Generates text with AI, in California

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Health and Safety Code Section 1339.75 · Read the law's page

• If you are a health facility, clinic, physician's office, or office of a group practice using generative AI to produce written or verbal patient communications about clinical information, include a disclaimer that the communication was generated by generative artificial intelligence
• Place that disclaimer at the start of a written letter or email, displayed throughout an ongoing chat, video, or telehealth interaction, or spoken at the start and end of an audio interaction, depending on the communication's format
• In each such communication, give clear instructions describing how the patient can reach a human health care provider or other appropriate person
• Both duties do not apply where a licensed or certified human health care provider reads and reviews the AI-generated communication before it is sent

Cal. Penal Code Sections 311.1, 311.2 and 311.11 (AB 1831, Ch. 926, and SB 1381, Ch. 929, Stats. 2024) · Read the law's page

• Do not knowingly possess or control matter that incorporates digitally altered or artificial-intelligence-generated matter, knowing that the matter is obscene and depicts what appears to be a person under 18 years of age engaging in or simulating sexual conduct (Penal Code Section 311.11(a)(2)).
• Do not knowingly possess or control matter that incorporates digitally altered or artificial-intelligence-generated matter, the production of which involves the use of a person under 18 years of age, knowing that it depicts a person under 18 years of age engaging in or simulating sexual conduct; the matter need not be obscene, and the paragraph does not apply to drawings, figurines or statues (Section 311.11(a)(1) and (d)).
• Do not, in California, possess, prepare, publish, produce, develop, duplicate or print digitally altered or artificial-intelligence-generated matter with intent to distribute or exhibit it, and do not distribute or exhibit obscene matter, knowing that it depicts a person under 18 years of age or contains digitally altered or artificial-intelligence-generated data depicting what appears to be a person under 18 years of age engaging in or simulating sexual conduct (Section 311.1(a)).
• Do not distribute or exhibit obscene matter depicting a person under 18 years of age, or an AI-generated or digitally altered depiction of what appears to be one, for commercial consideration, and do not possess such matter with intent to distribute it for commercial consideration (Section 311.2(b)); do not distribute or exhibit it to, or exchange it with, a person under 18 years of age (Section 311.2(d)).
• The prohibitions in Sections 311.1 and 311.2 do not apply to the activities of law enforcement and prosecuting agencies in investigating and prosecuting criminal offenses, to legitimate medical, scientific or educational activities, or to lawful conduct between spouses (Sections 311.1(b) and 311.2(e)).

AB 316 (Ch. 672, Stats. 2025), Cal. Civ. Code Section 1714.46 · Read the law's page

• Do not defend a claim that artificial intelligence you developed, modified, or used caused harm to the plaintiff by arguing that the artificial intelligence autonomously caused the harm; the defense is unavailable (Civil Code Section 1714.46(b)).
• You may still present any other affirmative defense, including evidence relevant to causation or foreseeability, and evidence relevant to the comparative fault of any other person or entity (Section 1714.46(c)).

Cal. Bus. and Prof. Code Sections 22601 to 22606 · Read the law's page

• If a reasonable person interacting with your companion chatbot could be misled into believing they are talking to a human, issue a clear and conspicuous notification that the chatbot is artificially generated and not human
• Do not let a companion chatbot on your platform engage with users unless you maintain, and publish on your website, a protocol for preventing it from producing suicidal ideation, suicide, or self-harm content, including a notification referring the user to a crisis hotline or crisis text line
• For a user you know is a minor, disclose that they are interacting with artificial intelligence, and provide a clear and conspicuous break reminder by default at least every three hours during continuing interactions (Section 22602(c)(1) and (2), deleted by SB 1119 effective January 1, 2027)
• For a user you know is a minor, take reasonable measures to prevent your companion chatbot from producing visual sexually explicit material or directly telling the minor to engage in sexually explicit conduct (Section 22602(c)(3), deleted by SB 1119 effective January 1, 2027)
• Disclose, wherever a user can access your companion chatbot platform, that companion chatbots may not be suitable for some minors (Section 22604)
• Beginning 1 July 2027, report annually to the Office of Suicide Prevention on the crisis-referral notifications you issued and the protocols you have in place, without including user identifiers or personal information
• A companion chatbot used only for customer service, internal business purposes, or as a limited video-game feature, or a stand-alone voice-command consumer device that does not sustain a relationship across interactions, falls outside this chapter

Cal. Bus. and Prof. Code Sections 22757.10 to 22757.16 · Read the law's page

• If you are a large frontier developer (a frontier developer whose group had annual gross revenues over $500,000,000 in the prior calendar year), write, implement and publish on your website a frontier AI framework describing how you define and assess catastrophic-risk thresholds for your frontier models and apply mitigations, and review that framework at least once a year
• If you are a large frontier developer, make your published frontier AI framework describe your cybersecurity practices to secure unreleased model weights from unauthorized modification or transfer by internal or external parties (Section 22757.12(a)(7))
• Before or when you deploy a new or substantially modified frontier model, publish a transparency report giving the model's release date, supported languages, output modalities, intended uses, and any generally applicable restrictions
• If you are a large frontier developer, add to that transparency report summaries of your catastrophic-risk assessments, their results, and the extent of any third-party evaluator involvement
• If you are a large frontier developer, transmit summaries of catastrophic-risk assessments from your frontier models' internal use to the California Office of Emergency Services on a quarterly or agreed schedule
• If you are a frontier developer, report a critical safety incident pertaining to one or more of your frontier models to the Office of Emergency Services within 15 days of discovering it; if you discover information about the incident after filing, you may file an amended report (Section 22757.13(c))
• If you are a frontier developer, disclose a critical safety incident that poses an imminent risk of death or serious physical injury within 24 hours of discovering that it does so, to an authority, including any law enforcement agency or public safety agency with jurisdiction, that is appropriate based on the nature of the incident and as required by law (Section 22757.13(c)(2))
• Do not make a materially false or misleading statement about catastrophic risk from your frontier models, or, if you are a large frontier developer, about your compliance with your own frontier AI framework
• Do not retaliate against a covered employee who discloses, in good faith and with reasonable cause, that your activities pose a catastrophic-risk danger to public health or safety or that you violated this Act; if you are a large frontier developer, also provide an internal channel for anonymous disclosure of that kind

Cal. Civ. Code Sections 3110 and 3111 · Read the law's page

• Post training-data documentation on your website before making a generative AI system publicly available to Californians, and again before any substantial modification
• Cover the datasets and their sources and owners, an approximate count and description of the data points, whether the data includes copyrighted or personal information, and whether synthetic data generation was used
• The duty reaches systems first made publicly available on or after 1 January 2022

Cal. Bus. & Prof. Code § 22650 et seq. (SB 11, 2025–2026 Reg. Sess.)

• This law is enacted but does not take effect until 1 December 2026; what follows applies from that date.
• If you make available AI technology capable of creating digital replicas of real people, display a consumer warning stating that unlawful use of the technology to depict another person without prior consent may result in civil or criminal liability for the user.
• If you make available AI technology capable of creating digital replicas of real people, hyperlink that warning on the pages where users enter prompts.
• If you make available AI technology capable of creating digital replicas of real people, include that warning in your terms and conditions.

Cal. Bus. and Prof. Code Section 6068.1 (SB 574, Ch. 858, Stats. 2026) · Read the law's page

• If you are an attorney, do not delegate the practice of law to generative artificial intelligence
• If you are an attorney who uses generative AI to assist in the practice of law, do not enter confidential, personal identifying, or other nonpublic information into a generative AI system unless access to what you input is restricted to you and persons you authorize under obligations to protect its confidentiality
• Take reasonable steps to verify the accuracy of generative AI outputs, including all case and statutory citations, and to correct any erroneous or hallucinated output in any material you use
• Disclose the use of generative AI to the court for all documents you submit to the court, and consider whether to disclose its use if it is used to create content provided to the public
• Do not file a brief, pleading, motion, or other paper in any court that contains a citation you have not personally verified, including a citation provided by generative AI
• If you are an arbitrator, do not delegate any part of your decisionmaking process to any generative AI tool, and do not rely on information generated by generative AI outside the record without making appropriate disclosures to the parties beforehand and, as far as practical, allowing them to comment on its use

Cal. Gov. Code Section 8319 (SB 1159, Ch. 863, Stats. 2026) · Read the law's page

• Do not knowingly use artificial intelligence to falsely represent that a natural person appeared before, submitted information to, or otherwise engaged with a California governmental agency
• Make requests, comments, and other submissions to a California agency under the Public Records Act, the Bagley-Keene Open Meeting Act, the Ralph M. Brown Act, the Legislative Open Records Act, the Administrative Procedure Act, the California Coastal Act of 1976, or the California Environmental Quality Act as a natural person or a legally recognized entity, because an artificial intelligence system, autonomous agent, or robot is not a person, interested person, participant, or member of the public under those acts
• A natural person may use artificial intelligence, autonomous agents, or robots to facilitate their own engagement with a governmental agency, including through assistive technologies, provided the volume and frequency of the engagement are reasonably consistent with ordinary participation by a natural person

Cal. Gov. Code Sections 8898 to 8898.4 (SB 813, Ch. 179, Stats. 2026) · Read the law's page

• This chapter does not require you to engage an independent verification organization (IVO) or undergo a covered AI audit as a condition of developing, deploying, or operating an AI system or model in California; doing so is voluntary.
• If you want to be designated as an IVO, apply once the Government Operations Agency publishes its application requirements and designation criteria, due by January 1, 2028.
• If you are a designated IVO, submit an annual report on your standards, methodologies, governance changes, and conflicts of interest to the agency and the Legislature, starting no sooner than 12 months after your designation.
• If a court considers whether your AI system or model caused harm, an audit performed to a standard identified under this chapter is relevant to, but not conclusive of, that action; the chapter creates no safe harbor or affirmative defense.

Cal. Gov. Code Sections 11549.80 to 11549.86 (AB 1405, Ch. 178, Stats. 2026) · Read the law's page

• This chapter binds AI auditors (anyone who assesses an AI system or model on behalf of a third party), not the developer or deployer of the AI system being assessed, unless that developer or deployer also offers covered AI audits to others.
• If you offer, sell, or conduct a covered AI audit, an audit assessing internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with California law, register with the Government Operations Agency before doing so, starting January 1, 2029.
• If you register as an AI auditor, give the agency your business name, contact information, the California laws or regulations you audit under, relevant certifications, a description of your services, and a standard operating procedure describing the standards you apply and the basis for your accuracy and reliability claims.
• If you are a registered AI auditor, update that information with the agency within 90 days of any change that materially affects its accuracy or completeness.
• If you are a registered AI auditor, do not conduct a covered AI audit of a system, process, control, assessment, or other subject matter you materially designed, developed, implemented, or operated for the auditee, and otherwise maintain independence, objectivity, and competence throughout the audit.
• If you are a registered AI auditor conducting a covered AI audit, give the auditee a report covering the audit's scope and objectives, its results and supporting documentation, each deficiency found and how it could reasonably be addressed, whether the auditee followed its own internal safety standards and protocols within the audit's scope, the audit's limitations, and a signed and dated statement that the audit met this chapter's requirements.
• If you are a registered AI auditor, retain the information you gave the auditee and the documentation behind your audit results for at least 10 years.
• If you are a registered AI auditor, display your registration number clearly and conspicuously on advertising for your audit services, and do not retaliate against an employee who reports suspected noncompliance to the Attorney General, the Labor Commissioner, or the agency.