California's 2026 AI Laws: The Six That Change What Software Vendors Owe

California enacted more than two dozen AI laws in 2026, and most of them never touch a software vendor. Six do. One of them, SB 1000, took effect the day it was signed on 30 September and carries a $5,000 penalty for every day a violation continues. If you sell software into California, these California AI laws for 2026 decide what your product must log, disclose and prove.

What California's 2026 AI laws actually did

The short version: California passed a large volume of AI bills, and most of them regulate employers, health providers, public agencies and children's products. Very few touch the vendor directly. That is the most useful fact in this post, and it is easy to lose in the headlines.

The governor's signing window closed on 30 September 2026. The governor's release that day lists 13 bills, covering workplace surveillance, health care AI, the AI Transparency Act, digital replicas and automated decision systems. Two other bills that matter here, SB 813 and AB 1405, were signed earlier, on 9 September.

The count depends on who is counting

You will see several totals quoted for the year. Latham & Watkins says California enacted "more than two dozen AI laws." The Transparency Coalition describes nearly 30 AI safety measures for the year and a dozen on the final day. The governor's own list for 30 September has 13 entries.

None of these is wrong. They draw the boundary of "AI law" in different places. Treat any single number as a framing device, and work from the bill list instead. We use "more than two dozen" because it is the most conservative figure from a named legal source.

The No Robo Bosses Act was signed, not vetoed

Several summaries still describe the No Robo Bosses Act as vetoed. That was true of SB 7, which Newsom vetoed in October 2025 as unfocused and overly broad. In 2026, Senator Jerry McNerney returned with SB 947, a narrower version that dropped pre-use notification and coverage of contractors.

Newsom signed SB 947 on 30 September 2026. If your compliance team filed the robo bosses issue as closed last year, reopen it. It now has an operative date, a penalty and an enforcement agency.

The vendor compliance table: bill, obligation, date and official text

We used one test to choose the six. Does the bill change what a software product must do, or what a customer will demand in a contract? Bills that regulate only lawyers, public agencies or toy makers fail that test, however important they are elsewhere.

Effective dates below come from the bill summaries we read. Where a summary gave no date, we apply California's default rule: a statute signed in 2026 takes effect on 1 January 2027 unless the text says otherwise. We have flagged every row where that default is doing the work.

Bill links go to the official California Legislative Information page for each bill. Obligations are summarised from Latham & Watkins, WilmerHale and the Transparency Coalition, October 2026. Read the chaptered text before relying on any row for a compliance decision.

SB 1000 makes every generative AI provider a covered provider

SB 1000 is the bill most likely to reach your product this quarter. It amends the California AI Transparency Act, originally SB 942, which came into effect on 2 August 2026. The original act applied only to providers with more than 1 million monthly users. SB 1000 deletes that threshold.

Latham's reading is that coverage now reaches startups, open-source model providers, smaller SaaS platforms and enterprise-facing tools. Any person producing a generative AI system publicly accessible in California is in scope. If your product generates images, audio or video for users, assume you are now a covered provider.

What changed from SB 942

Three changes matter most for a product team. First, the manifest disclosure option is gone, and latent disclosures are now required for content the system "created or altered". Second, the detection tool becomes a "disclosure verification tool," and you may meet the duty by pointing users to a compliant third-party tool. Third, minor edits such as cropping, resizing and format conversion are excluded.

Two further details carry real money. The tool may only output personal provenance data after the user expressly consents. And a provider that falsely claims its system is assistive technology faces a civil penalty of $50,000 per violation, with each day counted separately.

The secondary coverage does not fully agree on the disclosure mechanics. WilmerHale and Latham describe the same bill with different emphasis on manifest disclosures. We follow Latham's more detailed account here, and you should confirm against the chaptered text before you change your output pipeline.

What a vendor should build first

Our position is that the cheapest compliant path for most SaaS vendors is a third-party verification tool plus latent metadata on every generated asset. Building your own detection tool is a cost with no commercial upside. The statute explicitly allows the third-party route, so take it.

Then check your export path. Many products strip metadata on download, resize or format conversion. Conversion is excluded from the alteration test, but stripping the latent disclosure is a separate problem. If you have previously mapped EU obligations, the EU AI Act transparency checklist covers much of the same engineering work.

AB 2713 and the provenance chain your platform must not break

AB 2713 regulates the other end of the same pipe. SB 1000 tells generators to embed provenance data. AB 2713 tells large online platforms not to throw it away.

The bill applies to public-facing platforms with more than 2 million unique monthly users that distribute content their users did not create. From 1 January 2027, such a platform must let users inspect provenance data. It can do that in its own interface, through a link to a third-party viewer, or by letting users download the data.

The platform also may not knowingly strip provenance data or digital signatures from uploaded or distributed content, to the extent technically feasible. That phrase "technically feasible" will carry most of the litigation weight. It will also carry most of your vendor conversations.

Most B2B vendors are not large online platforms. But if you sell media processing, content delivery, digital asset management or community software to a platform that is, expect a contract clause. The customer will ask you to warrant that your pipeline preserves provenance metadata. Decide now whether you can say yes, because a no will cost you the renewal, not a fine.

SB 947 turns HR software into evidence infrastructure

SB 947 regulates employers, not vendors. That is exactly why it matters to vendors. Every employer covered from 1 July 2027 will ask its HR, performance and workforce analytics providers one question: can your product help us prove a human checked this?

The law defines an automated decision system broadly. It covers machine learning, statistics, analytics or AI that issues a score, classification or recommendation used to "assist or replace human discretionary decision-making". Spam filters, firewalls, antivirus, identity and access tools, calculators and databases are excluded.

Employers may not rely solely on that output for discipline or termination. If they primarily rely on it, a human must corroborate the decision using the underlying data or other evidence such as evaluations, personnel files or peer reviews. Output that cannot be corroborated cannot be used. A written post-use notice must then name a human contact and state that retaliation is prohibited.

Enforcement sits with the Labor Commissioner or a public prosecutor, with a civil penalty of $500 per violation, plus injunctive relief, punitive damages and attorney's fees. Employers covered by the CCPA must also follow the California Privacy Protection Agency's automated decision-making regulations, so the two regimes stack.

What corroboration means inside a product

Corroboration is a record, not a feeling. Your product needs to show which data produced a score, who reviewed it, what other evidence they checked, and when. Employees can also request an anonymised description of their own data that the system used.

We think most HR vendors will treat this as a reporting feature and ship it late. That is the wrong call. The vendor that ships a reviewer workflow with an exportable audit trail before 1 July 2027 turns a legal duty into a sales argument. The design questions overlap heavily with human-in-the-loop architecture for agents.

AB 1883 removes a feature category outright

AB 1883 is the companion bill vendors should not miss. It bans workplace surveillance tools that use AI to recognise or infer emotional states or to collect neural data, with exceptions for national security and defence. Latham reports penalties of up to $500 per violation.

If your product sells sentiment scoring on employee calls, meetings or messages to California employers, that feature now needs a geofence or a removal plan. The broader legal line on monitoring is covered in the analysis of where AI employee monitoring becomes unlawful.

AB 1609 and SB 503 put disclosure and bias duties on support and health AI

These two bills look unrelated. They share one feature: each attaches an obligation to a specific class of AI product, rather than to AI in general. That makes them easier to scope and harder to ignore.

AB 1609 for customer service agents

AB 1609 applies to businesses with gross annual revenue over $500 million that serve California consumers. Their chatbot may not claim to be human. It must disclose that it is AI where a reasonable person would be misled.

The operational duty is the one that will hit support vendors. During business hours, a customer must be able to ask for a human. The business must make a good faith effort to connect them within 15 minutes, or schedule an appointment within one business day. Public prosecutors enforce it, with penalties of up to $5,000 for a first violation and $10,000 after that.

The vendor implication is direct. If you sell AI support agents to enterprises, your escalation path is now a compliance feature with a clock on it. Your product needs to measure time to human handoff and report it. The comparison of Agentforce, Fin and Breeze support agents is worth rereading with that metric in mind, because none of them was sold on it.

SB 503 for clinical decision support

SB 503 is one of the few 2026 bills that names the developer directly. Developers and deployers of AI clinical decision support must make reasonable efforts to identify known or reasonably foreseeable risks of biased impacts in health programs. They must then make reasonable efforts to reduce those risks.

"Reasonable efforts" is a standard that gets decided after the fact. The defensible position is documentation you produced before the complaint arrived: intended uses, known risks, test results by population, and what you changed. If you sell into health systems, expect that documentation to become a procurement requirement within a year, whatever the enforcement record turns out to be.

AB 1405 and SB 813 build California's AI audit market

These two bills, signed on 9 September 2026, do not tell any company it must be audited. Latham is explicit that SB 813 "does not create an independent audit mandate for private companies." What they do is define who is allowed to audit, and on what terms.

SB 813 tells the Government Operations Agency to set criteria for independent verification organisations that assess AI systems for risk and compliance. AB 1405 creates a mandatory AI Auditor Registry. An unregistered person or firm may not offer, sell or conduct an AI audit used for compliance with California law. WilmerHale reports that registered auditors must keep records for at least 10 years.

Then the timelines moved. On 18 September, Executive Order N-9-26 directed the agency to accelerate both. According to Latham, the IVO criteria deadline moved from 1 January 2028 to 1 May 2027, and the registry moved from 1 January 2029 to 1 December 2027.

For a vendor, the registry changes one practical thing. From the registry date, an audit report you hand a California customer as evidence of compliance has to come from a registered auditor. An attestation from an unregistered consultancy may still be useful, and it will be worth less. If audit evidence already sits in your sales process, the overlap with what SOC 2 auditors now ask for on AI is substantial.

Where this reading is weakest

This post works from secondary legal summaries, not from the chaptered text. The official California legislative site refused our automated requests during research, so every obligation above is summarised from Latham & Watkins, WilmerHale, the Transparency Coalition and the governor's releases. Those are credible sources, and they do disagree in places. SB 1000's disclosure mechanics and SB 951's notice threshold are two examples.

The default effective date is an inference. For AB 1609 and SB 503, none of the summaries we read stated an effective date. We applied California's general rule that a 2026 statute takes effect on 1 January 2027. A delayed operative date written into the text would override that, and we could not rule it out.

The selection is a judgement call. A reasonable reader would swap AB 1883 or SB 1119 in for SB 503. SB 1119 adds child-safety audits and a private right of action for companion chatbot operators, which is the only private right of action WilmerHale identified in the package. We left it out because few B2B vendors operate companion chatbots for minors. If you do, it belongs at the top of your list.

Finally, the executive order dates are targets for a state agency, not obligations on you. Agencies miss accelerated deadlines often. We would still plan to the earlier date, because the cost of being early is a few months of paperwork. The cost of being late is a customer whose auditor cannot sign.

Frequently asked questions

Where to start before the next renewal cycle

Run one check this week, and draft one document.

The check: generate an asset in your product, export it the way a customer would, and inspect the file for latent provenance metadata. If nothing survives the export, you have an SB 1000 problem that has been accruing since 30 September. That is the only item in this post with a daily meter already running.

The document: a one-page California AI addendum for your sales team, mapping each row of the table above to a yes, a no, or a date. Your customers' procurement teams will send the questions anyway. The AI agent procurement checklist shows the shape those questions usually take, and answering them before they arrive is cheaper than answering them under deadline.

Related reading