United States – California: High-Risk Systems

6 instruments (6 current) · 13 obligations · 29 claims · 5 milestones

Instruments

• AB 1018 - Automated decision systems (no enactment evidenced) Draft, no legal force

  Automated decision systems accountability bill: passed the Assembly in 2025, was ordered to the Senate inactive file on 2025-09-13, returned from the inactive file on 2026-08-21, and its last recorded action is 2026-08-30 (read second time, ordered to third reading). No passage, signature or veto is recorded.

  Authority: California State Legislature · Verified 8 Oct 2026 · Official text
• AB 1405 - AI Auditor Registry Adopted 2026-09-09; valid from 2027-01-01

  Requires the Government Operations Agency to establish an AI Auditor Registry by January 1, 2029 and bars unregistered persons from offering or conducting covered AI audits from that date.

  Binding · Authority: California Government Operations Agency (GovOps) · Verified 8 Oct 2026
• CCPA regulations: automated decisionmaking technology (ADMT) and risk assessments In force since 2026-01-01

  CalPrivacy regulations effective January 1, 2026 requiring risk assessments for high-risk processing and giving consumers pre-use notice, opt-out and access rights for ADMT used in significant decisions, with ADMT compliance due by January 1, 2027.

  Binding · Authority: California Privacy Protection Agency (CalPrivacy), California Department of Justice - Office of the Attorney General · Verified 8 Oct 2026 · Official text
• Civil Rights Council employment regulations on automated-decision systems In force since 2025-10-01

  Council regulations, effective October 1, 2025, clarifying how existing California antidiscrimination law applies to AI, algorithms and automated-decision systems in employment decisions.

  Binding · Authority: California Civil Rights Council, California Civil Rights Department · Verified 8 Oct 2026 · Official text
• SB 1119 (Adam's Law) - Companion chatbots: children's safety Adopted 2026-09-10; valid from 2027-01-01

  Adds Business and Professions Code Chapter 21810 et seq.: companion chatbot operators must assess and mitigate child safety risks from July 1, 2027, obtain independent child safety audits by January 1, 2029, with public prosecutor penalties and a private right of action for harmed children.

  Binding · Authority: California Department of Justice - Office of the Attorney General, Public prosecutors (district attorneys, city attorneys, county counsel) · Verified 8 Oct 2026
• SB 813 - Independent verification organizations Adopted 2026-09-09; valid from 2027-01-01

  Directs the Government Operations Agency to designate and regulate independent verification organizations (IVOs) that assess AI risk, with application requirements, criteria and suspension procedures due by January 1, 2028.

  Binding · Authority: California Government Operations Agency (GovOps) · Verified 8 Oct 2026

Obligations

• Bus. & Prof. Code § 21812(a)

  Before making a new or substantially modified companion chatbot available, operators must perform and document a child-safety risk assessment and take measures to mitigate identified child safety risks.

  risk management · Applies to: provider · SB 1119 (Adam's Law) - Companion chatbots: children's safety
• Bus. & Prof. Code § 21814(a)

  Operators must ensure an independent child safety audit by January 1, 2029 (or before first public availability if later) and every two years after, and before substantial modifications that increase child safety risk.

  conformity assessment · Applies to: provider · SB 1119 (Adam's Law) - Companion chatbots: children's safety
• Gov. Code § 8898.1

  On or before January 1, 2028, the Government Operations Agency must develop IVO application requirements, procedures to suspend or terminate designations, and criteria for designating AI auditors as IVOs.

  authorisation · Applies to: other · SB 813 - Independent verification organizations
• Gov. Code § 11549.82.5

  From January 1, 2029, no person may offer, sell or conduct a covered AI audit unless registered with the Government Operations Agency.

  registration · Applies to: other · AB 1405 - AI Auditor Registry
• Gov. Code § 11549.82(a)

  No later than January 1, 2029 the Government Operations Agency must establish an AI Auditor Registry allowing auditors to register and natural persons to report misconduct.

  registration · Applies to: other · AB 1405 - AI Auditor Registry
• 11 CCR §§ 7200, 7220

  Businesses using ADMT for significant decisions must provide a Pre-use Notice explaining the ADMT use and consumers' rights, and comply with Article 11 by January 1, 2027.

  transparency disclosure · Applies to: deployer · CCPA regulations: automated decisionmaking technology (ADMT) and risk assessments
• 11 CCR § 7221

  Businesses must give consumers the ability to opt out of ADMT use for significant decisions, unless a human appeal route with authority to overturn the decision is provided.

  human oversight · Applies to: deployer · CCPA regulations: automated decisionmaking technology (ADMT) and risk assessments
• 11 CCR § 7222

  Businesses must provide plain-language information on the purpose and logic of ADMT use when responding to access requests.

  transparency disclosure · Applies to: deployer · CCPA regulations: automated decisionmaking technology (ADMT) and risk assessments
• 11 CCR § 7150(a)

  Businesses whose processing presents significant risk to consumer privacy must conduct a risk assessment before initiating that processing.

  risk management · Applies to: deployer · CCPA regulations: automated decisionmaking technology (ADMT) and risk assessments
• Employment Regulations Regarding Automated-Decision Systems (Civil Rights Council), operative text not opened

  Employers and covered entities remain subject to existing antidiscrimination law when using AI, algorithms or automated-decision systems in employment decisions, as clarified by the regulations.

  other · Applies to: deployer · Civil Rights Council employment regulations on automated-decision systems
• 2 CCR § 11009(f)

  Employers and other covered entities may not use an automated-decision system or selection criteria that discriminates against applicants or employees on a basis protected by FEHA, subject to available defenses; evidence of anti-bias testing is relevant to any claim or defense.

  prohibition · Applies to: deployer · Civil Rights Council employment regulations on automated-decision systems
• 2 CCR § 11008(b)

  A person acting on behalf of an employer to exercise employer functions, including through an automated decision system (for example screening or hiring), is an agent and is also an employer for FEHA purposes.

  other · Applies to: provider · Civil Rights Council employment regulations on automated-decision systems
• 2 CCR § 11013(c)

  Employers and covered entities must preserve personnel and employment records, expressly including selection criteria and automated-decision system data, for the period stated in the section.

  record keeping · Applies to: deployer · Civil Rights Council employment regulations on automated-decision systems

Milestones

• 1 Jan 2027ADMT compliance date for businesses already using ADMT for significant decisions Upcoming
  CCPA regulations: automated decisionmaking technology (ADMT) and risk assessments
• 1 Jul 2027Companion chatbot child-safety risk assessment duties operative Upcoming
  SB 1119 (Adam's Law) - Companion chatbots: children's safety
• 1 Jan 2028Government Operations Agency IVO framework due (statutory) Upcoming
  SB 813 - Independent verification organizations
• 1 Jan 2029First independent child safety audit due Upcoming
  SB 1119 (Adam's Law) - Companion chatbots: children's safety
• 1 Jan 2029AI Auditor Registry due and registration requirement begins Upcoming
  AB 1405 - AI Auditor Registry