Law lags behind technology, but California is sprinting to keep up. In the last few months, the California legislature passed 19 AI-related bills, targeting everything from AI safety to election deepfakes. Governor Newsom vetoed the controversial AI safety bill but signed all the others. These laws impose a variety of new requirements on developers and deployers of AI systems; here’s what you need to know.
Safety Bill Veto
If enacted, California SB 1047 would have created a number of safety-focused obligations for developers before training a model. These obligations included a kill switch to immediately shut down a model, safety and security protocols, third-party audits, and submissions of compliance records to the Attorney General.
The bill faced stiff opposition from the tech industry and Governor Newsom vetoed it. The veto cited concerns that SB 1047 did not reach smaller models and that regulation should “take into account whether an AI system is deployed in high-risk environments, involves critical decision-making or the use of sensitive data.”
Enacted Bills
TRANSPARENCY IN DATA SETS
Starting Jan. 1, 2026, AB 2013 will require AI developers to provide a public summary of data they use to train their models before making the models available. The law provides a list of what must be included in the summary, most notably, whether the data includes copyrighted or trademarked data or personal information and whether the datasets were purchased or licensed.
Disclosure of this information could expose developers to more litigation similar to the wave of copyright cases currently making their way through the courts, so companies will need to think carefully about how they will comply with this law.
WATERMARKING
The California AI Transparency Act requires creators to watermark AI-generated content with the name of the creator, the version of the generative AI system, the time and date of the creation, and a unique identifier. The watermark must be permanent or “extraordinarily difficult” to remove. Developers of AI systems with over a million monthly visitors are also required to make a free AI detection tool available to the public, and the watermarks must be detectable by the tool.
Currently, AI detectors don’t do a great job of detecting AI-generated content. For example, a researcher ran a document through an AI detection tool, which concluded that 97% of the document was AI-generated. That document? The Declaration of Independence.
HEALTHCARE
AB 3030 requires health facilities that use generative AI for patient communications to ensure the communications disclose the use of generative AI and include instructions describing how a patient may contact a human employee.
SB 1120 requires health care service plans and disability insurers that use AI for utilization review or management to ensure that the AI bases its determination on specified information, to ensure a fair and equitable application of review standards.
ROBOCALLS
AB 2905 adds to existing robocall law that requires an announcement stating the nature of the call with information about the calling business or organization. Callers using a prerecorded message must also inform the recipient if the message uses a voice generated or altered using AI.
ELECTION DEEPFAKES
AB 2839 prohibits the distribution of an ad or election communication containing materially deceptive content with malice – defined as knowing the content was false or having a reckless disregard for the truth. The law has already been challenged as violative of the First Amendment and the Northern District of California granted a preliminary injunction temporarily pausing its enforceability.
AB 2655 requires large online platforms to develop techniques to identify and label content that falsely appears to be authentic content of speech or conduct of the individual depicted. This law applies for only set durations throughout the year around election cycles.
AB 2355 requires committees that create or distribute political advertisements to include a disclosure when the ad was generated or substantially altered using AI. The law gives the Fair Political Practice Commission the power to seek injunctive relief to compel compliance or pursue other remedies available.
ENTERTAINMENT
AB 2602 prohibits employers from using AI-generated digital replicas instead of human performers if (1) the employment contract for the digital replica would replace work the performer would have done in person; (2) the contract does not include a reasonably specific description of the replica’s intended uses; and (3) the individual was not represented by legal counsel or a labor union.
AB 1836 makes liable any person who creates a digital replica of a deceased personality’s voice or likeness without prior consent.
DEEPFAKE PORNOGRAPHY
AB 1831 expands the scope of child pornography laws to include content that is altered or generated by the use of AI.
SB 926 creates a new crime under the California Penal Code for intentionally creating or distributing “any photo-realistic image, digital image, electronic image, computer image, computer-generated image, or other pictorial representation” of illicit material “that would cause a reasonable person to believe the image is an authentic image of the person depicted.”
SB 981 requires social media platforms to provide users with a mechanism to report sexually explicit digital identity theft. Platforms are required to immediately remove the content from the platform if there is a reasonable basis to believe the content is sexually explicit digital identity theft.
DEFINITION
AB 2885 puts forward a definition of artificial intelligence: “an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.”
The law also defines an automated decision system as a “computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons.” This definition does not include spam filters, firewalls, calculators, or antivirus software, among other select tools.
While seemingly less significant than other pieces of legislation, AB 2885 amends multiple sections of California law to create consistent definitions of what the state is attempting to regulate. Hopefully, this will enable both legislators and employers to get on the same page for compliance and enforcement.
PRIVACY
AB 1008 amends the CCPA to clarify that personal information can exist in AI systems that are capable of outputting personal information.
The notion that state privacy laws apply equally to AI as they do to other technology has been increasingly expressed by privacy professionals. This amendment makes it clear that the CCPA will cover personal information in AI, both in training data and in AI outputs.
EDUCATION
AB 2876 adds to the California Education Code and requires the Instruction Quality Commission to consider including media literacy and AI literacy content in math, science, and history-social science curriculum, and SB 1288 requires the Superintendent of Public Instruction to convene a working group and develop guidance for schools on the safe use of AI in education.
RISK MANAGEMENT
The Generative AI Accountability Act requires the California Department of Technology to update guidance on AI technology to government agencies. It would also require the Office of Emergency Services to perform risk analyses on potential threats posed by the use of generative AI to California’s critical infrastructure.
The law also requires agencies using generative AI to communicate with people to include a disclaimer indicating the use of generative AI, as well as instructions on how a person may contact a human employee of the agency.
