California AI Regulations
California regulates AI through at least six statutes already in force and two finalized regulatory packages. The 2026 session signed more: SB 1000 amended the California AI Transparency Act effective September 30, 2026, and SB 947, on automated decision systems in discipline and termination, is operative July 1, 2027. The obligations that reach ordinary employers today are still the Civil Rights Council's FEHA automated-decision-system regulations, in force since October 1, 2025, and the CPPA's CCPA regulations — not SB 53, which applies to a handful of frontier-model developers.
Last reviewed against primary sources: . AI legislation is moving quickly — statutes have been delayed, repealed and replaced mid-cycle. Verify against the linked primary sources before relying on any date here.
Where we work in California
TrustEdge serves organizations across California, including these markets.
In-Depth Analysis
The most useful thing to say about California is which of its AI laws you can ignore.
SB 53 gets the coverage. It is a real law with a real $1,000,000-per-violation penalty, and it applies to organizations that train foundation models above 10^26 operations. If you are a hospital system, a bank, a law firm, or a state agency, that is not you. It regulates your vendor. What you can do about SB 53 is ask your model provider for its published frontier AI framework and transparency reports and read them — that is a procurement diligence step, not a compliance program.
The law that does apply to you is the Civil Rights Council's FEHA regulation, effective October 1, 2025. It reaches every California employer with five or more employees. Its definition of an automated-decision system is wide enough to capture resume-screening software that nobody in the organization thinks of as AI. It imposes four-year retention on ADS data. It makes you responsible for a vendor's tool. And it makes the presence or absence of anti-bias testing evidence in a discrimination claim.
That last point is the one worth internalizing. The regulation does not order you to run bias testing. It tells you that whether you did, how recently, how thoroughly, and what you found will be weighed if you are sued. Testing is not a compliance checkbox in California. It is a litigation posture.
SB 947 does not replace that regulation, and it is not in force until July 1, 2027. It has no five-employee minimum. From that date an employer may not rely solely on an automated decision system to discipline or terminate. If it primarily relies on the output, a human has to corroborate it from the data that produced the output or from other evidence, such as a supervisor's evaluation or the employee's work. The statute does not ban prediction. It bans using the system to predict and take adverse action against a worker for exercising a legal right.
The CPPA package is the second real obligation and it is often misread as future work. The ADMT consumer rights do start January 1, 2027. The risk assessments do not — processing initiated from January 1, 2026 already requires one, and legacy processing must be assessed by December 31, 2027 with first submission to the CPPA on April 1, 2028. An organization that has done nothing on CPPA risk assessments this year is already behind on documentation it will have to produce.
The California AI Transparency Act became operative August 2, 2026, not January 1, 2026. AB 853 moved it. SB 1000, an urgency statute, has been in effect since September 30, 2026. It removed the covered-provider threshold, formerly over 1,000,000 visitors or users a month. Any person who produces a generative AI system that is publicly accessible in California is a covered provider. A calendar that still scopes the Act to that old count is wrong. So is a program built around offering users a visible disclosure: SB 1000 removed that required offer. What the amended Act requires instead is a free disclosure verification tool and a latent disclosure that states whether the system created or altered the content.
Practical Implications for SMBs & Healthcare
For a regulated-industry organization in California, the honest scoping order is: FEHA first, CPPA second, sector law third, frontier law probably never.
Start with employment. If you use any tool that screens, ranks, scores, or recommends candidates or employees — including one embedded in an applicant tracking system you did not choose — you are inside the FEHA regulations today, and you have been since October 2025. Find those tools, get bias testing results from the vendor or run your own, and set four-year retention on the outputs. Contract for it if the vendor will not volunteer it; liability does not transfer with the procurement.
SB 947 is the next employment date, and it is July 1, 2027, not today. It is not limited to employers of five or more. Map any automated decision system that feeds a disciplinary or termination decision. Sole reliance will be prohibited. Primary reliance will require a human to corroborate the output, a written notice at the moment you tell the employee, and a way to describe that employee's own data on request. Parties covered by a collective bargaining agreement are out only if the agreement explicitly waives the statute in clear and unambiguous terms, expressly provides for the wages or earning, working conditions, and other terms and conditions of work, and protects workers from algorithmic management. Do not read the statute as a ban on prediction. It bars using the system to predict and take adverse action against a worker for exercising a legal right.
AB 1883, effective January 1, 2027, is separate. It bars an employer, including a public employer and the University of California, with no regents opt-in, from using a workplace surveillance tool that uses artificial intelligence to recognize, infer, or predict an individual's emotional state or to collect neural data. Monitoring that does neither, and a tool used to ensure safety, is outside the ban. The penalty is up to $500 per violation.
Then look at your CCPA position. If you make lending, housing, education, employment, or health care decisions with technology that replaces or substantially replaces human judgment, you have a January 1, 2027 date for pre-use notice, opt-out, and explanation — and a risk assessment obligation that started this January.
Healthcare payers have one hard rule already in force: under SB 1120, a licensed clinician makes the final medical-necessity determination. AI can inform it. It cannot make it. SB 503 and AB 1979, both signed September 30, 2026, add clinical-decision-support duties for developers and for health facilities, clinics, and physician offices. SB 503 is identification, documentation, and mitigation of biased impacts. AB 1979 keeps the licensed professional's independent judgment and bars an artificial intelligence tool from independently performing a clinical function the law assigns to a licensee. Both take effect January 1, 2027. A business that offers a health care chatbot so a consumer can manage the consumer's information, or for diagnosis, treatment, or management of a medical condition, is treated as a provider of health care under the Confidentiality of Medical Information Act, and not under other laws.
AB 1609 takes effect January 1, 2027. A private business with more than $500 million in gross annual revenue nationally must not represent a customer service chatbot as a human, and must offer a path to a human agent during regular business hours. Make a good-faith effort to connect within 15 minutes or to offer a specific appointment within one business day of the request, and after connection a good-faith effort to keep each hold or wait to 15 minutes and cumulative holds, waits, and escalation queues to one hour; a pharmacy subject to Cal. Code Regs. tit. 16, §1707.2 may instead return the call within one business hour, and email, a web-based contact form, or voicemail has no 15-minute connect-or-respond duty. Those hours are the hours the business customarily maintains customer-service functions, excluding days it is ordinarily closed or state or federal holidays, and they include a 10-hour period per day over a five-day week or 8 hours per day for a full seven-day week. If you serve California customers online and offer telephone service, post that number clearly and conspicuously on the website. You need not add a channel you had not offered as of January 1, 2027. You need not add a phone line if you had none then, so long as customers can still reach an agent promptly another way. A hospital's communications about providing, coordinating, managing, administering, paying for, or operating health care are outside it, as are consumer reporting agencies.
If you produce a generative AI system that is publicly accessible in California, the California AI Transparency Act now applies without a user count. SB 1000 has been in effect since September 30, 2026. If you only deploy a system you do not produce, that Act still does not make you a covered provider. If you license the system, notify the licensee of its obligations under the chapter when you grant the license. If you know an identifiable licensee has modified the system out of compliance, within 72 hours of that discovery either terminate the licensee's authorization or notify the licensee. That notice must state the noncompliance and explain the requirement to report noncompliance with the licensee's duty to the Attorney General. The licensee must either modify the system into compliance or cease using and making it available, including any copy or modified version, and within 96 hours of receiving the notice must report to you which of those actions it took. If no report arrives, or the report shows neither corrective action, you must report that noncompliance to the Attorney General. You need not monitor, investigate, or inquire into the licensee's use or modification.
SB 813 takes effect January 1, 2027. The Government Operations Agency must develop designation requirements by January 1, 2028. It does not require you to hire an independent verification organization, or to undergo an audit, as a condition of operating in the state. AB 1405's bar on unregistered covered AI audits begins January 1, 2029.
If you are being sold "California AI Act compliance," ask which statute. There is no single California AI act. The instruments have different regulators, different triggers, and different dates, and several bills signed in September 2026 are not yet operative. The one that can cost a typical employer money today is still the FEHA regulation, not the frontier statute.
Key Provisions
FEHA automated-decision-system regulations — the rule that reaches almost everyone
Effective October 1, 2025, the California Civil Rights Council's regulations apply the Fair Employment and Housing Act to automated-decision systems used in employment. FEHA covers employers with five or more employees, which makes this the California AI rule most likely to apply to you. An ADS is defined broadly: a computational process that makes a decision or facilitates human decision making regarding an employment benefit, whether derived from artificial intelligence, machine learning, algorithms, statistics, or other data-processing techniques. Resume screening, interview scoring, trait and skill assessments, and promotion recommendations are all in scope. Use of an ADS can violate FEHA through intentional discrimination or through disparate impact, and running the tool does not satisfy an employer's individualized-assessment obligations.
Four-year retention, vendor liability, and the evidentiary weight of bias testing
The FEHA regulations require employers to retain automated-decision-system data for four years — ADS data created or received by the employer in connection with any employment practice affecting any employment benefit of any applicant or employee. That includes vendor scores and outputs, not only your internal records. Employers are responsible for the AI tools they use whether or not they built them, and the regulations extend aiding-and-abetting liability to third parties that design or implement those tools. Evidence of anti-bias testing is relevant to a discrimination claim, judged on its quality, recency, scope, and results. The absence of testing is relevant too. That is the practical reason to test and document now rather than after a complaint.
SB 947 — automated decision systems in discipline and termination, operative July 1, 2027
Operative July 1, 2027, not before. Binds a person who, directly or indirectly, or through an agent or another person, employs someone or controls wages, hours, or working conditions, including by suffering or permitting work. Includes labor contractors and public employers. No five-employee floor. The University of California is in only if the regents agree. A collective bargaining agreement exempts covered parties only if it explicitly waives this part in clear and unambiguous terms, expressly provides for the wages or earning, working conditions, and other terms and conditions of work, and protects workers from algorithmic management. Use is excused only to the extent required by, or reasonably necessary to comply with, a federal statute, regulation, or binding contract relating to developing aircraft for the national airspace, or products or services for national security, military, space, or defense, and only in those operations. An automated decision system is any computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons. Not included: a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data. Do not use it to prevent compliance with, or to violate, labor, occupational health and safety, employment, or civil rights law, to infer Fair Employment and Housing Act status, or to predict and take adverse action against a worker for exercising a legal right. Prediction alone is not banned. No sole reliance for discipline or termination. Primary reliance requires a human to corroborate the decision from the data that produced the output or other supporting information. Do not use an uncorroborated, inaccurate, incomplete, or misleading output for that decision. If you primarily used the system, describe the employee's own data on request and give written notice when you inform the employee. The notice is a separate, stand-alone plain-language communication, in the language in which routine communications and other information are provided to employees, delivered by a simple and easy-to-use method including an email, a hyperlink, or other written format, and it states that the employer primarily relied on the system for that disciplinary or termination decision, that a human reviewed the decision and corroborated the output, contact information for a human the employee may contact for more information about the decision and the right to a description of the employee's own data, and that retaliation for exercising rights under this part is prohibited (§1524). That data description must anonymize a customer's, another employee's, or another individual's personal information (§1522(e)), and, independently, an employer may not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate for using or attempting to use these rights, filing a complaint with the Labor Commissioner, alleging a violation, cooperating in an investigation or prosecution, assisting enforcement, or exercising a right under this part (§1526). The Labor Commissioner or a public prosecutor enforces it, at a civil penalty of $500 per violation.
AB 1883 — workplace surveillance tools, effective January 1, 2027
Effective January 1, 2027. An employer must not use a workplace surveillance tool that uses artificial intelligence on employees to recognize, infer, or predict an individual's emotional state, or to collect neural data (Lab. Code §§1580-1583). Neural data is information generated by measuring the activity of an employee's central or peripheral nervous system, and not inferred from nonneural information. The tool collects, or facilitates collecting, employee data, activity, communications, biometrics, or behavior other than by direct observation. Use to ensure safety is allowed, as is any use that does neither. Employer includes public employers, charter cities, and the University of California, with no regents opt-in and no five-employee minimum, and includes labor contractors. The exemption applies only to operations covered by a federal statute, regulation, or binding contract where the tool is reasonably necessary to comply with it, and only for developing aircraft for the national airspace or products or services for national security, military, space, or defense. The Labor Commissioner or a public prosecutor may enforce it. The penalty is up to $500 per violation.
CPPA ADMT regulations — significant decisions, from January 1, 2027
The CCPA regulations on automated decisionmaking technology, risk assessments, and cybersecurity audits were approved by the Office of Administrative Law on September 22, 2025 and took effect January 1, 2026. ADMT means technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. The obligations attach to "significant decisions": financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, and health care services. Behavioral advertising appeared in earlier drafts and is not in the final rule. Businesses using ADMT for a significant decision must give pre-use notice, offer an opt-out, and provide access to an explanation, with compliance required from January 1, 2027. Human reviewers must be able to understand and evaluate the ADMT output and to alter the final decision.
CPPA risk assessments — this clock is already running
Risk assessments are the CPPA obligation that is live today, not in 2027. Processing initiated on or after January 1, 2026 that involves selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, training ADMT with personal information, or using automated processing to infer personal attributes requires a documented risk assessment. Processing that predates 2026 must be assessed and documented by December 31, 2027. The first documentation submission to the CPPA is due April 1, 2028. Cybersecurity audit certifications are staggered by revenue: April 1, 2028 above $100M, April 1, 2029 for $50M–$100M, April 1, 2030 below $50M.
SB 1120 — AI cannot make the final medical-necessity call
The Physicians Make Decisions Act has applied since January 1, 2025. A health plan or insurer using AI in utilization review, utilization management, or prior authorization may not let the tool make the final determination of medical necessity. That determination must be made by a licensed physician or other competent health care professional reviewing the individual clinical circumstances. Enforced by the Department of Managed Health Care and the Insurance Commissioner, with administrative penalties for willful violations. For payers, this is the most concrete AI constraint in California health care.
SB 503 — clinical decision support, effective January 1, 2027
Effective January 1, 2027. SB 503 binds developers and deployers of a clinical decision support system: artificial intelligence that predicts, classifies, recommends, evaluates, or analyzes to aid a decision on the timing of care, diagnosis, or treatment. A deployer is a health facility, clinic, physician's office, or office of a group practice. A developer designs, codes, substantially modifies, or otherwise produces a system for commercial or public use, and the same body can be both. Scheduling, reminders, patient education, and payment processing are outside the system when performing them does not require a professional license. Developers and deployers must make reasonable efforts to identify systems developed for deployer use that are known to carry, or that reasonably foreseeably risk, biased impacts — less access, lower quality, or worse outcomes based on a protected characteristic. Developers must try to mitigate that risk and give deployers the intended uses, known risks, and documentation on training data, evaluation, and monitoring, due at the earlier of request or initial sale and again on a material update. An internal-use system need not generate that documentation if the same information is already on hand. Deployers must regularly monitor the identified systems and take reasonable, proportionate mitigation steps. Compliance is not a defense to an unlawful-discrimination claim. The statute names no penalty and no enforcing agency.
AB 1979 — licensed judgment and health care chatbots, effective January 1, 2027
Effective January 1, 2027. A health facility, clinic, physician's office, or office of a group practice must take reasonable steps so a licensed provider, acting within scope, keeps independent professional judgment when care is informed by a clinical decision support output. It must not use a tool that includes artificial intelligence to direct, guide, supervise, or instruct unlicensed personnel in a clinical function the law reserves to a licensee, or to perform that function independently. A trainee in a supervised program is excepted. A record-update message, a reminder, or help finding information the patient asked for is outside the section when it does not apply professional judgment. A physician's violation is before the Medical Board of California or the Osteopathic Medical Board of California. Where the conduct is unlicensed practice, the licensing board may seek an injunction. A business that offers a health care chatbot so a consumer can manage the consumer's own information, or for diagnosis, treatment, or management of a medical condition, is a provider of health care under the Confidentiality of Medical Information Act and not under any other law.
SB 243 — companion chatbots and crisis protocols
In effect since January 1, 2026, and the first state companion-chatbot law. Operators must disclose that the user is interacting with AI, issue recurring reminders to minors, bar sexual content for minors, maintain a suicide and self-harm crisis protocol with referral to crisis services, and file annual reports. The crisis protocol is the demanding part. It is an operational capability, not a disclosure, and behavioral-health and patient-facing deployments should be scoped against it before launch rather than after.
AB 1609 — customer service chatbots at the largest businesses
Effective January 1, 2027. Binds a private business with more than $500 million in gross annual revenue nationally that provides goods and services to customers. A customer is a natural person residing in California, judged by the account address. Out of scope: a free service charged only on a later upgrade; a hospital's communications about providing, coordinating, managing, administering, paying for, or operating health care; a Fair Credit Reporting Act consumer reporting agency; an employee-only or business-to-business line; and telecommunications or water service subject to, and in compliance with, Public Utilities Commission General Order 133 or 103-A, and with a corrective action plan, if any. Do not present a customer service chatbot as human. If a reasonable person would likely think it is, say it is artificial, clearly and conspicuously, in the same medium. During regular business hours, offer a simple way to request a human agent on each customer-service platform. Make a good-faith effort either to connect that customer to an agent within 15 minutes of the request or to give a specific appointment time, within one business day of the request, at which an agent will call or connect (§22627(b)). A business subject to the pharmacy duty to consult (Cal. Code Regs. tit. 16, §1707.2) may instead return the call within one business hour. After connection, make a good-faith effort so that no hold or wait exceeds 15 minutes at any time and so that cumulative holds, waits, and escalation queues do not exceed one hour (§22627(c)). The section does not require a connection or response within 15 minutes when the request or connection is made by email, a web-based contact form, or voicemail (§22627(e)(1)). Regular business hours are the hours the business customarily maintains customer-service functions, excluding days it is ordinarily closed or state or federal holidays, and include a 10-hour period per day over a five-day week or 8 hours per day for a full seven-day week (§22625(i)). If you serve California customers online and offer telephone customer service, post that number clearly and conspicuously on the website (§22627(d)). You need not add a channel you had not offered as of January 1, 2027. You need not add a phone line if you had none then, so long as customers can still reach an agent promptly another way. A public prosecutor may sue, at up to $5,000 for a first violation and up to $10,000 later. No private right of action.
California AI Transparency Act — SB 1000 in effect since September 30, 2026
SB 1000, an urgency statute, took effect September 30, 2026. A covered provider creates, codes, or otherwise produces a generative AI system publicly accessible in California. The threshold of more than 1,000,000 monthly users is gone. A deployer that does not produce the system is not covered. Exclusively non-user-generated videogames are out. Until January 1, 2029, so is a system designed to primarily function as assistive technology. Offer a free disclosure verification tool, not a detection tool, so a user can assess whether the system created or altered image, video, or audio, other than by a minor modification, without visiting the provider's website. The tool must not output personal information detected in the content unless the user it pertains to expressly consents, clearly and conspicuously in plain language, to include personal information that user specifies, pursuant to a notice of the personal information that may be output and that, once embedded in provenance data and exported, it becomes part of the file's permanent digital footprint and cannot be retracted from copies already in circulation; the provider may not collect, use, retain, sell, share, or otherwise make available personal information from a tool user or from content the tool processes beyond what is strictly necessary to comply with the chapter, except that it may collect, retain, or use that information solely to communicate with a user who opts into being contacted; and it may not make access to the system or the tool contingent on personal information beyond what is strictly necessary to comply (§22757.2(a)(3), (c), (d)). A latent disclosure is still required where technically feasible, including whether the system created or altered the content and, from January 1, 2029, whether it is primarily assistive technology. SB 1000 removed the duty to offer a visible disclosure and put no other offer in its place. A false assistive-technology claim is $50,000 per violation per day, under a section repealed January 1, 2029. The $5,000 per-violation, per-day penalty does not apply to that claim. The Attorney General, a city attorney, or a county counsel may sue. Hosting platforms still begin January 1, 2027, and capture devices January 1, 2028. When a covered provider licenses its system, it must at that time notify the licensee of the licensee's obligations under the chapter. If the provider knows an identifiable licensee modified the system so that it no longer complies, then within 72 hours of discovering that action the provider must either terminate the licensee's authorization or notify the licensee. That notice must state the licensee's noncompliance and explain the requirement to report noncompliance with the licensee's duty to the Attorney General. A licensee that receives the notice must either modify the system into compliance or cease using and making it available, including any copy or modified version, and within 96 hours of receiving the notice must report to the provider which of those actions it took. If the provider receives no report, or the report shows neither corrective action, the provider must report that noncompliance to the Attorney General. The provider need not monitor, investigate, or inquire into the licensee's use or modification (§22757.3(b)).
AB 2713 — large online platforms, operative January 1, 2027
Operative January 1, 2027. A large online platform must detect provenance on content it distributes, indicate when that provenance marks the content as generated or substantially altered by a generative AI system or captured by a capture device, and let the user inspect it. The platform is public-facing social media, file sharing, mass messaging, or a stand-alone search engine that distributes content to users who did not create or collaborate in creating it, and that exceeded 2,000,000 unique monthly users in the preceding 12 months. Broadband internet access and a telecommunications service are not large online platforms. The platform need not act on provenance that is not compliant or interoperable with widely adopted specifications issued by an established standards-setting body, need not display personal information, and must not, to the extent technically feasible, knowingly strip system provenance or a digital signature from content uploaded, distributed, or downloaded.
SB 813 and AB 1405 — independent verification and the auditor registry
SB 813 takes effect January 1, 2027. On or before January 1, 2028, the Government Operations Agency must develop designation requirements for independent verification organizations (Gov. Code §§8898-8898.4). An organization is an AI auditor designated for expertise in assessing the risks an AI system or model poses and the metrics and methods behind that assessment. A covered AI audit assesses the internal controls, processes, or systems an AI system needs in order to comply with state law. The chapter does not require a developer, deployer, or operator to hire an organization or undergo an audit as a condition of operating in the state, and designation does not require a compliance audit. It endorses no system. Missing a standard under the chapter is not, by itself, liability, and in a harm suit such an audit is relevant, not conclusive. AB 1405 has the same agency open an auditor registry and take misconduct reports from natural persons no later than January 1, 2029. From that date no one may offer, sell, or conduct a covered AI audit unless registered. A registered auditor must not audit its own work or accept employment with the auditee during the audit. Registration is not an endorsement and does not delay an audit another statute already requires. Removal from the registry and referral to the Attorney General are the consequences. Neither statute states a dollar penalty or requires a deployer to obtain an audit.
AB 2013 — training-data transparency, and it can catch fine-tuners
In effect since January 1, 2026. A developer of a generative AI system or service made publicly available to Californians on or after January 1, 2022 must post a high-level summary of the datasets used in training, across twelve enumerated categories: sources and owners of the datasets, how they further the intended purpose, the number of data points in ranges, whether the data includes copyrighted or licensed material, whether it includes personal information or aggregate consumer information, how it was cleaned or processed, collection and first-use timeframes, and whether synthetic data was used. The summary must be posted before public release and updated on substantial modification. The statute defines a developer as one who designs, codes, produces, or substantially modifies an AI system — so a materially retrained or fine-tuned model can bring you into scope even though you did not build the base model.
SB 53 — the headline law, which probably is not about you
The Transparency in Frontier Artificial Intelligence Act was chaptered September 29, 2025 and took effect January 1, 2026. It reaches frontier developers: entities that trained or initiated the training of a foundation model using more than 10^26 integer or floating-point operations, counting fine-tuning and modification. Heightened duties fall on "large frontier developers," meaning those whose annual gross revenues with affiliates exceeded $500,000,000 in the preceding calendar year. Obligations are to publish a frontier AI framework, publish transparency reports, report critical safety incidents, and protect whistleblowers. Enforced by the California Attorney General with penalties up to $1,000,000 per violation. If you buy or license models rather than train at that scale, SB 53 regulates your vendor and not you. Your access to what it produces is a contracting question, not a compliance one.
AB 1008 — CCPA rights can attach to the model itself
In effect since January 1, 2025 and routinely overlooked. AB 1008 confirms that personal information under the CCPA can exist in abstract digital formats, including an AI system capable of outputting personal information. Access, deletion, correction, and opt-out duties can therefore attach to a trained model, not only to the training dataset that produced it. This is a genuinely hard engineering problem and it is far cheaper to design around before you fine-tune on customer or patient data than to remediate afterward.
Bills & Statutes
Civil Rights Council employment regulations on automated-decision systems (Cal. Code Regs. tit. 2)
Approved by OAL June 27, 2025; effective October 1, 2025
Read the primary source(opens in a new tab)Employment: automated decision systems
Signed September 30, 2026; Chapter 859, Statutes of 2026; operative July 1, 2027
Read the primary source(opens in a new tab)CCPA regulations on automated decisionmaking technology, risk assessments, and cybersecurity audits
Approved by OAL September 22, 2025; effective January 1, 2026; ADMT obligations from January 1, 2027
Read the primary source(opens in a new tab)Transparency in Frontier Artificial Intelligence Act (artificial intelligence models: large developers)
Chaptered September 29, 2025; in effect January 1, 2026
Read the primary source(opens in a new tab)Generative artificial intelligence: training data transparency
Chaptered September 28, 2024; in effect January 1, 2026
Read the primary source(opens in a new tab)California AI Transparency Act
Chaptered September 19, 2024; operative August 2, 2026 as amended by AB 853; further amended by SB 1000 (Chapter 861), effective September 30, 2026
Read the primary source(opens in a new tab)California AI Transparency Act — amendments extending the regime and delaying operation
Chaptered October 13, 2025; moved SB 942 operation to August 2, 2026; hosting platforms January 1, 2027; capture devices January 1, 2028; the Act was further amended by SB 1000
Read the primary source(opens in a new tab)California AI Transparency Act
Signed September 30, 2026; Chapter 861, Statutes of 2026; urgency statute, effective immediately
Read the primary source(opens in a new tab)California AI Transparency Act: system provenance data
Signed September 30, 2026; Chapter 856, Statutes of 2026; large-online-platform duties operative January 1, 2027
Read the primary source(opens in a new tab)Companion chatbots
Chaptered October 13, 2025; in effect January 1, 2026
Read the primary source(opens in a new tab)Customer service chatbots
Signed September 28, 2026; Chapter 733, Statutes of 2026; effective January 1, 2027
Read the primary source(opens in a new tab)Physicians Make Decisions Act — health care coverage: utilization review
Chaptered September 28, 2024; in effect January 1, 2025
Read the primary source(opens in a new tab)Health care services: artificial intelligence
Signed September 30, 2026; Chapter 857, Statutes of 2026; effective January 1, 2027
Read the primary source(opens in a new tab)Health care services: artificial intelligence
Signed September 30, 2026; Chapter 854, Statutes of 2026; effective January 1, 2027
Read the primary source(opens in a new tab)California Consumer Privacy Act — personal information in abstract digital formats
Chaptered September 28, 2024; in effect January 1, 2025
Read the primary source(opens in a new tab)Elementary and secondary education: public school employees: contractors: natural persons
Chaptered June 30, 2026; effective January 1, 2027
Read the primary source(opens in a new tab)Independent verification organizations
Signed September 9, 2026; Chapter 179, Statutes of 2026; effective January 1, 2027; agency designation requirements due on or before January 1, 2028
Read the primary source(opens in a new tab)Artificial intelligence: auditors: registration
Signed September 9, 2026; Chapter 178, Statutes of 2026; registry no later than January 1, 2029; unregistered covered AI audits prohibited beginning January 1, 2029
Read the primary source(opens in a new tab)Workplace surveillance tools
Signed September 30, 2026; Chapter 853, Statutes of 2026; effective January 1, 2027
Read the primary source(opens in a new tab)Applicability & Enforcement
Who It Applies To
Layered, and most organizations sit in more than one layer. Every employer with five or more employees that uses an automated-decision system in hiring, promotion, or other employment decisions is covered by the FEHA regulations today. SB 947, operative July 1, 2027, has no five-employee floor. It covers an employer's use of an automated decision system, including a ban on sole reliance for a disciplinary or termination decision, and it includes public employers. The University of California is in only if the regents agree. Parties covered by a collective bargaining agreement are out only when the agreement explicitly waives the statute in clear and unambiguous terms, expressly provides for the wages or earning, working conditions, and other terms and conditions of work, and protects workers from algorithmic management. AB 1883, effective January 1, 2027, bars an employer, including a public employer and the University of California, from using an artificial intelligence workplace surveillance tool to recognize, infer, or predict an individual's emotional state or to collect neural data. CCPA-covered businesses using ADMT for a significant decision in financial services, housing, education, employment, or health care are covered by the CPPA regulations, with risk assessments running now and ADMT duties from January 1, 2027. Health plans and insurers using AI in utilization review are covered by SB 1120. SB 503 and AB 1979, both effective January 1, 2027, reach developers and the health facilities, clinics, and physician offices that deploy clinical decision support. Developers of publicly available generative AI systems — including those who substantially modify one — are covered by AB 2013. Under the California AI Transparency Act as amended by SB 1000, effective September 30, 2026, a covered provider is any person who creates, codes, or otherwise produces a generative AI system publicly accessible in California. The former threshold, over 1,000,000 visitors or users a month, no longer applies. A deployer that does not produce the system is not a covered provider. A product, service, website, or application that provides exclusively non-user-generated videogames is outside the chapter, and before January 1, 2029 so is a generative AI system designed to primarily function as assistive technology. Only developers training above 10^26 operations are covered by SB 53. AB 1609, effective January 1, 2027, applies to a private business with more than $500 million in gross annual revenue nationally, and not to a hospital's communications about providing, coordinating, managing, administering, paying for, or operating health care. SB 813, effective January 1, 2027, does not require a developer, deployer, or operator to hire an independent verification organization or to undergo an audit as a condition of operating in the state. AB 1405 bars an unregistered covered AI audit beginning January 1, 2029.
Enforcement
No single regulator. The Civil Rights Department enforces FEHA, including through the ordinary FEHA complaint and civil-action route, which means private plaintiffs — not just an agency — can reach your automated-decision system. The Labor Commissioner enforces SB 947 and AB 1883, and a public prosecutor may sue under either. The California Privacy Protection Agency and the Attorney General enforce the CCPA regulations. The Attorney General enforces SB 53 and AB 2013. The Attorney General, a city attorney, or a county counsel may sue under the California AI Transparency Act. A public prosecutor enforces AB 1609, which states that it creates no private right of action. The Department of Managed Health Care and the Insurance Commissioner enforce SB 1120. AB 1979 places a physician's violation with the Medical Board of California or the Osteopathic Medical Board of California. SB 503 names no enforcing agency. The Government Operations Agency designates independent verification organizations under SB 813 and keeps the AI auditor registry under AB 1405. That distribution matters: employment ADS exposure under FEHA arrives as discrimination litigation, not as a regulatory notice with a cure period.
Penalties
SB 53 carries civil penalties of up to $1,000,000 per violation, recoverable by the Attorney General. CCPA penalties apply to violations of the CPPA regulations. SB 1120 carries administrative penalties for willful violations. The FEHA regulations add no separate penalty schedule — they operate through existing FEHA remedies, which include back pay, front pay, compensatory and punitive damages, and attorney's fees, with no statutory cap. California's largest AI-related financial exposure for a typical employer is therefore not an AI statute at all. SB 947, operative July 1, 2027, sets a civil penalty of $500 per violation. AB 1883, effective January 1, 2027, sets a penalty of up to $500 per violation. The California AI Transparency Act sets a civil penalty of $5,000 per violation, and each day is its own violation. A false claim that a system is designed to primarily function as assistive technology is $50,000 per violation per day, under a penalty section that repeals on January 1, 2029, and the $5,000 penalty does not apply to that claim. AB 1609 authorizes up to $5,000 for an initial violation and up to $10,000 for each subsequent violation. AB 1405 states no dollar amount. A violation is grounds for removal from the auditor registry and referral to the Attorney General. SB 813 states no dollar penalty, and failing a standard under that chapter is not, by itself, liability. SB 503 states no penalty.
Recommended Compliance Actions
Steps organizations should consider to prepare for and comply with California's AI regulations.
- 1
Inventory every tool that touches an employment decision — screening, ranking, scoring, assessments, promotion and scheduling recommendations — including features inside HR platforms you did not procure as AI. The FEHA definition of an automated-decision system is broader than most inventories assume.
- 2
Set four-year retention on automated-decision-system data, including vendor-generated scores and outputs, and confirm your vendor will actually hand those records over. Retention you cannot execute is not retention.
- 3
Obtain or commission anti-bias testing for each in-scope employment tool and document its scope, method, recency, and results. Under the FEHA regulations this is evidence, not a checkbox, and its absence is evidence too.
- 4
Amend vendor contracts to cover bias-testing disclosure, records access, notice of material model changes, and indemnity. California holds you liable for third-party tools regardless of who built them.
- 5
If you use an automated decision system in discipline or termination, prepare for SB 947, operative July 1, 2027. You may not rely solely on the system for those decisions. If you primarily rely on its output, a human must corroborate it, you must give a written notice when you inform the employee, and you must be able to describe the employee's own data on request. The statute bars using the system to predict and take adverse action against a worker for exercising a legal right. It does not bar prediction in general, and it is not limited to employers with five or more employees. Give the notice as a separate, stand-alone plain-language communication, in the language in which routine communications and other information are provided, by a simple method including email, a hyperlink, or other written format, stating primary reliance, that a human reviewed and corroborated the output, a human contact for more information and the data-description right, and that retaliation is prohibited; anonymize a customer's, another employee's, or another individual's personal information in that description; and, independently, do not discharge, threaten to discharge, demote, suspend, or otherwise discriminate or retaliate for using these rights (§§1522(e), 1524, 1526).
- 6
Before January 1, 2027, screen workplace tools for AB 1883. An employer, including a public employer and the University of California, may not use artificial intelligence surveillance to recognize, infer, or predict an individual's emotional state or to collect neural data. A tool used to ensure safety, and monitoring that does neither, is outside the ban.
- 7
If you are a private business with more than $500 million in gross annual revenue nationally, prepare for AB 1609 on January 1, 2027. Do not present a customer service chatbot as a human, offer a way to reach a human agent during regular business hours, and, if you serve California customers online and offer telephone customer service, post that number clearly and conspicuously on the website. Make a good-faith effort to connect within 15 minutes or to offer a specific appointment within one business day of the request, and after connection a good-faith effort to keep each hold or wait to 15 minutes and cumulative holds, waits, and escalation queues to one hour; a pharmacy subject to Cal. Code Regs. tit. 16, §1707.2 may instead return the call within one business hour, and email, a web-based contact form, or voicemail has no 15-minute connect-or-respond duty.
- 8
If you deploy clinical decision support in a health facility, clinic, or physician office, SB 503 and AB 1979 take effect January 1, 2027. Identify systems that risk biased impacts, preserve a licensed professional's independent judgment, and do not let an artificial intelligence tool perform a licensed clinical function on its own.
- 9
Start CPPA risk assessments now for processing initiated on or after January 1, 2026, and schedule legacy processing for documentation by December 31, 2027. The first CPPA submission is due April 1, 2028.
- 10
Map which of your decisions are "significant decisions" under the CPPA rules — financial or lending services, housing, education, employment or compensation, health care services — and build pre-use notice, opt-out, and explanation capability against a January 1, 2027 date.
- 11
If you are a health plan or insurer, confirm in writing that a licensed clinician, not a model, issues every final medical-necessity determination, and that your utilization-management workflow makes that reviewable.
- 12
If you fine-tune or materially retrain a publicly available generative AI system, check AB 2013. Substantial modification makes you a developer and triggers the twelve-category training-data summary.
- 13
If you create, code, or otherwise produce a generative AI system that is publicly accessible in California, treat the California AI Transparency Act as applying with no user-count threshold. SB 1000, in effect since September 30, 2026, requires a free disclosure verification tool and a latent disclosure stating whether the system created or altered the image, video, or audio. The requirement to offer users a visible disclosure has been removed. If you only deploy a system you do not produce, this statute still does not make you a covered provider. If you license the system, §22757.3(b) sets the workflow. When you grant the license, notify the licensee of its obligations under the chapter. If you know an identifiable licensee modified the system so that it no longer complies, within 72 hours of discovering that action either terminate the licensee's authorization or notify the licensee. The notice must state the licensee's noncompliance and explain the requirement to report noncompliance with the licensee's duty to the Attorney General. A licensee that receives the notice must either modify the system into compliance or cease using and making it available, including any copy or modified version, and within 96 hours of receiving the notice must report to you which of those actions it took. If you receive no report, or the report shows neither corrective action, you must report that noncompliance to the Attorney General. You need not monitor, investigate, or inquire into the licensee's use or modification. The disclosure verification tool must not output personal information detected in the content unless the person it concerns expressly consents, clearly and conspicuously in plain language, to include personal information that person specifies, pursuant to a notice of what may be output and that, once embedded in provenance data and exported, it becomes part of the file's permanent digital footprint and cannot be retracted from copies already in circulation; do not collect, use, retain, sell, share, or otherwise make available personal information from a user or from processed content beyond what is strictly necessary to comply, except to collect, retain, or use it solely to communicate with a user who opts into being contacted; and do not make access to the system or the tool contingent on personal information beyond that (§22757.2(a)(3), (c), (d)).
- 14
Ask your frontier model vendors for their SB 53 frontier AI framework and transparency reports. This is procurement diligence on a law that binds them, not you.
Related TrustEdge Services
As of September 14, 2026. We are not lawyers and this is not legal advice. It is the responsibility of consumers of this data that they verify the applicability and current ratified statutes and legal precedence with a qualified attorney licensed in the state or country they are researching.
Need Help with AI Compliance?
Our team helps organizations build compliance-first AI systems that meet current and emerging regulatory requirements.