California

Requires developers of the largest frontier models (trained above roughly 10^26 FLOPs) to publish a safety framework, report safety incidents, and protect whistleblowers.

Requires developers of generative-AI systems to publish a high-level summary of the datasets used to train them. xAI is challenging the law on First Amendment and trade-secret grounds in x.AI LLC v. Bonta: the district court denied a preliminary injunction on March 4, 2026, finding xAI unlikely to succeed, and the Ninth Circuit (No. 26-1591) hears argument on November 18, 2026. The law remains in force.

Requires providers of generative AI systems that are publicly accessible in California to embed latent disclosures in AI-generated content, stating whether the system created or altered it, and to offer a disclosure verification tool. SB 1000, an urgency statute in force September 30, 2026, removed the one-million-user threshold, so every covered provider is in scope, delayed the duties for systems designed primarily as assistive technology to January 1, 2029, and added, until that date, a $50,000 per-violation civil penalty for falsely claiming that a system is assistive technology, each day a separate violation. Large online platforms must detect and surface standards-compliant provenance data and may not knowingly strip it from January 1, 2027 under AB 853, as narrowed by AB 2713 to data that follows widely adopted standards.

Requires companion-chatbot platforms to tell users the bot is not human and adds safeguards, including restrictions on sexually explicit content for minors.

A state framework for independent third-party evaluation of AI. SB 813 creates a category of independent verification organizations that can assess AI systems and models for compliance with state law, codifying a central recommendation of the governor's frontier-AI panel. AB 1405 creates a state registry of AI auditors with standards for their independence, transparency, and integrity, and requires the registry to be in place by January 1, 2029. Together they build the assessment infrastructure that Illinois' 2028 audit mandate and Adam's Law child-safety audits will draw on.

The strongest companion-chatbot rules in the country, building on 2025's SB 243. Adam's Law, named for a teenager who died after months of conversations with a chatbot, requires crisis protocols for suicidal ideation, parental controls, notification when a child disables safety settings, and, for the first time anywhere, independent child-safety audits every two years and annual risk assessments. SB 867 bans companion chatbots in toys for a multi-year period. Signed alongside a package banning addictive feeds for users under 16 and extending child sexual exploitation law to AI-generated material.

Makes it false advertising to run a video or audio ad that uses a synthetic performer without a clear and conspicuous disclosure, in language substantially similar to 'this performance features a synthetic performer.' Enforcement runs through the false-advertising and unfair-competition laws, and an ad found in violation must come down. Ads for expressive works and translation-only uses are exempt. New York adopted the first such rule; California's version also reaches audio-only ads, which New York exempts.

Bars employers from relying solely on an automated decision system to discipline or terminate a worker; where the system is the primary basis, a human must corroborate the output with other evidence, and an uncorroborated output may not be used. Employers may not use such a system to infer protected status or to predict and punish the exercise of legal rights. When a system is used in a disciplinary or termination decision, the worker may request the data about them that it used, the employer must give a written post-use notice with the decision, and retaliation is barred. Violations carry a $500 civil penalty per violation, enforced by the Labor Commissioner and public prosecutors. Adds Part 5.5.5 to the Labor Code.

Applies to businesses with more than $500 million in annual revenue. A customer-service chatbot may not be presented as human, must be disclosed where a reasonable person would otherwise be misled, and the business must make a good-faith effort to connect a customer who asks to a human agent within 15 minutes or schedule a time, with posted contact details. Public prosecutors enforce it, with civil penalties of up to $5,000 for a first violation and $10,000 for each later one.

AB 1979 treats a business that offers a health-care chatbot as a provider of health care under the medical-confidentiality law, requires facilities to keep licensed professionals' independent judgment where care is informed by a clinical decision support system, and bars AI from independently performing any clinical function the law reserves to a licensed person, under the Medical Board and the licensing boards. SB 503 requires developers and deployers of clinical decision support systems to identify, document, and mitigate reasonably foreseeable bias risks.

AB 1331 bars using workplace surveillance tools to monitor workers in workplace bathrooms and gives workers the right to leave such tools behind when they enter one. AB 1883 bars employer surveillance tools that collect neural data or infer emotional state. Both carry civil penalties of up to $500 per violation, enforced by the Labor Commissioner and public prosecutors. SB 951 requires layoff notices under the state WARN Act to list the job functions automated when AI caused the layoffs in whole or substantial part, with an EDD report to the Legislature due by January 1, 2028 (that report provision expires January 1, 2029).

SB 1111 writes digital replicas into the right-of-publicity statute (Civil Code 3344), so a person's voice or likeness includes an AI replica of it, and extends the false-impersonation crimes to the use of a digital replica. SB 1159 provides that AI systems, autonomous agents, and robots are not persons or members of the public under the Public Records Act, the open-meeting laws, the Administrative Procedure Act, the Coastal Act, or CEQA, bars using AI to pretend that a natural person engaged with an agency, and lets agencies use a disclosure verification tool.

Directs the Government Operations Agency, with the Office of Emergency Services, to convene outside experts and deliver by November 16, 2026 recommendations to strengthen California's AI safety and security laws. They cover onsite independent verification at frontier AI labs, verified safety frameworks and risk assessments, an emergency shutoff for frontier models whose efficacy an independent verification organization checks on an ongoing basis, and incident definitions that include loss of control. The order also sets May 1, 2027 and December 1, 2027 for the agency to stand up the verification-organization and auditor programs created by SB 813 and AB 1405. On September 23, 2026 the governor named the panel: Jason Goldman, a former White House chief digital officer; Gillian Hadfield of Johns Hopkins; Alondra Nelson of the Institute for Advanced Study; and Rob Reich of Stanford. The governor vetoed a shutdown mandate in 2024's SB 1047, and press reports tie the recommendations to a possible special legislative session.

Directs every agency under the governor's authority to keep using the terms 'artificial intelligence' and 'AI' regardless of the federal government's rebranding, unless the law requires otherwise. It answers federal Executive Order 14434 of September 29, 2026, which tells federal agencies to say 'super intelligence' instead, and its recital says a change of name cannot distract from the federal failure to act on documented safety and security risks.

Rules under the California Consumer Privacy Act for businesses that use automated decisionmaking technology to make significant decisions about consumers, covering financial or lending services, housing, education, employment or independent contracting, and health care. Such businesses must give a pre-use notice, let consumers opt out, with exceptions that include an appeal to a human reviewer who can overturn the decision, and explain on request the purpose and logic of the technology and how its output was used. The same rules phase in risk assessments, with attestations due April 1, 2028, and cybersecurity audits, with certifications due from April 1, 2028 depending on revenue. Enforced by the California Privacy Protection Agency and the attorney general.