Data, privacy and AI rules

12 due in 60 days · 190 regulations

California SB 53 (TFAIA)

In force California · In force Jan 1, 2026 · next deadline Jan 1, 2027 (in 2 months)

Deadlines

Coming up
ReportingJan 1, 2027 · in 2 months · Source
First OES anonymized incident report and CDT definition reviewOES begins publishing annual anonymized incident summaries and the Department of Technology begins annual review of the act's definitions; the CalCompute framework report is due to the Legislature.
Already passed
Takes effectJan 1 · 10 months ago · Source
Frontier developer obligations applyFrontier AI frameworks, transparency reports, critical safety incident reporting (15 days, or 24 hours for imminent risk of death or serious injury) and whistleblower protections apply.
MilestoneSep 29, 2025 · 13 months ago · Source
SB 53 signedGovernor Newsom signs SB 53 (chapter 138).

Summaries for reference, not legal advice. Check the official text.

What it does

Frontier AI developers must publish transparency reports when deploying new or substantially modified frontier models and report critical safety incidents to the Office of Emergency Services (OES). Large frontier developers must also write, implement and publish a frontier AI framework for catastrophic risk, update it annually, and send OES quarterly summaries of their catastrophic-risk assessments. The act also adds whistleblower protections and creates the CalCompute public computing consortium.

Who it applies to
Frontier developers: trained or started training a foundation model with more than 10^26 integer or floating-point operations, counting fine-tuning. Large frontier developers: those whose revenue with affiliates exceeded $500,000,000 in annual gross revenue in the preceding calendar year.
Penalties
Civil penalty up to $1,000,000 per violation, recoverable only in a civil action by the Attorney General.
Enforced by
California Attorney General; Office of Emergency Services receives incident reports
Official name
California SB 53, Transparency in Frontier Artificial Intelligence Act (Stats. 2025, ch. 138)
Citation
SB 53 (2025), Stats. 2025, ch. 138
Topics
AI
Verified 2026-09-22 leginfo.legislature.ca.gov
Research notes

CalCompute depends on a budget appropriation. The quarterly catastrophic-risk summary schedule can be set with OES.

Related

AmendedCalifornia
CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months
In forceCalifornia
California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026
In forceCalifornia
California ADS employment regulationsClarifies that using an automated-decision system in hiring or other employment decisions can violate the Fair Employment and Housing Act if it discriminates on protected traits. Employers must keep automated-decision data and employment records for at least four years. AI assessments that elicit disability information can be unlawful medical inquiries.In effect since Oct 1, 2025
EnactedCalifornia
California AI Auditor RegistryCreates a state registry for AI auditors run by the Government Operations Agency. From 2029 only registered auditors may offer, sell or conduct covered AI audits, and they must show their registration number in advertising. Registered auditors must file information and follow conduct rules.Next: Jan 1, 2027 Act takes effect · in 2 months
AmendedCalifornia
California AI Transparency Act (SB 942)Covered generative AI providers must offer a free AI-content detection tool, give users the option of a visible (manifest) disclosure on AI-generated image, video or audio, and embed a latent, machine-readable provenance disclosure. Licensees must keep those disclosures intact, and providers must revoke a license within 96 hours of learning a licensee disabled them. AB 853 delayed the operative date to August 2, 2026 and extends duties to large online platforms and GenAI hosting platforms from 2027 and to capture-device makers from 2028.Next: Jan 1, 2027 Large online platform and hosting platform duties · in 2 months
In forceCalifornia
California AI autonomous-harm defense banA defendant that developed, modified or used AI cannot argue in a civil case that the AI acted autonomously and so caused the harm on its own. Other defenses such as causation and comparative fault remain.In effect since Jan 1, 2026
In forceCalifornia
California Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 months
EnactedCalifornia
California Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 months
Questions about California SB 53 (TFAIA)
What are the California SB 53 (TFAIA) compliance deadlines?
Sep 29, 2025: SB 53 signed. Jan 1, 2026: Frontier developer obligations apply. Jan 1, 2027: First OES anonymized incident report and CDT definition review.
When does California SB 53 (TFAIA) take effect?
California SB 53 (TFAIA) took effect on Jan 1, 2026. The next milestone is Jan 1, 2027: First OES anonymized incident report and CDT definition review.
Who does California SB 53 (TFAIA) apply to?
Frontier developers: trained or started training a foundation model with more than 10^26 integer or floating-point operations, counting fine-tuning. Large frontier developers: those whose revenue with affiliates exceeded $500,000,000 in annual gross revenue in the preceding calendar year.
What are the penalties under California SB 53 (TFAIA)?
Civil penalty up to $1,000,000 per violation, recoverable only in a civil action by the Attorney General.