California AI Regulations

California doesn't have one AI statute you can point to the way Colorado has a single AI statute (SB 26-189) — it regulates AI through several parallel regulatory tracks, each moving on its own timeline, which makes California one of the more operationally complex jurisdictions to track even though no single law here is as sweeping as the EU AI Act.

Automated decision-making technology (ADMT) rules

The California Privacy Protection Agency's regulations on automated decision-making technology, risk assessments and cybersecurity audits took effect on January 1, 2026. Businesses that use ADMT to make significant decisions about consumers, in areas such as employment, lending, housing and health care, must comply with the ADMT requirements from January 1, 2027. Those include pre-use notice, the right to opt out or appeal in many cases, and access to information about the logic involved. Risk assessment attestations are due to the agency by April 1, 2028. Sources differ slightly on the effective date, so confirm the timeline on the CPPA's regulations page.

Frontier AI and generative AI statutes

Two statutes took effect on January 1, 2026 and target AI developers rather than ordinary businesses that use AI:

• SB 53, the Transparency in Frontier AI Act (signed September 29, 2025) imposes transparency and safety-reporting duties on developers of frontier models trained with more than 10^26 floating-point operations, enforced by the Attorney General with penalties of up to $1 million per violation.
• AB 2013, the Generative AI Training Data Transparency Act requires developers of generative AI systems made available to Californians to publish documentation about their training data.

Employment-specific rules

California's existing employment discrimination framework has been extended to explicitly address automated decision systems used in hiring and employment, layering AI-specific expectations on top of the state's already-robust employment law rather than creating a standalone AI-employment statute.

The practical challenge

Because these obligations come from several sources rather than one bill, a compliance program built around "did we satisfy the California AI law" is asking the wrong question — the right question is "which of California's several AI-relevant regulatory tracks does this specific system touch," since a system can clear one track's requirements while still being fully exposed under another.

How this compares to Colorado

Colorado consolidates its rules in a single statute, SB 26-189, whose duties begin January 1, 2027, which is generally easier to build a compliance checklist against; California's fragmented approach requires tracking CPPA rulemaking, generative AI statutes, and employment law amendments as separate, independently evolving obligations. See our Colorado coverage for the contrast.

A third model: Texas's intent standard

A company tracking California and Colorado at once should also look at how Texas's TRAIGA handles the same underlying problem — it skips California's fragmented, multi-track approach and the foreseeability-based duty of care Colorado first adopted in favor of a single statute that only imposes liability where intent to cause a specific listed harm can be shown.

A fourth model: Illinois's two separate statutes

Illinois takes yet another approach — not one fragmented statute like California's, but two entirely unrelated ones: a 2008 biometric-privacy law that has nothing to do with AI by design, and a 2024 employment-discrimination amendment that has nothing to do with biometrics. A company already juggling California's multi-track ADMT rules should treat Illinois as its own separate tracking problem rather than assuming it slots into the same mental model.

A fifth model: New York's four separate instruments

New York goes a step further than any of the above: on top of New York City's own employment-specific ordinance, the state has enacted four distinct instruments since mid-2025 covering frontier-model safety, companion chatbots, personalized pricing, and AI-assisted insurance underwriting. One comparison worth noting directly: California's own companion-chatbot statute, SB 243, gives users a private right of action that New York's equivalent law withholds, enforcing instead through the Attorney General alone — the same underlying policy problem, regulated two different ways by two states that otherwise look similar on AI. Washington's 2026 companion-chatbot law, HB 2225, lands on California's side of that split — it also routes through a private right of action rather than attorney-general-only enforcement.

See every upcoming date on our AI compliance deadlines calendar.