group of AI and worker protection bills. Several others were signed earlier in the month, including SB 813 and AB 1405 on September 9 and SB 1119 on September 10. Covington counts more than 20 AI related bills signed in the final days of September, and Latham & Watkins puts the total at more than two dozen out of more than 30 AI focused bills sent to his desk. Because “AI related” is not a formal legislative category, those counts vary depending on whether adjacent privacy, surveillance, and synthetic media measures are included.

Most of the coverage since then has been organized by topic: worker protection, child safety, transparency, health care. That framing is accurate, but it does not answer the question a 40 person company actually has. Which of these laws apply to me, starting when, and what do they cost if I get it wrong?

The answer turns almost entirely on thresholds. Some of the new laws have no general revenue or headcount floor and turn instead on what an employer or business actually does with AI. Others are written for businesses with $500 million in revenue, 2,000,000 monthly users, or 75 employees at one site. Reading the chaptered text, not the press release, is the only way to tell which is which.

California’s 2026 AI law package is a set of more than 20 statutes, by law firm counts, enacted in the 2026 session that regulate generative AI provenance, AI in employment decisions, workplace surveillance, chatbots, and clinical AI. Most take effect January 1, 2027. SB 1000, which removed the AI Transparency Act’s 1,000,000 user threshold, took effect immediately on September 30, 2026.

That matters at scale. The SBA Office of Advocacy’s 2025 California profile counts 4.3 million small businesses in the state, 99.8 percent of all California businesses, employing 7.6 million people, or 47.4 percent of the state’s workforce. A threshold change in one definition can move thousands of those firms from outside a statute to inside it overnight.

This article sorts the package by reach. We read the chaptered text of 14 of the bills on the Legislature’s own site and checked the status of three vetoes. Where a law is covered in depth in an earlier Dynamic Comply article, we summarize it and link to the full analysis rather than repeat it.

2. SB 1000: the law that took effect the day it was signed

SB 1000 rewrote the California AI Transparency Act and took effect on September 30, 2026, because the Legislature passed it as an urgency statute. The chaptered text (Chapter 861, Statutes of 2026) ends with an urgency clause stating the act “shall go into immediate effect.” Urgency statutes need a two thirds vote, and according to the bill history it cleared the Assembly 72 to 0, with no votes against in the Senate concurrence.

The single most consequential change is in the definition. Under the original Act, SB 942 from 2024, a “covered provider” was a person that produced a generative AI system “that has over 1,000,000 monthly visitors or users” and is publicly accessible in California. SB 1000 strikes the user count. The definition now reads, in full, a person “that creates, codes, or otherwise produces a generative artificial intelligence system that is publicly accessible within the geographic boundaries of the state.”

The Act’s provider duties had only been operative since August 2, 2026. We covered what that date meant for agencies that buy AI content tools in our August piece on the Act and small marketing agencies. At that time the 1,000,000 user floor kept almost every small developer outside the provider duties. Fifty nine days later, that floor is gone.

What a covered provider must now do

A covered provider has two core duties, and both attach to image, video, or audio content, or any combination of them. First, it must make a free “disclosure verification tool” available that lets a user check whether content was created or altered by the provider’s system, outputs any system provenance data it detects, accepts an upload or a URL, and supports an API so users can call it without visiting the provider’s website. A provider may instead point users to a compliant third party tool that is compatible with its disclosures and clearly accessible from its own interface.

Second, to the extent technically feasible, the provider must embed a latent disclosure in image, video, or audio content its system creates or alters, except by minor modification such as cropping, resizing, or color correction. The disclosure must convey, either directly or through a link to a permanent website, the provider’s name, the system name and version information, the time and date of creation or alteration, a unique identifier, and whether the content was created or altered. It must be “permanent or extraordinarily difficult to remove,” compatible with the verification tool, and interoperable with widely recognized industry standards.

SB 1000 also removed a duty. Covered providers no longer have to offer users the option of a visible, manifest disclosure. Morrison & Foerster’s October 1 alert notes that the bill also narrowed the Act’s entertainment exemption from video games, television, streaming, and movies down to exclusively non user generated video games.

Penalties and who enforces them

Enforcement belongs to the Attorney General, city attorneys, and county counsel, at $5,000 per violation, and the statute says “each day” a covered provider is in violation “shall be deemed a discrete violation.” A prevailing public plaintiff recovers reasonable attorney’s fees and costs. There is no private right of action in the Act.

A separate $50,000 per violation, per day penalty, in effect until January 1, 2029, applies to a provider that falsely claims its system is designed primarily as assistive technology. That claim matters because SB 1000 exempts genuine assistive technology systems from the entire chapter until January 1, 2029.

3. Are you a covered provider now?

You are likely a covered provider if your company builds and offers a tool, publicly accessible to users within California, that generates or alters images, video, or audio. Where your company is based does not matter; public accessibility within the state does. Latham expects the change to pull in startups, open source model providers, smaller SaaS platforms, and enterprise tools that sat under the old floor. MoFo’s first recommendation to clients is simply to reassess covered provider status.

The harder question is the business that does not train its own model. The statute covers a person that “creates, codes, or otherwise produces” a generative AI system, and it does not define “produces.” No regulator, court, or Attorney General guidance has addressed it as of October 12, 2026. So the honest answer is a spectrum, not a rule.

• Stronger case for coverage: you fine tune or package a model, put your own name on the product, and let the public generate or edit images, voice, or video through it.
• Weaker case for coverage: you call a model through an API purely to support internal work, such as drafting a product photo your staff then publishes, with no public access to the generation function.
• Outside the core duties as written: a text only assistant. The definition of a generative AI system includes text, but the verification tool and latent disclosure duties concern image, video, and audio content. A text only provider should still review the rest of the chapter rather than assume the whole statute is inapplicable.

Treat “public and branded as yours” as a screening question, not a statutory test. It tells you where to look first, but it does not settle coverage for an API integrator on its own.

The licensing provisions give a second route into the statute even if you are not the covered provider. If a covered provider licenses its system to you, it must tell you about your obligations under the chapter when it grants the license. If the provider learns you modified the system so it no longer complies, it must either terminate your authorization within 72 hours or notify you within 72 hours. You then have 96 hours to bring the system into compliance or stop using it, and report back. A provider that hears nothing, or hears that you did neither, must report you to the Attorney General. The statute also says this subdivision does not require providers to monitor or investigate how licensees use or modify their systems.

The trigger is modification of the licensed generation system so that it no longer complies, for example changing a licensed image model so it stops producing compliant latent disclosures. Ordinary downstream editing of individual output files, including compression that strips metadata, needs a separate analysis and should not automatically be treated as modifying the licensed system. Check your license terms for a notice of California obligations. Separately, as good operational practice, test whether your pipeline preserves provenance data before content reaches users.

One other SB 1000 detail matters to anyone who has been on the receiving end of a demand letter. New Section 22757.4(c) says a civil action brought before SB 1000’s effective date cannot be maintained if the conduct does not violate the chapter as amended. In practical terms, a claim premised on the old manifest disclosure option duty, which no longer exists, should not survive.

4. The workplace laws with no general headcount threshold

Three of the new workplace laws have no general employee count threshold: SB 947, AB 1883, and AB 1331. Each defines “employer” as a person who directly or indirectly, or through an agent, “employs or exercises control over the wages, hours, or working conditions of any person.” A five person dental office and a 400 person distributor start from the same place, but each law is triggered by specific uses of AI or surveillance, and each has statutory exceptions that still need to be assessed.

SB 947: AI in discipline and termination, from July 1, 2027

Newsom signed SB 947, the No Robo Bosses Act, as Chapter 859. Its duties begin July 1, 2027. An employer may not rely solely on an automated decision system for a disciplinary or termination decision, and if it primarily relies on one, a human must corroborate the decision by reviewing the data collected or used to produce the ADS output or other relevant supporting information, such as supervisory evaluations, personnel files, work product, peer reviews, or witness interviews.

The employer must also give a written postuse notice when it primarily relied on an ADS, provide a description of the employee’s own data on request, and avoid three freestanding uses: violating labor or civil rights law, inferring protected status, and predicting and punishing the exercise of legal rights. The Labor Commissioner and public prosecutors enforce it, with a $500 civil penalty per violation. The law does not apply to parties covered by a valid collective bargaining agreement that meets specified conditions, including an explicit waiver, and it does not prohibit ADS use reasonably necessary to comply with federal requirements for aircraft development or national security, military, space, or defense work. Our full SB 947 analysis was written before the signature and walks through every duty in the enrolled text, which is the text that became law.

AB 1883: no AI emotion recognition, no neural data

AB 1883 (Chapter 853) adds Labor Code Section 1581, which bars an employer from using a workplace surveillance tool that uses AI on employees to recognize, or make inferences or predictions about, an individual’s emotional state, or to collect neural data. “Workplace surveillance tool” is drawn broadly: any system, application, instrument, or device that collects employee data, activities, communications, biometrics, or behaviors by means other than direct observation by a person, expressly including video and audio surveillance, continuous time tracking, and geolocation.

The practical review targets are features small employers rarely think of as AI. Call center software that scores an agent’s “frustration,” interview platforms that rate a candidate’s affect, and wearables that infer stress are worth a hard look. Not every sentiment feature is prohibited, though. The answer depends on whether the tool is used on employees, whether it recognizes or infers an individual’s emotional state rather than, say, the tone of a document, and whether an exception applies. Neural data is defined narrowly as information measured from nervous system activity, not inferred from outward behavior. The law does not prohibit a tool used “to ensure safety,” or a tool that does not do either of the two prohibited things. Separate carve outs cover aircraft development and national security, military, space, or defense work, but only where the tool is reasonably necessary to comply with a federal statute, regulation, or binding federal contract.

AB 1883 penalties run up to $500 per violation, recoverable by the employee as a statutory penalty or by the Labor Commissioner or a public prosecutor as a civil penalty, but not both for the same violation. Civil actions can also seek injunctive relief, punitive damages, and attorney’s fees.

AB 1331: no surveillance in workplace bathrooms

AB 1331 (Chapter 851) bars an employer, unless directed by a court order, from using a workplace surveillance tool to monitor employees in a workplace bathroom, and gives employees the right to leave surveillance tools on their person behind when they enter one. An employer may still check tools for the one time entry and exit of a bathroom.

The AI connection is in the exception. An employer does not violate the law when an employee carries a required badge or personal alarm into a bathroom for identification or safety, but only if that tool does not detect or record audio or video and does not have physically embedded or attached AI. A smart badge with an onboard model is outside that exception. AB 1331 allows a penalty of up to $500 per violation, and civil actions can also seek injunctive relief, punitive damages, and attorney’s fees.

Neither AB 1883 nor AB 1331 contains an operative date or an urgency clause. Under the California Constitution’s default rule for regular session statutes, both take effect January 1, 2027, which matches the effective date shown for the package in the California Lawyers Association’s bill status chart. Both also state they apply to charter cities, so a local carve out is not available.

5. The AI layoff notice and its 75 employee establishment threshold

SB 951 adds AI specific content to California’s Cal/WARN notice, but it only reaches employers that already owe one: employers ordering a mass layoff, relocation, or termination at a covered establishment, generally a facility that employs or has employed 75 or more persons in the preceding 12 months. The threshold is per establishment, not company wide headcount. The chaptered text (Chapter 860) restates the existing definitions: a covered establishment is a facility that employs, or has employed in the preceding 12 months, 75 or more persons, and a mass layoff is a layoff of 50 or more employees at that establishment during any 30 day period.

When a mass layoff, relocation, or termination is caused “in whole or in substantial part” by an AI system or other automated technology replacing or automating positions, the 60 day notice must now add four things. It must state the number, classification, and work location of the affected layoffs, the job functions that will be automated, the specific category or type of AI or automating technology, and the statement “This notice is for a technology displacement” at the top.

The Employment Development Department must publish a summary of these notices and a quarterly statewide summary of technology displacements. That means an AI driven layoff by a mid sized California employer will now be publicly visible by category. Existing Cal/WARN penalties, which the bill digest describes as a civil penalty of not more than $500 for each day of violation, continue to apply to a deficient notice.

For most small businesses the operative piece is what SB 951 did not do. It does not require notice when a company simply stops hiring for a role because AI now covers it. Instead it directs EDD to report to the Legislature by January 1, 2028 on “technological cessation in hiring” and to recommend whether a public notice requirement should follow. Expect that to come back as a bill.

6. The headline laws that skip most small businesses

Four of the most reported laws in the package do not apply to a typical small business at all, because they are limited by revenue, platform size, product type, or profession. Knowing this saves real money, because vendors will market compliance products against all of them.

AB 1609: the 15 minute human agent rule is for $500 million companies

AB 1609 (Chapter 733, approved September 28, 2026) applies only to a “large private business,” defined as a business with more than $500,000,000 in gross annual revenue nationally that provides goods and services to customers. It bars representing a customer service chatbot as human, requires a clear disclosure where a reasonable person would be misled, and requires a simple way to request a human agent during regular business hours.

The headline 15 minute rule is a good faith effort standard: connect the customer to an agent within 15 minutes of the request or give a specific appointment within one business day. After connection, holds should not exceed 15 minutes at a time or one hour cumulatively. Email, web forms, and voicemail are excluded from the 15 minute clock. Public prosecutors enforce it at up to $5,000 for an initial violation and $10,000 for each subsequent one, with no private right of action.

The chapter also carves out services provided under specified Public Utilities Commission telecommunications and water general orders, exclusive business lines used only by employees or for business to business communications, qualifying hospital communications about health care services, and consumer reporting agencies. Inability to comply caused by unforeseen circumstances or emergencies, such as grid events and IT or telecommunications outages, is not a violation. “Services” covers paid services and excludes free options that offer an upgrade path.

Small businesses are not directly covered. Contractual flowdown from large customers is a separate commercial question, and two groups should pay attention: small vendors that sell chatbot or contact center software to large California brands, whose customers will now push these requirements into contracts, and any business that would rather adopt the disclosure practice voluntarily than explain later why it did not.

AB 2713: provenance duties for platforms above 2,000,000 users

AB 2713 (Chapter 856) revises the duties of a “large online platform,” which SB 1000 now defines as a public facing social media platform, file sharing platform, mass messaging platform, or standalone search engine that exceeded 2,000,000 unique monthly users in the preceding 12 months. Those duties become operative January 1, 2027. Unlike the covered provider definition, this platform threshold survived.

SB 1119: companion chatbots, with a deferred audit for smaller operators

SB 1119, “Adam’s Law” (Chapter 190, signed September 10), only reaches an operator of a companion chatbot, meaning a person who makes one available to users in California. It has no general revenue exemption from its principal child safety duties, which begin July 1, 2027. From that date, an operator that allows child users must complete and document a risk assessment before releasing a new or substantially modified companion chatbot, along with the other design and data duties the chapter sets.

Independent audits follow a separate schedule, and this is the small business detail most summaries miss. The first child safety audit is due on or before January 1, 2029, or before the operator first makes a companion chatbot publicly available, whichever is later, and every two years after that. But under Section 21814, an operator with less than $500 million in gross revenue in the prior calendar year is not required to comply with the audit section before January 1, 2032.

Public prosecutors can seek up to $5,000 per affected child for each negligent violation and $15,000 per affected child for each intentional violation. There is also a limited private action: a child who suffers actual harm from a violation of specified child protection duties, or a parent or guardian acting for the child, may sue for actual damages, fees, and injunctive relief. Financial harm must exceed $1,000 per child, and emotional harm must amount to serious emotional distress.

A company that makes a companion chatbot available only to its own employees, contractors, or personnel in workplace settings is expressly excluded. The definition the bill borrows from Business and Professions Code Section 22601 covers a system capable of meeting a user’s social needs, including by exhibiting anthropomorphic features and sustaining a relationship across multiple interactions, and it excludes bots used only for customer service, business operations, or technical assistance. A small app developer building an AI “friend” is a strong candidate regardless of revenue. A tutor persona or wellness companion may qualify, depending on whether it meets that definition and whether an exclusion applies.

SB 574: lawyers only

SB 574 (Chapter 858) became the first statewide statute written specifically for attorneys’ use of generative AI when Newsom signed it on September 30. It applies to attorneys, arbitrators, and alternative dispute resolution providers, not to their clients. Our SB 574 analysis covers the new verification, confidentiality, and court disclosure duties that take effect January 1, 2027.

Two notes on the table. Effective dates for bills without an urgency clause or a stated operative date are the January 1, 2027 default. And AB 2713’s penalty is the Act’s general penalty provision as amended by SB 1000, which covers large online platforms as well as covered providers.

7. Health care: where the size threshold disappears

The two clinical AI laws can apply to the smallest practices in the state, because both expressly include a “physician’s office,” meaning a physician in solo practice. The obligations are triggered by covered clinical uses of AI, not by any AI tool that happens to be used in a physician’s office. The California Health Care Foundation’s October 8 summary lists both as effective January 1, 2027.

AB 1979: the clinician keeps the final say

AB 1979 (Chapter 854) requires a health facility, clinic, physician’s office, or office of a group practice to take reasonable steps to ensure a licensed provider “retains the ability to exercise independent professional judgment” whenever care is informed by a clinical decision support system. It also bars using AI to independently perform, or to direct unlicensed personnel in performing, any clinical function the law reserves to a licensee. That prohibition does not stop a trainee from using a tool as part of a supervised course of study or training program toward licensure. A violation by a physician falls under the Medical Board of California or the Osteopathic Medical Board.

The statute exempts automated documentation and communication that does not involve professional judgment, such as record update notices, reminders, and helping patients find information they ask for. The definition of a clinical decision support system also excludes scheduling, reminders, previsit materials, and payment processing. A front desk scheduling bot is fine. A triage bot that tells a medical assistant which patients to room first deserves a review.

AB 1979 also amends the Confidentiality of Medical Information Act so a business that offers a “health care chatbot” to consumers for managing their information or for diagnosis, treatment, or management of a condition is deemed a provider of health care for CMIA purposes. That status is about confidentiality law; it does not make the chatbot or the business a licensed clinical provider. It is still a meaningful expansion for small digital health startups, and it sits on top of the federal and state disclosure rules we covered in our patient intake chatbot article.

SB 503: bias duties for developers and deployers

SB 503 (Chapter 857) requires developers and deployers to make reasonable efforts to identify clinical decision support systems with a known or reasonably foreseeable risk of biased impacts. Developers must try to mitigate that risk and give deployers a statement of intended uses and risks plus documentation on training data, evaluation, data governance, and recommended monitoring. They must provide it on request or at initial sale, whichever is earlier, and again on material updates.

A deployer, which again includes a solo physician’s office, must regularly monitor identified systems and take reasonable and proportionate steps to mitigate the risk. The statute adds that compliance “shall not be used as a defense to a claim of unlawful discrimination.” For a small practice the action item is concrete: ask every clinical AI vendor for its SB 503 documentation now, and keep the answer.

8. What Newsom vetoed, and what that tells you

Newsom vetoed at least three AI and data bills that would have reached small businesses: SB 903 on AI in psychotherapy, AB 2575 on clinician overrides of AI, and AB 1542 on sensitive personal information. The leginfo bill histories record SB 903 and AB 2575 as vetoed on September 30, 2026 and AB 1542 on September 27, 2026.

SB 903 is the notable one. According to its bill history, it passed the Assembly 74 to 1 and the Senate concurred 40 to 0. It would have limited AI in therapy to administrative and supplementary support, required informed consent for AI recording and transcription, and barred marketing a chatbot as a therapist. CHCF reports Newsom found its definitions and scope so broad they would harm legitimate clinical tools. California did not enact SB 903’s therapy specific framework this session, so it does not join the seven states we mapped in our AI therapy restrictions article. Other California laws, including AB 1979, the CMIA, and the companion chatbot rules, still govern relevant AI uses in behavioral health.

AB 2575 would have barred employers from punishing clinicians who override AI recommendations, enforced through the Labor Commissioner. CHCF reports the veto cited the impracticality of the “solely based on” evidentiary standard and the Labor Commissioner’s lack of medical expertise. Note that AB 1979, which was signed, still protects the clinician’s independent judgment through licensing law rather than labor law.

The pattern is useful. CalMatters reported that Newsom signed most of the labor backed AI bills, including the SB 947 language he had vetoed in a broader form in 2025. He vetoed where a bill reached ordinary clinical tools or used an evidentiary standard he considered unworkable. Bills that set process duties, such as human corroboration, documentation, and disclosure, fared better than bills that banned categories of use outright. That is a reasonable predictor for 2027 drafts under the next governor.

9. The AI audit infrastructure arriving in 2028 and 2029

California also built the plumbing for regulated AI audits, with a state registry of AI auditors due by January 1, 2029. AB 1405 (Chapter 178, signed September 9, 2026) requires the Government Operations Agency to establish an AI Auditor Registry and, beginning January 1, 2029, prohibits an unregistered person from offering, selling, or conducting a “covered AI audit.”

The definition is what makes this relevant to everyone else. A covered AI audit is an audit “to assess internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with state law.” The SB 1119 child safety audit is one obvious example, although operators below $500 million in revenue do not face that audit before 2032. Neither AB 1405 nor SB 813 itself creates a general audit obligation for small businesses. Any future California statute that requires an AI audit will now draw from a registered pool.

SB 813 (Chapter 179, also signed September 9) works alongside it. It requires the agency, on or before January 1, 2028, to set up a framework for designating “independent verification organizations” with demonstrated expertise in assessing AI risk. Executive Order N-9-26, signed September 18, 2026, orders the Government Operations Agency to complete the verification organization framework by May 1, 2027 and the registry setup under Section 11549.82(a) by December 1, 2027. That accelerates the agency’s administrative schedule. It does not, by itself, move forward the statutory January 1, 2029 date in Section 11549.82.5 on which unregistered auditors are barred from conducting covered AI audits.

For a small business the takeaway is not that you need a registered auditor today. You do not. It is that California is moving toward third party assurance of AI controls, as Illinois did for frontier developers in SB 315. A business that can already show documented controls against a recognized standard such as ISO/IEC 42001 or the NIST AI RMF will spend less when an audit duty eventually reaches it, or when a customer asks for one first.

10. A 90 day plan for a California small business

A California small business should spend the next 90 days answering one applicability question per law, starting with SB 1000 because it is already in force. This plan is a defensible baseline, not a safe harbor, and every step assumes you document what you found and when.

Days 1 to 15: SB 1000 applicability. List every product feature that lets a member of the public generate or alter images, video, or audio. For each one, record whether you trained, fine tuned, or packaged the model, whose name is on it, and which license governs it. If any feature is public and branded as yours, plan for the verification tool and latent disclosure duties now, and check whether your pipeline strips provenance data. Read your model license for the California notice SB 1000 now requires providers to give.

Days 16 to 40: workplace tool inventory. Inventory every tool that observes employees: call recording, time tracking, video, badges, wearables, productivity scoring, interview platforms. For each, ask the vendor in writing whether it infers emotional state or collects neural data (AB 1883) and whether it has embedded AI or records audio or video (AB 1331). Before January 1, 2027, disable emotion recognition features unless you have verified that the use actually qualifies for the statutory safety exception; do not rely solely on a vendor’s label.

Days 41 to 60: discipline and termination process. Identify any scoring, ranking, or flagging system that feeds discipline or termination. Draft the human corroboration step, the postuse notice template, and the employee data description process SB 947 will require from July 1, 2027. Our SB 947 guide has the element by element checklist.

Days 61 to 75: sector specific checks. Health care practices should request SB 503 documentation from every clinical AI vendor and confirm that no tool performs a licensed clinical function on its own (AB 1979). App developers with a companion style chatbot should first confirm whether it meets the Section 22601 definition, then start the SB 1119 risk assessment scope, since July 1, 2027 is close for a product release cycle. Note your prior year revenue too, because it determines whether the audit duty starts in 2029 or 2032.

Days 76 to 90: the applicability register. Write down every California AI law you have decided does not apply, the threshold or exemption you rely on, and the date you checked. Include AB 1609’s $500 million revenue floor, SB 951’s 75 person covered establishment threshold, and AB 2713’s 2,000,000 user floor. Set a calendar reminder to recheck in January 2027, after the next session starts. If you operate in more than one state, add Texas and Colorado; our TRAIGA explainer and Colorado employer guide cover their thresholds.

This article is provided for general informational purposes and reflects the state of the law as of October 2026. It is not legal advice. Regulations in this area are changing quickly. Confirm current requirements and consult qualified counsel before making decisions for your organization.