California's New AI Transparency Law Reaches Resellers

California's AI Transparency Act became fully operative on August 2, 2026, reaching past the company that built a generative AI system to the business that licenses and relabels it. If your MSP white-labels an AI tool that generates images, video, or audio for clients, your contract terms and configuration choices are now a compliance surface too.

What Does California's AI Transparency Act Actually Cover?

The law applies to any covered provider that creates or codes a generative AI system with more than 1,000,000 monthly visitors or users reachable in California, and its disclosure duties apply to image, video, and audio content, or any combination of those, that the system creates or alters. A covered provider must offer a free, public tool that lets anyone check whether a piece of content came from its system, plus a visible disclosure option and a hidden, machine-readable marker embedded in anything the system creates or alters. None of that depends on where the provider's headquarters sits. It depends on whether the content reaches a California audience.

The detection tool itself has to accept an uploaded file or a link, support an application programming interface so a business could run checks without visiting the provider's own site, and the provider cannot collect or retain personal information gathered from content submitted to it. None of that infrastructure burden shifts to you as a licensee directly, but it does mean every white-labeled AI content tool your MSP resells should already have this detection and disclosure plumbing built in, not bolted on after a client complaint.

Why Does This Reach MSPs Who Never Built an AI Model?

The statute does not stop at the company that trained the model. The Act requires a covered provider that licenses its system to a third party to contractually require that the licensee maintain the system's capability to include a latent disclosure in content it creates or alters. That licensing clause covers exactly the arrangement sitting underneath most white-labeled AI tools, where an MSP licenses someone else's engine and puts its own brand on top. If the provider later learns that a licensee modified the system so it can no longer include that disclosure, the provider must revoke the license within 96 hours of discovering it.

A licensee that keeps using the system after that revocation takes on its own exposure. State and local attorneys may seek injunctive relief and recover attorney's fees against a licensee that keeps operating a system after its license has been revoked, separate from whatever penalty the provider itself owes.

Does This Apply If Your MSP Isn't Based in California?

Yes. The Act's definition of a covered provider turns on where the content is reachable, not where the business is headquartered, so an MSP based in Ohio or Texas is in scope the moment a client's AI-generated image, video, or ad reaches a California audience. Most MSPs serving even a handful of multi-state clients clear that bar without ever opening a California office.

That extraterritorial reach is not unique to California, but it is one of the sharper versions of it so far because the law attaches to the content itself rather than to a company's registration or client base. A regional MSP with no plans to ever sign a California client can still trigger the law the moment a national client syndicates an AI-generated ad into a California market, or a remote employee in the state opens a piece of AI-produced content the MSP delivered somewhere else entirely.

Your Marketing Stack Is Probably Already in Scope

This is not a hypothetical compliance gap for some future AI product your MSP might build someday. A 2026 survey of MSPs by ConnectWise found that 60 percent are already using AI to support their marketing efforts, and 81 percent of those use it specifically for content creation, the exact category of output the Act regulates once it takes the form of an image, a video clip, or an audio voiceover. Most of that content gets produced through a licensed third-party tool wearing the MSP's own brand, not a model the MSP built in-house, which is the licensing relationship the Act's disclosure clause addresses directly.

Compliance Is Also a Positioning Opportunity

The MSPs that treat this as a one-time legal chore will miss the bigger play. An MSP that can tell a client exactly which disclosure markers its AI content tools carry, and show a documented process for what happens if a vendor revokes access, is selling something most competitors cannot yet show: proof that the AI work it delivers will not disappear mid-contract over a vendor dispute the client never saw coming. That is harder to copy than a lower price, and the advantage travels well into whatever state writes the next version of this law.

What Happens If Your Vendor Contract Gets This Wrong?

The financial exposure sits mostly with the provider, not the licensee. A covered provider that violates the Act is liable for a civil penalty of $5,000 per violation, with each day of noncompliance counted as a separate violation, collected by the Attorney General, a city attorney, or a county counsel. Your MSP is not the one writing that check in most arrangements, since you are typically the licensee rather than the provider. A revoked license you keep running anyway is a different problem, trading a civil penalty for an injunction and a fee award against your own business.

That revocation window is also under legislative review. An analysis from Morgan Lewis notes a pending amendment, not yet enacted, that would shorten the provider's revocation deadline from 96 hours to 72 hours, a change worth tracking if you are negotiating a multi-year AI licensing contract right now.

The same 2026 amendment that moved the law's start date also phases in duties for other parties. Large online platforms must detect and surface content provenance data starting January 1, 2027, and capture device manufacturers face their own latent-disclosure requirement starting January 1, 2028, neither of which applies to a typical MSP but both of which signal where the law is headed next.

How to Audit Your AI Vendor Contracts This Quarter

Consider a hypothetical mid-size MSP that resells a white-labeled AI video-ad generator to twenty clients under its own brand. One client asks the MSP's implementation team to strip the platform's visible watermark so an ad looks fully homemade, and the team obliges without checking the license terms first. If the vendor later discovers the change, the MSP's access to that tool could be cut off within days, mid-campaign, for every one of its twenty clients at once, not just the one that asked for the edit.

Start the review with the vendor agreement behind every AI content tool you resell under your own brand, not the master services agreement you hand clients. Look for whether the vendor names you as a licensee with disclosure obligations, whether the contract spells out a process if the vendor revokes your license, and whether you have any contractual right to notice before that happens. Orrick's analysis of the Act notes that businesses may want to renegotiate indemnification, audit rights, and modification restrictions in exactly this kind of licensing agreement.

Next, check your renewal calendar. A contract signed before the law's amended effective date may still bind you to whatever the vendor decides counts as compliance, since many of these agreements were drafted before that date existed. Flag any upcoming renewal for a legal read-through rather than a rubber stamp, and ask your vendor directly whether its detection tool and disclosure markers meet the Act's requirements today, not whether it plans to meet them eventually.

Put someone on your team in charge of this before a renewal forces the question. Whoever manages your AI marketing and content vendors should be able to read a licensing agreement for these clauses, not just the pricing page. Building that literacy now, before a provider sends a 96-hour notice you were not ready to act on over a weekend, is exactly the kind of staff development Forge University is built to support, turning a compliance blind spot into a documented skill on your team roster.

Pair that training with a clear map of where AI compliance work fits across your broader stack using the stack builder, and compare it against what you already run for clients on the full product page.

California will not be the last state to make a licensee, not just a vendor, a regulated party under its own AI law, and the MSPs that get their vendor contracts in order now will not be scrambling when the next one lands. See the full stack.