Artificial Intelligence

Requires state agencies to establish human oversight of artificial intelligence systems managing critical infrastructure. Mandates specialized AI safety training for personnel overseeing critical infrastructure systems. Requires annual safety assessments of AI systems that could impact transportation, energy, and emergency services. Exempts existing automated systems from oversight requirements if human monitoring would destabilize operations.

Increases penalties for social media platforms that violate cyberbullying prevention rules to $50,000 per violation. Establishes that each day of non-compliance counts as a separate violation for penalty purposes. Authorizes courts to order platforms to comply and award attorney fees to successful plaintiffs.

Establishes a state registry system for AI auditors who evaluate artificial intelligence systems in California. Requires AI auditors to enroll with the state, pay fees, and follow strict reporting requirements by January 2027. Prohibits AI auditors from working for companies they audit within 12 months before or after an audit. Creates a public reporting system for misconduct by AI auditors and mandates 10-year retention of audit records.

Prohibits businesses from collecting location data unless necessary to provide requested services. Requires businesses to display notices when collecting location data and maintain detailed privacy policies. Bans state and local agencies from selling or monetizing any location information. Authorizes fines up to $25,000 per violation and allows both state and consumer enforcement actions.

Prohibits third-party platforms from listing restaurant reservations without written agreements from establishments. Authorizes the Attorney General to impose civil penalties up to $1,000 per violation. Creates a state fund from collected penalties to enforce restaurant reservation regulations. Allows restaurants and authorized reservation services to sue unauthorized platforms for damages.

Establishes a state working group to evaluate artificial intelligence use in mental health treatment by July 2026. Requires input from health organizations, tech companies, and advocacy groups through three public meetings. Mandates comprehensive reports to the Legislature on AI in mental health by July 2028 and January 2030. Creates a framework for training mental health professionals on effective use of AI tools in treatment.

Requires law enforcement agencies to disclose when artificial intelligence is used to generate official reports. Mandates retention of all AI-generated report drafts for as long as the final report exists. Requires AI programs to maintain audit trails tracking who created and modified reports. Establishes tracking requirements for video and audio footage used in AI-generated reports.

Requires California to develop a statewide AI cybersecurity playbook by July 2026 to combat emerging threats. Mandates information sharing between state AI contractors about potential cybersecurity vulnerabilities. Establishes strict confidentiality rules for shared cybersecurity threat information. Creates a dedicated cyber incident response team to detect and address threats across California.

Expands student privacy protections to cover K-12, preschool, and higher education institutions by July 2026. Prohibits operators from using student data to train AI systems unless specifically for educational purposes. Requires operators to implement data security measures and delete student information upon request. Allows students to sue operators for privacy violations with damages up to $500 per incident.

Requires social media platforms to provide clear reporting mechanisms for child sexual abuse material. Mandates platforms to review reported content through hash matching and human review within 30 days. Imposes penalties up to $250,000 per day on platforms that fail to maintain functional reporting systems. Requires platforms to undergo bi-annual third-party safety audits and publicly release findings.

Establishes a state board to regulate artificial intelligence systems that interact with or affect children. Requires AI developers to assess and label their products based on risk levels to children by July 2028. Prohibits AI systems that manipulate children's emotions or collect biometric data without parental consent. Allows children harmed by AI systems to sue for damages and sets $25,000 penalties per violation.

Requires device manufacturers and app stores to verify user age and share age data with app developers. Mandates parental consent for users under 16 to download apps from covered application stores. Requires apps to provide age-appropriate content and parental controls when user age is known. Imposes penalties up to $7,500 per child for intentional violations of age verification requirements.

Requires developers and deployers of automated decision systems to evaluate and disclose their impact on individuals. Mandates that companies provide individuals the right to opt out of AI decisions and appeal automated outcomes. Establishes mandatory third-party audits for AI systems affecting more than 5,999 people every three years. Authorizes civil penalties up to $25,000 per violation for companies that fail to comply with the regulations.

Requires businesses using high-risk AI systems to implement comprehensive data security programs to protect personal information. Mandates annual security reviews and immediate updates when business practices significantly change. Establishes strict access controls including encryption, monitoring, and unique authentication for AI system data. Violations are classified as deceptive trade practices subject to penalties under California's Unfair Competition Law.

Establishes Quantum Innovation Zones to accelerate California's quantum computing development. Creates a diverse board of directors with representatives from government, industry, and academia. Requires annual progress reports tracking job creation and workforce training in quantum computing. Mandates partnerships between cities, universities, and businesses to secure funding and resources.

Requires all California state agencies to implement Zero Trust cybersecurity architecture by 2030. Mandates multifactor authentication and continuous monitoring for all state systems and data access. Establishes a two-phase implementation with Advanced maturity required by 2026 and Optimal by 2030. Requires agencies to submit annual security assessment reports tracking Zero Trust implementation progress.

Requires AI systems with over 1 million monthly users to provide free detection tools for AI-generated content. Mandates large online platforms to retain and display provenance data that verifies content authenticity. Requires device manufacturers to include provenance data capture features in cameras and recording devices. Imposes $5,000 daily penalties for violations, enforceable by state and local attorneys.

Requires developers to assess high-risk AI systems for discrimination before public deployment starting 2026. Mandates companies notify individuals when AI systems are used to make decisions affecting them. Prohibits state agencies from contracting with companies that violate AI discrimination laws. Authorizes penalties up to $25,000 per violation for companies that discriminate using AI systems.

Prohibits businesses from using algorithms that process competitors' private data to set prices or rents. Imposes civil penalties of up to $1,000 for each violation of the algorithmic price-fixing ban. Allows sellers to avoid penalties by proving they conducted due diligence before using pricing algorithms. Authorizes the Attorney General and local officials to enforce the ban through civil lawsuits.

Requires a state study on artificial intelligence's impact on jobs and worker well-being in California. Mandates the UCLA Labor Center to conduct the comprehensive workforce impact study. Sets a June 2027 deadline for submitting study findings to the state Legislature.

Expands data broker reporting requirements to include sensitive personal data like citizenship and biometric information. Requires data brokers to provide clear instructions for consumers to access and delete their personal information. Imposes daily fines of $200 for data brokers who fail to register or comply with deletion requests. Mandates data brokers to undergo privacy audits starting January 2029.

Establishes legal protections against the creation and sharing of non-consensual AI-generated explicit content. Requires service providers to stop enabling deepfake pornography services within 30 days of receiving violation evidence. Increases maximum penalties to $250,000 for malicious creation or sharing of non-consensual explicit deepfakes. Allows prosecutors to pursue civil cases against deepfake pornography services without proving individual harm.

Prohibits food delivery apps from using customer tips to reduce drivers' base pay. Requires delivery platforms to provide human customer service representatives when automated systems fail. Mandates full refunds for undelivered or incorrect orders, including all fees and taxes. Requires platforms to show drivers itemized pay breakdowns including base pay, tips, and bonuses.

Requires browsers to include easy-to-find settings for users to opt out of personal data sharing. Mandates mobile operating systems add privacy opt-out settings within six months of new regulations. Empowers the California Privacy Protection Agency to create and enforce opt-out signal requirements. Expands consumer privacy protections under the California Consumer Privacy Act of 2018.

Prohibits AI healthcare systems from falsely implying their advice comes from licensed medical professionals. Requires health licensing boards to enforce violations of AI systems misusing professional medical titles. Establishes each misuse of a professional medical title or credential by AI as a separate violation. Empowers medical boards to pursue injunctions against AI systems that deceptively present as licensed providers.