California SB 1000 is sitting on Assembly third reading right now, and the Legislature has until midnight on 31 August to pass it. It amends the California AI Transparency Act, which has only been operative since 2 August. If you ship model weights, or host anyone else’s, you should read it before it becomes law rather than after.
The bill has an urgency clause. That means a two-thirds vote in both houses, and it also means the thing takes effect the moment the Governor signs it. No 1 January lead time. The Governor has until 30 September.
Most of the coverage frames SB 1000 as an AI deepfake-labeling bill, which it is. That framing misses the part that matters if you work on open models.
What the Act does today
The California AI Transparency Act, as amended by AB 853 last October, applies to a covered provider: someone who creates, codes, or otherwise produces a generative AI system with over 1,000,000 monthly visitors or users that is publicly accessible in California. If you’re a covered provider, you owe three things. A free public AI detection tool with an API. An option for users to attach a visible manifest disclosure to generated images, video, or audio. And a latent disclosure, machine-readable, embedded in all such content, carrying your name, the system name and version, a timestamp, and a unique identifier, “permanent or extraordinarily difficult to remove, to the extent it is technically feasible.”
Text is out of scope. Only image, video, and audio. Penalties are $5,000 per violation, each day counting separately, enforced by the Attorney General, a city attorney, or a county counsel. No private right of action.
At a million monthly users the statute reaches maybe a dozen companies, all of whom have a compliance department and a C2PA implementation already.
The change that matters is four words long
SB 1000 deletes “that has over 1,000,000 monthly visitors or users” from the definition of covered provider. That’s it. After the edit, a covered provider is “a person that creates, codes, or otherwise produces a generative artificial intelligence system that is publicly accessible within the geographic boundaries of the state.”
Publicly accessible. No threshold. If you push a Stable Diffusion fine-tune to a public repo and someone in Sacramento can download it, you have produced a publicly accessible GenAI system, and every obligation in the chapter now attaches to you personally.
The bill softens this in one genuinely useful way. New Section 22757.2(e) lets you satisfy the detection-tool requirement by pointing users at a compliant third-party tool, as long as it works with your disclosures and is reachable from your interface. That is the difference between “operate a public detection API forever” and “link to someone else’s.” Nobody’s summary of this bill mentions subdivision (e). It is the most important thing in it for small providers, and it only appeared in the 9 June Assembly amendment.
Where it lands on open weights
Section 22757.3.2, added by AB 853 and operative 1 January 2027, is one sentence:
A GenAI system hosting platform shall not knowingly make available a GenAI system that does not place disclosures pursuant to Section 22757.3.
And a GenAI hosting platform is defined as “an internet website or application that makes available for download the source code or model weights [of] a generative artificial intelligence system by a resident of the state, regardless of whether the terms of that use include compensation.” That definition is ungrammatical in the statute as enacted, and the bill carries the error forward unchanged, but its target is not ambiguous. It is Hugging Face. It is GitHub. It is your project’s release page and your university’s mirror. There is no size threshold on hosting platforms and there never was one.
Chain the two provisions together. Today, a hosting platform only has to worry about weights from the dozen companies over the user threshold. Delete the threshold and Section 22757.3.2 becomes a duty not to knowingly host any non-compliant model weights, from anyone, worldwide. From 1 January 2027, with penalties at $5,000 a pop.
I don’t think that’s what Senator Becker is aiming at. I do think it’s what the text says, and “knowingly” is the only thing standing between a model hub and a very bad quarter. The predictable response from a platform’s counsel is not careful per-model assessment. It’s a filter, or geoblocking, or a policy that weights only go up with attestation. None of those outcomes is good, and none of them requires anyone to have intended them.
The revocation clause, and why the fair version is less alarming than you’ve heard
Section 22757.3(b) is the provision GitHub’s coalition objected to publicly, and it’s the one you’ll see described as incompatible with open source licensing. In the current draft, if you license your GenAI system to a third party, you must require by contract that the system stays compliant and that you may revoke authorization if the licensee breaks compliance. If you learn an identifiable licensee has modified the system out of compliance, you must terminate that licensee’s authorization within 72 hours. The licensee must then stop using or making available the system, “including a copy or modified version.”
The objection writes itself. An Apache-2.0 or MIT grant is irrevocable. You cannot terminate it for non-compliance with a California statute, and you certainly cannot order a downstream recipient to stop redistributing. Bradley Kuhn made roughly this argument in reverse back in July, pointing out that GitHub has the mechanics wrong and that the whole fight is moot because the systems in question aren’t FOSS anyway.
Kuhn is right about the mechanics and I think he’s right that this is mostly a proxy fight. Two amendments on 9 June blunted the objection considerably, and I have not seen either mentioned in the commentary. Subdivision (b)(2) now applies only to an “identifiable” third-party licensee. And a new (b)(4) says flatly:
This subdivision does not require a covered provider to monitor, investigate, or otherwise inquire into a third-party licensee’s use or modification of a licensed GenAI system.
So there is no surveillance duty and no obligation to chase anonymous downstream forks. If you publish weights under a permissive license, you have no licensees in the relevant sense, nothing to terminate, and no duty to go looking. Subdivision (b) is close to a no-op for you.
Where it stays broken is (b)(3), the redistribution prohibition. It presumes a world in which a provider’s termination decision can reach through a chain of recipients and stop republication. Copyleft and permissive licenses both exist specifically to make that impossible. This isn’t a drafting slip you can patch with an “identifiable” here and there. The subdivision assumes a licensing model that open distribution does not have, and no amount of qualification fixes an assumption.
Technical feasibility is the actual escape hatch
Read Section 22757.3(a) as SB 1000 would rewrite it. The whole obligation is now prefaced with “To the extent it is technically feasible.” And (a)(2) requires the disclosure be “permanent or extraordinarily difficult to remove or tamper with,” with the internal feasibility caveat deleted from that criterion specifically.
Think about what that means when the user has your weights. They can patch out your watermarking step in an afternoon. They can fine-tune it away. There is no version of open-weight distribution in which an embedded disclosure is extraordinarily difficult to remove, because the adversary owns the model. So either the front-loaded feasibility clause swallows the requirement for open weights entirely, or it doesn’t and open weights are simply illegal to publish in California. Those are very different worlds and the statute does not say which one you’re in.
That ambiguity is fine at a million users, where you can afford to ask a lawyer. It is not fine as a condition of pushing a fine-tune.
I’d also note that the definition of provenance data now requires a format “compliant, or interoperable with, widely adopted specifications adopted by an established standards-setting body.” The statute names no standard. In practice there is exactly one candidate for image, video, and audio, which is C2PA Content Credentials. So the bill is technology-agnostic in the way that a specification requiring a widely adopted relational query language is database-agnostic.
The bill does not compile
Since we’re all engineers here, some notes from a careful read.
Section 22757.4(c), the enforcement provision, authorizes an injunction against a third-party licensee who violates “paragraph (3) of subdivision (c) of Section 22757.3.” In current law that’s the licensee cease-use rule. SB 1000 moves the licensing provisions from subdivision (c) to subdivision (b), and does not amend Section 22757.4. The only enforcement hook against downstream licensees would point at a subdivision that no longer exists. A dangling pointer, shipped.
The bill renames “AI detection tool” to “disclosure verification tool” throughout, except in 22757.2(b) and 22757.2(c), which both end up reading “AI disclosure verification tool.” Find-and-replace, no review pass.
The definitions of “latent” and “manifest” are deleted, since the manifest disclosure option is being removed. The operative requirement in 22757.3 still says “latent disclosure.” The defined term is gone and the usage remains.
“Resampling” was quietly dropped from the list of minor modifications. Resizing became “file resizing” and format conversions became “file format conversions.” So resampling audio is now an alteration that triggers disclosure obligations, while resizing the file does not. I assume this was deliberate. It reads like nobody asked an audio engineer.
For the record, deleting the manifest option is defensible. The legislative findings say conflicting manifest and latent provenance data damages trust in both, which is true, and one reliable machine-readable signal beats a visible label users strip and re-upload. That part is a real engineering judgment and I have no complaint about it.
What to actually do
If you publish or host model weights, the dates you care about are 31 August, when SB 1000 lives or dies, and 1 January 2027, when Section 22757.3.2 binds hosting platforms regardless of what happens to SB 1000. That second date is already law. It does not depend on this bill at all. What SB 1000 changes is how much of the world falls inside it.
Nothing about the current Act requires you to do anything today unless you’re over a million monthly users. But if you maintain a model hub, a release pipeline, or a mirror, the question “can we tell whether a given set of weights emits C2PA-compliant provenance data” is one you want answered before the end of the year, because “knowingly” is a fact about your internal processes and someone else will characterize it for you.
And if you have an opinion about the threshold deletion, the Assembly floor session runs through 31 August. After that it’s the Governor’s desk until 30 September, and then it’s just the law.