Law / United States / 
California
Generative AI Procurement Standards and Training in Public Postsecondary Education (AB 2392)
Cal. Educ. Code Sections 66098 to 66098.3 (AB 2392, Ch. 855, Stats. 2026)
An AI sector rules rule binding government bodies.
- Obligation class
- Governance, Reporting, Retention
- Audit expectation
- none
What it requires
- The office of the Chancellor of the California Community Colleges and the California State University must jointly convene and participate in an intersegmental working group to develop standards for responsible generative AI training and procurement for the purchase, development, and use of generative AI systems for educational purposes (Section 66098.1(a)(1)), and the University of California is requested to do the same; the office of the Chancellor of the California Community Colleges and the Chancellor of the California State University must designate a lead convener responsible for coordinating working group activities (Section 66098.1(a)(2)(B)).
- The office of the Chancellor of the California Community Colleges and the California State University must develop, through the working group, procurement standards that ensure any procured generative AI system meets minimum protections, including a documented risk assessment, no prioritization of engagement over factual accuracy by excessive sycophancy, a vendor safety monitoring protocol, a transparent incident reporting system, written data use, retention, sharing and deletion policies, collection of only data strictly necessary for the stated educational purpose with regular audits, and vendor disclosure of all training data sources (Section 66098.1(a)(3)(A)); the University of California is requested to do the same.
- The office of the Chancellor of the California Community Colleges and the California State University must develop, through the working group, a training on the use of any procured generative AI system covering systemwide policies including academic integrity, the privacy policies that apply, and the limitations of a generative AI system, and present the working group's recommendations to the respective system leaders on or before (Section 66098.1(a)(3)(B) and (C)); the University of California is requested to do the same.
- The office of the Chancellor of the California Community Colleges and the California State University must provide that training to students, faculty, or staff, as applicable (Section 66098.1(b)(1)); the University of California is requested to do the same.
- The office of the Chancellor of the California Community Colleges and the California State University must review the training at least once per academic year, update it as necessary, and maintain records of completed trainings, each holding the name of the individual, the date of completion and the version of the training delivered, for a minimum of four years following the date of completion (Section 66098.2); the University of California is requested to do the same.
- Until procurement standards are adopted, the office of the Chancellor of the California Community Colleges and the California State University must, within 60 days following the execution of a systemwide contract for a generative AI system, submit a written report to the Legislature and its higher education and privacy and consumer protection committees describing the system procured, the vendor name, the intended use, the process used in evaluating and selecting the system, the training to be provided, and the vendor's data use, retention, and privacy practices (Section 66098.3); the University of California is requested to do the same.
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 66098.2(b) requires a record of each completed training, holding the name of the individual, the date of completion and the version of the training delivered, kept for at least four years. It is a record of who took the training, and no section requires a log or record of the operation or use of a generative AI system. Section 66098.3 requires a written report to the Legislature on a system procured, which is not a log either.
- Kind
- None
- As of
What this law does
AB 2392 was chaptered on as Chapter 855 of the Statutes of 2026. The office of the Chancellor of the California Community Colleges and the California State University must, and the University of California is requested to, jointly convene and participate in an intersegmental working group to develop standards for responsible GenAI training and procurement.
The working group is to develop procurement standards that ensure any procured GenAI system has undergone a documented risk assessment of potential harms, misuses, abuses, and bias and does not prioritize engagement over factual accuracy by using excessive sycophancy.
Those standards are to require the system's vendor to have a safety monitoring protocol that detects a user's intent to harm themselves or others and escalates to human review, and a transparent incident reporting system to report and respond to harmful outputs.
Those standards are also to require written policies governing data use, retention, sharing with third parties, and deletion timelines, and a configuration that collects only data strictly necessary for the stated educational purpose and is subject to regular audits. Those standards are also to require the vendor to disclose all training data sources, including whether copyrighted content, personally identifiable information, or student-generated content was used.
The working group is also to develop a training on the use of any procured GenAI system that covers systemwide policies including academic integrity, the privacy policies that apply, including how user data and prompts may be collected, stored, or used to train GenAI systems, and the limitations of a GenAI system. The working group must present its recommendations on procurement standards and training to the respective system leaders on or before .
The training developed by the working group must be provided to students, faculty, or staff, as applicable. The training must be reviewed at least once per academic year and updated as necessary to reflect changes in systemwide policy, applicable law, or the functionality or privacy practices of the GenAI system.
Records of completed trainings must include the name of the individual, the date of completion, and the version of the training delivered, and must be retained for a minimum of four years following the date of completion. Until procurement standards are adopted, a written report must go to the Legislature within 60 days following the execution of a systemwide contract for a GenAI system.
The report must describe the GenAI system procured, including the vendor name, the intended use, and the population with access to it, the process used in evaluating and selecting the system, the training to be provided, and the vendor's data use, retention, and privacy practices.
Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for this act is .
When LexLint raises it
When your app profile says your app serves colleges and universities.
Back to the example · Lint your app
Page updated .