CDTFA Proposes Emergency Regulations to Implement California’s New Sales and Use Tax on Digital Products

By Priscilla Ayn Parrett, Geoffrey L. Gunnerson, Tony Caldwell, Monique Torres, and Nida Salim Rais

Overview

As discussed in our August 2026 Legal Alert, on June 29, 2026, Governor Newsom signed Senate Bill 122 (SB 122) into law, marking the most significant expansion of California’s sales and use tax base in decades. Effective January 1, 2027, SB 122 extends California’s sales and use tax to prewritten computer software, whether delivered on tangible storage media, transferred electronically, or accessed remotely, including Software as a Service (SaaS).

On September 1, 2026, the California Department of Tax and Fee Administration (CDTFA) published a Discussion Paper with proposed emergency regulations (the Draft Regulations) to implement the new law. The Draft Regulations are not final. The CDTFA held an interested parties meeting on September 10, 2026, is actively soliciting public comments through September 24, 2026, and the regulations remain subject to revision before they are finalized, which is expected before year-end. During the interested parties meeting, many practitioners and business group representatives expressed concern that the Draft Regulations diverge from practices in other states and may impose extraordinary burdens on businesses. The CDTFA indicated that they would review and consider the comments made at the meeting when working on subsequent drafts.

The discussion below reflects the Draft Regulations as currently proposed, but companies should be aware that specific provisions may change in the final version and should continue to monitor this issue closely.

What Is a Taxable “Digital Product”

SB 122 redefines “tangible personal property” to include a “digital product,” which means “prewritten computer software transferred on tangible storage media, transferred electronically, or accessed remotely.” (RTC § 6016.1(a); Proposed Reg. 1600(a)(6)). The Draft Regulations, as currently proposed, confirm that this definition includes, but is not limited to, SaaS and other computer applications accessed via the cloud. (Proposed Reg. 1600(a)(6)).

Key exclusions from the definition of “digital product” under the statute and Draft Regulations include:

(RTC § 6016.1(b); Proposed Reg. 1600(a)(6)(A) – (G)).

Separately, custom computer software prepared for a special order of a single customer remains outside the scope of the tax. (Proposed Reg. 1502.2). However, if charges for the prewritten software and custom modifications are combined into a single amount, the entire charge may be taxable unless the modification is sufficiently significant for the resulting software to qualify as custom software under the Draft Regulations. Vendors and purchasers should therefore consider separately identifying custom development and modification charges in statements of work, order forms, and invoices.

The exclusion for “digital infrastructure” is particularly noteworthy. The Draft Regulations describe digital infrastructure as “cloud-based Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) that allow customers to create, deploy, or run their own software application.” (RTC § 6016.1(c)(8); Proposed Reg. 1600(a)(6)(E)). This is the first clear indication from the CDTFA that PaaS and IaaS offerings may fall outside the tax base. However, the boundary between taxable SaaS and excluded digital infrastructure remains unclear for many hybrid, managed, and highly configurable offerings. This is an area where the final regulations will hopefully provide additional clarity. Companies should begin to evaluate whether their products and services fall within the IaaS or PaaS framework as opposed to soon to be taxable SaaS.

The “Human Effort” Service Exemption

SB 122 exempts a digital product that represents a service provided in electronic form if (1) the service primarily involves the application of human effort by the service provider, and (2) the human effort originated after the customer requested the service. (RTC § 6372.1(a); Proposed Reg. 1600(g)(3)). However, the statute expressly provides that this exemption does not apply to the right to use the provider’s computer software running on a cloud infrastructure or accessed through a web browser or program interface (RTC § 6372.1(b)). Therefore, it appears that standard SaaS products would remain taxable even when delivered alongside human services.

Companies should carefully evaluate bundled offerings to determine whether the transaction qualifies as an electronically delivered service that primarily involves human-effort following customer request, or instead the right to use a taxable prewritten software product. Because the Draft Regulations do not yet provide detailed guidance or examples on how “primarily” will be interpreted, this exemption could be narrowed or clarified in the final regulations. Contract descriptions and separately stated charges may become particularly important where an offering combines professional services with access to a software platform.

AI and Emerging Technology

The Draft Regulations include an example addressing artificial intelligence (AI) technologies. (Proposed Reg. 1502.2, Example 2). An AI-powered tax-analysis tool embedded in a prewritten compliance platform (e.g., one that generates outputs trained on California tax statutes) is not considered custom computer software even though its outputs appear tailored to a specific use case. Instead, under the Draft Regulation, the CDTFA will treat such AI tools as generalized machine-learning systems sold or licensed to many customers, meaning they are taxable prewritten software. (Proposed Reg. 1502.2(b)). While the example does not establish that all AI-enabled products are taxable, it does illustrate that training or configuring a generalized machine-learning system for a particular jurisdiction or use case does not, without more, transform software offered to multiple customers into custom software prepared to the special order of a single customer. Companies that sell or purchase AI-enabled products should assess whether their offerings will now fall within the taxable “digital product” definition.

The $5 Million Threshold and Direct Payment Permits

SB 122 introduces a $5 million annual threshold that shifts tax collection obligations from the seller to the purchaser. (RTC § 6052; Proposed Reg. 1600.1). If a retailer’s gross receipts from sales of digital products transferred electronically or accessed remotely to a single purchaser exceed $5 million in a calendar year, the retailer is relieved of its sales tax obligation, and the purchaser must self-assess use tax and obtain a use tax direct payment permit from the CDTFA. (RTC § 6052(b); Proposed Reg. 1600.1(a) – (c)). This threshold applies during the 2027-2031 calendar years and will be adjusted for inflation thereafter. (RTC § 6052(a)(2); Proposed Reg. 1600.1(b)). For 2027, the threshold is measured using the retailer’s aggregate gross receipts from qualifying digital-product sales to the purchaser during the current calendar year. Beginning in 2028, the test considers the current or immediately preceding calendar year.

The purchaser may apply for a waiver from the CDTFA, which, if granted, shifts the obligation back to the retailer. (RTC § 6052(c); Proposed Reg. 1600.1(d)). Waiver requests must be submitted prior to any purchase to which the purchaser intends the waiver to apply. (Proposed Reg. 1600.1(d)(4)).

Sourcing Rules and Multiple Points of Use

For digital products that are not transferred on tangible storage media and not sold in person, SB 122 sources the sale to the purchaser’s known address in California as shown in the seller’s records. (RTC § 6010.5(b)(3)(A); Proposed Reg. 1600(d)(2)(A)). If the purchaser has more than one known address, the statute provides a hierarchy: (1) billing address, (2) shipping or delivery address, (3) address associated with the payment instrument, and (4) most recent mailing address. (RTC § 6010.5(b)(3)(B); Proposed Reg. 1600(d)(2)(B)). If no California address can be determined under these rules, the sale is deemed to occur outside of California. (RTC § 6010.5(b)(4); Proposed Reg. 1600(d)(2)(C)).

Importantly, place-of-sale rules are distinguishable from SB 122’s place-of-use provisions. For remotely accessed products, use generally occurs where the person accessing the product is located. In addition, a digital product purchased outside California and used in California within 90 days is subject to a statutory presumption that it was purchased for storage, use, or consumption in California. Accordingly, billing-address information may not resolve the ultimate use-tax analysis for mobile workforces or multi-state deployments.

The Draft Regulations introduce Multiple Points of Use (MPU) certificates, allowing purchasers to apportion tax based on the actual use of the digital product inside and outside of California using “any reasonable method that is consistent and uniform.” (RTC § 6372(e); Proposed Reg. 1600.2). Methods based on the number of users or computers inside and outside California are identified as reasonable and are presumptively acceptable. By contrast, an allocation based solely on the location of the servers on which the software is installed is not considered reasonable. Companies deploying enterprise software across multiple states should ensure they have systems and records in place to document the allocation of California versus non-California users at each return filing date.

Pre-Existing Contracts: Transitional Guidance

The Draft Regulations provide critical guidance on contracts that straddle the January 1, 2027 effective date, including five illustrative examples (Proposed Reg. 1600(f)(2)(C), Examples 1 – 5):

The principle being applied is that the sale occurs when the right to the product transfers, regardless of when payment is made or when the purchaser actually uses the product (Proposed Reg. 1600(f)(2)(A)).

For subscription offerings, the CDTFA is indicating that each period will be treated as a continuing sale and purchase and pre-2027 periods are not taxable, but periods on or after January 1, 2027 are taxable. (Proposed Reg. 1600(f)(2)(B)).

Deal Considerations for the Remainder of 2026

The transitional rules in the Draft Regulations have significant implications for software and SaaS transactions being negotiated or entered into between now and December 31, 2026. Because the Draft Regulations are not yet final, any deal planning should account for the possibility that specific provisions — including the transitional examples, sourcing rules, and threshold mechanics — could be revised before finalization. With that caveat, companies on both the buy side and sell side should consider the following:

Accelerating purchases to lock in pre-tax treatment. As discussed in the transitional guidance above, the sale of a digital product occurs when the right to access or use the product is transferred and not when payment is made (Proposed Reg. 1600(f)(2)(A)). Companies contemplating significant software acquisitions may benefit from structuring transactions so that the transfer of access rights occurs before year-end. However, merely prepaying for access that does not begin until 2027 will not avoid the tax (see Examples 1 and 2 above).

Structuring subscription and renewal terms carefully. For subscription-based SaaS arrangements, each billing period constitutes a continuing sale and purchase (Proposed Reg. 1600(f)(2)(B)). Companies negotiating multi-year SaaS contracts should consider how pricing, billing cycles, and renewal dates interact with the effective date. For example, a contract with an annual billing date of November 2026 covering a 12-month service period through October 2027 would be subject to tax on the portion of service delivered on or after January 1, 2027.

Addressing tax allocation and indemnification in contracts. New and renegotiated agreements should include clear provisions addressing which party bears the economic burden of the new tax. Sellers should consider adding tax-inclusive pricing terms or pass-through clauses for California sales tax effective January 1, 2027. Purchasers, in turn, should negotiate clarity on whether quoted prices are tax-inclusive and seek representations regarding the seller’s classification of the product (e.g., taxable SaaS versus exempt digital infrastructure or custom software).

Evaluating the $5 million threshold in large enterprise deals. For enterprise purchasers negotiating high-value software deals, the $5 million threshold discussed above (Proposed Reg. 1600.1) may be triggered in the first year. Parties should address in the contract how the shift from seller-collected sales tax to purchaser self-assessed use tax will be handled operationally, including provisions for timely notice when the threshold is approaching and cooperation in obtaining direct payment permits or waivers.

Establishing MPU frameworks for multi-state deployments. Companies entering into enterprise software agreements for use across multiple states should negotiate the right to provide MPU certificates (Proposed Reg. 1600.2) at or before the time of billing and ensure that their allocation method is supported by books and records as of each return filing date (Proposed Reg. 1600.2(d), (h)). Establishing these systems and contractual frameworks now will be critical to reducing California tax exposure on multi-state licenses.

Reviewing Technology Transfer Agreements (TTAs). The Draft Regulations amend Regulation 1507 to provide that the existing TTA framework is no longer applicable to the sale or purchase of prewritten computer software, including any associated copyright or patent interests; those transactions are now governed by Proposed Reg. 1600 (Proposed Amendments to Reg. 1507(b)(3)). Companies with existing TTAs for software-related IP should evaluate whether those arrangements will be reclassified as taxable digital product transactions effective January 1, 2027.

Next Steps to Consider

All companies should monitor the CDTFA’s finalization of the emergency regulations, which are expected before year-end. Because the regulations remain in draft form, companies should revisit their compliance planning once the final emergency regulations are published. Many significant interpretive questions, including the scope of “digital infrastructure,” the treatment of AI products, and the application of the “human effort” exemption, remain open and may be addressed in the final emergency regulations, in subsequent permanent rulemaking expected in mid-2027, or through formal legal opinions.