Oakland, CA
AI governance in Oakland
AI inside the HIPAA boundary
Oakland and the wider East Bay concentrate exactly the organisations TrustEdge was built for: health systems, county agencies, community clinics and the nonprofits that serve them. These are institutions where an AI feature does not get to be an experiment.
We work on-site in Oakland. TrustEdge has no Oakland office — our engineers and assessors travel to you, and AI Academy and agent engagements are delivered nationally.
The pressure
What Oakland organisations are actually dealing with
A model that touches protected health information is inside the HIPAA scope whether or not it appeared at your last assessment, and the same is true of your HITRUST or SOC 2 boundary. Public-sector buyers carry procurement and records obligations on top.
Sectors we serve here
- Healthcare and health systems
- Government and public agencies
- Nonprofit
Regulatory context
The California rules that reach Oakland buyers
California has more AI law in force than any other state. The rule most likely to reach you is not the frontier-AI headline act — it is an employment regulation that has bound every employer with five or more employees since October 1, 2025.
SB 1120 — AI cannot make the final medical-necessity call
The Physicians Make Decisions Act has applied since January 1, 2025. A health plan or insurer using AI in utilization review, utilization management, or prior authorization may not let the tool make the final determination of medical necessity. That determination must be made by a licensed physician or other competent health care professional reviewing the individual clinical circumstances. Enforced by the Department of Managed Health Care and the Insurance Commissioner, with administrative penalties for willful violations. For payers, this is the most concrete AI constraint in California health care.
FEHA automated-decision-system regulations — the rule that reaches almost everyone
Effective October 1, 2025, the California Civil Rights Council's regulations apply the Fair Employment and Housing Act to automated-decision systems used in employment. FEHA covers employers with five or more employees, which makes this the California AI rule most likely to apply to you. An ADS is defined broadly: a computational process that makes a decision or facilitates human decision making regarding an employment benefit, whether derived from artificial intelligence, machine learning, algorithms, statistics, or other data-processing techniques. Resume screening, interview scoring, trait and skill assessments, and promotion recommendations are all in scope. Use of an ADS can violate FEHA through intentional discrimination or through disparate impact, and running the tool does not satisfy an employer's individualized-assessment obligations.
CPPA risk assessments — this clock is already running
Risk assessments are the CPPA obligation that is live today, not in 2027. Processing initiated on or after January 1, 2026 that involves selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, training ADMT with personal information, or using automated processing to infer personal attributes requires a documented risk assessment. Processing that predates 2026 must be assessed and documented by December 31, 2027. The first documentation submission to the CPPA is due April 1, 2028. Cybersecurity audit certifications are staggered by revenue: April 1, 2028 above $100M, April 1, 2029 for $50M–$100M, April 1, 2030 below $50M.
All California AI provisions, in full →
Reviewed against primary sources as of August 2, 2026.
How we help
What we do in Oakland
Talk to us about AI governance in Oakland
No pitch, no pressure. We will tell you what is actually in scope and what an assessor will accept.