California SB 1000 Is Signed. What Every Professional Services Firm Must Know About AI Disclosure.
California SB 1000 Is Signed. What Every Professional Services Firm Must Know About AI Disclosure.
Governor Newsom signed California SB 1000 on September 30, 2026 — the same day he signed SB 947. The bill is an urgency measure, meaning it took effect immediately. No waiting for January 1.
The change that matters most is a deletion. Four words removed from one definition: "that has over 1,000,000 monthly visitors or users."
Those four words were the reason most AI tools used by professional services firms — Harvey, Clio Duo, Karbon Kai, CoCounsel — were likely not covered by California's existing AI transparency law. Under the new definition, they are.
Here is what that means for your firm.
What SB 1000 Changes: The 1M Threshold Is Gone
California already had an AI transparency law. The AI Transparency Act (SB 942) became operative on August 2, 2026. It required covered providers to offer users a disclosure verification tool and embed machine-readable latent disclosures — provenance metadata — in AI-generated content.
The law was narrower than it sounded. A "covered provider" was defined as a company with over 1,000,000 monthly users. That kept the obligations on roughly a dozen large companies: OpenAI, Google, Anthropic, Meta, and a handful of others.
SB 1000 deletes the million-user threshold. The revised definition now reads: a "covered provider" is "a person that creates, codes, or otherwise produces a generative artificial intelligence system that is publicly accessible within the geographic boundaries of the state."
The expansion is large. From roughly a dozen large tech companies to potentially any developer or company that releases a publicly accessible generative AI system that California users can reach — which includes every purpose-built professional services AI tool on the market.
Who Has to Comply: Your AI Vendor, Not You (Probably)
The compliance obligations under SB 1000 fall on covered providers — your AI tool vendors — not on the firms using those tools.
If you use Harvey, Harvey is the covered provider. Harvey must offer a disclosure verification tool and embed latent disclosures in the content their system generates. If you use Clio Duo, Clio is responsible. Your firm, as a client using an off-the-shelf tool, is not the covered provider under SB 1000.
Three specific obligations now apply to covered providers:
Effective September 30, 2026:
- Offer a free disclosure verification tool that lets users determine whether content was created or altered by the provider's AI system
- Embed latent disclosures in AI-generated content: provider name, system name and version, creation or alteration timestamp, unique identifier, and whether the system created or altered the content
- Penalties: $5,000 per violation per day
Effective January 1, 2027:
- Hosting platforms (GitHub model repositories, Hugging Face, etc.) must ensure hosted generative AI systems include the required disclosures
- Large online platforms must detect, preserve, and surface provenance data to users
Effective January 1, 2029:
- Covered providers must indicate whether their system is designed primarily as assistive technology, with $50,000 penalties for false claims
The practical effect on your experience with Harvey or Clio Duo: AI-generated content from compliant tools will carry new embedded metadata. You may not see it — latent disclosures are machine-readable, not visible labels. But the provenance data is in the file.
One Exception: If Your Firm Has Built a Client-Facing AI Tool
Most professional services firms are users of AI tools, not builders of them. If that describes your firm, SB 1000 is your vendor's compliance problem, not yours.
The exception is firms that have built and deployed their own AI systems to clients. A consulting firm with a proprietary AI analysis tool that client contacts log into. A law firm with a custom AI document generator accessible via a client portal. A staffing agency with a candidate-matching AI that recruiters and hiring managers both access.
If that tool is a generative AI system and California clients or contacts can access it, your firm may be a covered provider under the amended definition. The law covers anyone who "creates, codes, or otherwise produces" such a system — the firm that built it, not only the underlying model provider.
If this describes any tool your firm has deployed, consult legal counsel on whether SB 1000 applies to you directly.
The One Question to Ask Your AI Vendor Now
Your AI tools should be moving to implement SB 1000 requirements. Vendors that do not could be subject to $5,000-per-day penalties, which is a meaningful risk signal for vendor stability.
Do not wait for an update notification or a compliance email. The next time you are in a vendor review, renewal conversation, or procurement discussion, ask directly:
"How are you implementing SB 1000's latent disclosure requirements, and what is your timeline for full compliance?"
A vendor that answers clearly — specific implementation plan, specific date — is managing this responsibly. A vendor that doesn't know what you're asking about, or can't give a timeline, has not done the work. That is relevant to your vendor due diligence.
For Attorneys: SB 1000 and State Bar Ethics Are Two Different Rules
Attorneys have another layer to track, and it is separate.
SB 1000 governs AI content provenance — whether AI-generated documents carry embedded metadata that identifies the AI system that created them. It does not govern whether an attorney must tell their client that a brief or memo was written with AI assistance.
That question is a California State Bar ethics question, not an SB 1000 question. The California Rules of Professional Conduct and existing guidance on competent representation govern when and how attorneys disclose AI use to clients. Those obligations exist independent of SB 1000.
For attorneys: SB 1000 compliance is primarily your tool vendors' responsibility. Your ethics obligations around client disclosure are separate, arise from bar rules, and are worth confirming with your ethics counsel or reviewing against any State Bar guidance specific to AI use.
What to Do This Week
If your firm uses off-the-shelf AI tools like Harvey, Clio Duo, Karbon Kai, or any other commercially available generative AI platform:
- Add one question to your next AI vendor review: "How are you complying with California SB 1000, and by when?" Log the response.
- Check whether your firm has built or deployed any client-facing AI system. If yes, talk to your legal counsel about whether your firm may be a covered provider.
- If you are a California attorney: distinguish your SB 1000 question (vendor compliance) from your ethics question (client disclosure). They are related but governed by different rules.
The compliance burden here is not yours to carry — it is your vendors'. But knowing the law exists and asking the right questions protects you when it matters.
California SB 1000 is part of an accelerating state regulatory stack. See also: California SB 574 signed (law firm AI compliance), California SB 947 signed (staffing and consulting AI employment decisions), and multi-state AI compliance for professional services firms.
Frequently Asked Questions
Does California SB 1000 require my law firm to disclose AI use to clients?
SB 1000 does not directly require your law firm to disclose AI use to clients. SB 1000 governs AI content provenance — it places disclosure obligations on covered providers (your AI tool vendors), not on the firms using those tools. For attorneys, the question of whether you must tell clients a memo was AI-generated is a California State Bar ethics question, not an SB 1000 question. Those are two separate regulatory layers.
Are Harvey, Clio Duo, and Karbon Kai covered providers under SB 1000?
Under SB 1000 — which removed the 1,000,000 monthly user threshold from the original California AI Transparency Act — yes. Any generative AI system publicly accessible in California is now a covered provider, regardless of user count. Harvey, Clio Duo, and Karbon Kai are all enterprise SaaS tools accessible to California subscribers, which means each is likely a covered provider under the amended definition. Each vendor must now offer a disclosure verification tool and embed latent provenance data in their AI-generated content.
What happens if my AI vendor is not SB 1000 compliant?
Penalties fall on the covered provider (your vendor), not your firm. But if your AI vendor is non-compliant, two practical consequences follow: first, AI-generated content delivered through their tool may not carry the required machine-readable latent disclosures, which could matter to California clients who check for provenance. Second, ongoing non-compliance signals a vendor that is not managing legal risk responsibly. During your next AI contract review or renewal, ask vendors directly: 'How are you implementing SB 1000 latent disclosure requirements and by when?' If they cannot answer, that is worth noting.
My firm built a custom AI tool for client deliverables — does SB 1000 apply to us?
It might. SB 1000 defines a covered provider as anyone who 'creates, codes, or otherwise produces a generative AI system that is publicly accessible' in California. If your consulting or law firm built a proprietary AI tool that clients in California can access directly — a client portal, a document automation system, an AI-assisted research tool — your firm may itself be a covered provider. The line is between using an AI tool (generally not a covered provider) and creating or deploying one to clients (potentially a covered provider). If this applies to your firm, consult your own legal counsel.
Get the weekly briefing
AI adoption intelligence for accounting, law, and consulting firms. Free to start.
Related Reading
- California SB 574 Is Law: What Your Firm Must Do Before January 1, 2027
- California SB 947 Is Signed. What Staffing and Consulting Firms Must Do Before July 1, 2027.
- Washington HB 1170: The AI Disclosure Law That Will Change What You Send to Clients
- California's AI Law Is Real. Does It Actually Apply to Your Professional Services Firm?
- Multi-State AI Compliance for Professional Services Firms in 2026: A Practical Guide
This is the kind of intelligence premium subscribers get every week.
Deep analysis, cross-sector patterns, and the frameworks that help professional services firms make the crossing.