California's AI Disclosure Laws Take Effect August 2. Here's What Your Small Business Actually Has to Do.

On August 2, 2026, California's AI Transparency Act (SB 942) goes live. If you have seen the headlines, you have probably also seen two opposite claims: that this is an existential compliance nightmare for every business using ChatGPT, and that it only applies to a handful of big tech companies and you can ignore it. Both are wrong. The truth is in the middle, and the middle is where the actual money risk sits. SB 942 itself does target large generative AI providers with more than one million monthly California users. But California did not stop there. It stacked four separate AI disclosure laws on top of each other between January 2025 and August 2026, and several of those do apply directly to a two-person shop in Riverside, a dental practice in Irvine, or a contractor in San Diego. This post breaks down what each law requires, who it actually covers, what the penalties are, and what a small business owner in Southern California should do this week to stay on the right side of all four.

Aug 1, 2026 Category: Security 9 min read

The Four Laws, in Plain English

California did not pass one AI law. It passed four, each aimed at a different risk. They go live on different dates and apply to different businesses. Here is the full stack:

AB 2905 (effective January 1, 2025) — AI voice robocall disclosure. If your business places outbound calls using an artificial or AI-generated voice, you must disclose at the start of the call that the voice is artificial. Applies to every business, regardless of size.
AB 2013 (effective January 1, 2026) — AI training data transparency. Requires developers of generative AI systems available to Californians to post documentation about the data used to train their models. Applies to AI developers, not to small businesses using off-the-shelf tools.
SB 243 (effective January 1, 2026) — Chatbot disclosure. Requires businesses to clearly disclose when a user is interacting with an AI chatbot. Applies to businesses operating chatbots that interact with California consumers.
SB 942 (effective August 2, 2026) — AI Transparency Act (CAITA). Requires large generative AI providers (1 million+ monthly California users) to embed provenance markers in AI-generated images, video, and audio, and to offer a free AI detector tool. Applies to covered providers, not to end users.

Notice the pattern. Two of these laws (AB 2905 and SB 243) apply to any business that uses the technology. Two (AB 2013 and SB 942) apply to the companies building the technology. If you run a small business, the first two are the ones that can actually cost you money.

SB 942 Itself: Why You Still Care

SB 942 is the headline law, and it is also the one most likely to be misread. The covered-provider threshold is 1 million or more monthly California users, which means OpenAI, Anthropic, Google, Meta, Midjourney, and a short list of others. Your seven-person marketing agency is not a covered provider. Neither is the chatbot you bought from a SaaS vendor.

So why should you care? Because SB 942 changes what flows through your business even though you are not the one regulated. Starting August 2, the images and audio you generate inside ChatGPT, Midjourney, ElevenLabs, and similar tools will start arriving with C2PA provenance metadata attached. That metadata is invisible to the eye but readable by platforms, ad networks, and increasingly by detection tools. The downstream effect: content you publish may be flagged as AI-generated by Facebook, Instagram, Google Ads, or news partners whether you label it or not. The practical move is not to fight it. The practical move is to know it is there, to not strip the metadata when you export, and to add your own visible label on top when the content is obviously synthetic.

Enforcement of SB 942 sits with the California Attorney General, city attorneys, and county counsel. The civil penalty is $5,000 per violation, and a violation is counted per piece of undisclosed content. That math is brutal for a covered provider; it is irrelevant for you. What matters for you is the next two laws.

AB 2905: The AI Voice Law That Already Applies to You

If your business uses an AI voice agent to make outbound calls — appointment reminders, follow-ups, lead callbacks, collection notices — AB 2905 has applied to you since January 1, 2025. The rule is short: at the start of every call, the AI must clearly disclose that the voice is artificial. Not buried in a terms page. Not in the third sentence. At the start.

This is the law most SoCal small businesses are quietly breaking. A lot of off-the-shelf AI phone tools ship with the disclosure set to off by default, or buried under a natural-sounding greeting that makes the caller think they are talking to a person. If a consumer records the call and complains, you are on the hook. The Federal TCPA layer stacks on top, and the combined exposure for a small batch of undisclosed AI calls can clear five figures in penalties and legal fees fast.

The fix takes 10 minutes. Open your AI phone vendor's settings, find the disclosure toggle, turn it on, and test by calling your own cell phone. If the first words out of the AI's mouth are not some version of "Hi, this is an AI assistant calling from [Business Name]," you are not compliant. Fix it today.

SB 243: The Chatbot Disclosure Law

SB 243 took effect January 1, 2026, and it covers any business operating a chatbot that interacts with California consumers. "Chatbot" here means an automated system powered by AI or similar logic that converses with a user. If your website has a chat widget that answers customer questions, books appointments, or qualifies leads, this applies to you.

The requirement is clear disclosure. The user has to know they are talking to an AI before the conversation meaningfully progresses. Best practice, and the safest reading of the law, is a visible label on the widget itself ("Chat with our AI assistant") and a first message from the bot that identifies itself as automated. Hiding the disclosure in a tooltip or in fine print does not meet the spirit of the law and increasingly will not meet the letter either.

This is low-cost to fix and high-cost to ignore. A plaintiff's firm in California can pull up your site, screenshot a chat conversation where the bot never identified itself, and start a demand letter. The same firms that drove the ADA website lawsuit wave in 2024 and 2025 are pivoting to AI disclosure as the next volume practice. You do not want to be in the first batch of named defendants.

AB 2013: The One You Can Mostly Ignore

AB 2013, the AI Training Data Transparency Act, took effect January 1, 2026. It requires developers of generative AI systems to publish documentation about the data used to train their models. If you do not train your own models — and almost no small business does — this law does not directly apply to you.

The one edge case: if your business fine-tunes a model on customer data and makes that model available to California users, you may be in scope. For the vast majority of small businesses using ChatGPT, Claude, or a packaged AI tool, AB 2013 is the vendor's problem, not yours. Confirm with your vendor that they have published their training data documentation, file the response, and move on.

The Honest Cost of Non-Compliance

The penalty structure across these four laws varies, and the numbers are worth staring at:

SB 942 (covered providers only): $5,000 per violation, enforced by the California Attorney General, city attorneys, and county counsel.
AB 2905 (AI voice calls): California Attorney General enforcement, layered on top of federal TCPA exposure that can run $500–$1,500 per call for willful violations.
SB 243 (chatbots): California Attorney General enforcement, plus exposure under the broader Unfair Competition Law and the consumer-protection statutes the AG has said already apply to AI.
Related AI provisions (Pillsbury Law's March 2026 analysis): up to $1 million per violation for certain AI-related conduct enforced by the California Attorney General.

The realistic exposure for a small business is not the headline $1 million figure. It is the plaintiff's-firm demand-letter economy. A well-documented AI disclosure violation settles in the $5,000–$25,000 range before it ever reaches a courtroom, plus your own legal fees. That is the price of a new piece of equipment, not a company-ending judgment — but it is also a completely avoidable cost.

The Five-Point Compliance Checklist

Here is what a California small business should do this week. Total time investment: under two hours.

Audit your AI touchpoints. List every place a customer or prospect interacts with AI at your business: chatbots on the website, AI voice agents on the phone, AI-generated images in ads, AI-written email sequences. If you do not know where AI touches your customers, you cannot disclose it.
Fix the AI voice disclosure. Open your AI phone vendor settings. Turn on the artificial-voice disclosure. Test by calling yourself. If the first sentence does not identify the call as AI, fix it before your next outbound campaign.
Label the chatbot. Add a visible "AI assistant" label to your website chat widget. Update the bot's first message to identify itself as automated. Takes 15 minutes in most chat platforms.
Do not strip image metadata. When you export AI-generated images from ChatGPT, Midjourney, or other covered tools, leave the C2PA provenance metadata intact. For obviously synthetic images used in ads, add a visible "AI-generated" label on top.
Document the audit. Write a one-page note dated today listing what you checked, what you fixed, and when. If a demand letter ever arrives, a dated internal compliance record is your strongest defense.

None of this requires a lawyer on retainer. None of it requires new software. It requires 90 minutes and the willingness to open the settings panels you have been avoiding.

What Is Coming Next

The August 2 SB 942 effective date is not the end of California's AI rulemaking. It is the middle of it. The AG's office has said publicly that existing California consumer-protection, civil-rights, and competition laws already apply to AI, which means enforcement does not wait for new statutes. The plaintiff's bar has noticed. ADA-style website litigation peaked in 2024, CIPA cookie-and-pixel litigation peaked in 2025, and AI disclosure litigation is the obvious 2026 and 2027 target.

The businesses that get ahead of this now will spend a few hours and a few hundred dollars. The businesses that wait will spend ten to a hundred times that responding to a demand letter, plus the distraction of dealing with it. California has given small business owners roughly 18 months of lead time on every one of these laws. The lead time is running out.

The Takeaway for SoCal Owners

You do not need to comply with SB 942 itself — that is OpenAI's and Anthropic's job. You do need to comply with AB 2905 if you use AI voice calls, SB 243 if you run a chatbot, and the general California consumer-protection framework if you publish AI-generated content. The fixes are small, the penalties are not, and the deadline for the biggest of the four laws is tomorrow. Run the five-point checklist this week. If you are not sure whether a given AI tool at your business is covered, treat it as covered until you confirm otherwise. That is the conservative read, and in California in 2026, the conservative read is the cheap one.

Sources

Not Sure If Your AI Tools Are Compliant?

PepeWebTech builds and audits AI automation for small businesses across Southern California — voice agents, chatbots, AI-generated ad content, and the disclosure layer that keeps all of it legal under California's 2025–2026 AI laws. Book a free 30-minute compliance review and we will map every AI touchpoint at your business, flag what needs a disclosure, and tell you exactly what to fix first.

Book a Free AI Compliance Review