Introduction to AI in California

AI has evolved over the past decade. It has transformed industries and reshaped the global economy, particularly in healthcare, finance, education, transportation and entertainment. These advancements have led to significant breakthroughs in machine learning, natural language processing, autonomous systems and robotics.

California – home to Silicon Valley and a hub for technological innovation – has emerged as the epicentre of leading players in the AI industry, such as OpenAI, Meta, Google, Anthropic and others. These tech giants have been at the forefront of AI innovation, driving the development of sophisticated AI models and applications. However, in addition to AI’s seemingly limitless potential, the use of AI also poses significant challenges and risks – such as ethical, legal, social and economic implications – that require careful oversight and governance. Because of this, California has been a leader in considering these issues and regulating AI.

Lawmakers in California have been collaborating with key industry stakeholders, such as tech companies, academic institutions, the entertainment industry and other advocacy groups, to enact laws designed to ensure that AI is developed, deployed and used responsibly. These collaborative efforts aim to strike a balance between fostering innovation and safeguarding the interests of workers and the public. The regulatory framework in California seeks to mitigate AI-specific risks while promoting transparency, the elimination of bias, and accountability.

California’s approach to regulating AI has been guided by its historical connection to the entertainment industry. In 2023, a Hollywood actor’s strike (including actors, voice artists and other performers) and a separate Hollywood writer’s strike were primarily driven by the prospect of generative AI replacing jobs in the entertainment industry. Lawmakers responded with Assembly Bill 459, which aimed to safeguard actors’ rights by ensuring that their voices and likenesses could not be digitally recreated without consent. However, the bill failed to progress in the 2024 legislative session.

While California is at the forefront of enacting AI regulations, this has not been without controversy. Recently, in September 2024, the Governor vetoed an AI bill that was viewed by some as a blueprint for national legislation to ensure the safe development of AI technology. The passing of the bill was fraught with controversy. While some in the AI community supported it (including a leading AI company), others did not. Even federal politicians weighed in on the debate. The Governor acknowledged that a California-only approach to regulating AI may be warranted, but cited several reasons for the veto, including that:

• sufficient empirical evidence to justify its stringent standards was lacking;
• these stringent standards could stifle innovation in California’s AI industry; and
• large-scale AI models were specifically targeted, but the risks posed by smaller models deployed in high-risk environments were largely ignored.

Supporters of the bill disagreed. This was a lesson for all regarding the complexity of regulating AI, even in a state where one political party dominates all the branches of government.

California’s Regulatory Approach to AI

California has adopted a proactive approach to regulating AI, distinguishing itself from other states and the federal government. Effective from the beginning of 2025, 18 new AI laws were enacted in California. These were 18 of at least 38 AI-related bills worked on by the California legislature in 2024 alone. The result is a patchwork approach of AI regulations that is the most comprehensive in the nation and addresses a variety of issues, including deepfakes, privacy, the use of AI in healthcare, protecting children and workers, and AI transparency. All of this is in furtherance of the Governor’s 2023 Executive Order laying out how California’s measured approach will focus on shaping the future of ethical, transparent and trustworthy AI while remaining the world’s AI leader.

California’s efforts have not gone unnoticed at the federal and global levels. The European Union (EU) established an office in San Francisco to support the EU’s co-operation with the United States, namely regarding West Coast stakeholders, digital regulation and innovation policies. It sent a tech envoy, Gerard de Graaf, to better communicate with the United States and California about laws and regulations around AI. The tech envoy and deputy head of the EU office have stated that California has the potential to influence AI regulation in the United States.

Key regulatory bodies

Several key regulatory bodies oversee AI regulations in California.

California Department of Technology

This department is responsible for ensuring that AI technologies used within the state adhere to safety and ethical standards.

California Privacy Protection Agency (CPPA)

The CPPA oversees the enforcement of privacy laws, including those related to AI. It ensures that AI systems comply with the California Consumer Privacy Act (CCPA) and other privacy regulations.

California Civil Rights Department

This department addresses issues related to algorithmic discrimination and ensures that AI systems do not violate civil rights laws (eg, the Fair Employment and Housing Act and Title VII of the Civil Rights Act).

Current regulatory framework and guidelines

California’s regulatory framework for AI includes several key pieces.

The California AI Transparency Act (SB 942)

This imposes disclosure requirements on providers of large generative AI systems. This act also mandates the provision of a free, publicly accessible AI detection tool and sets penalties for non-compliance.

Digital replica laws (AB 1836 and AB 2602)

These protect individuals from the unauthorised use of their likeness and voice, including AI-generated replicas.

The Generative AI Training Data Transparency Act (AB 2013)

This requires generative AI developers to post high-level summaries about their training data, starting 1 January 2026.

Artificial intelligence definition and governance (AB 2885)

This standardises the definition of AI across various parts of California law, ensuring consistency in regulation.

The AI in healthcare utilisation review (SB 1120)

This sets transparency, privacy and other standards for AI and algorithms used by healthcare service plans and disability insurers.

Impact of AI on Specific Sectors in California

California’s approach to regulating AI has been driven by the goal of addressing the needs of industries operating within the state and the specific challenges faced by those industries.

Entertainment

California’s AI digital replica legislation, namely Assembly Bill 2602, is set to significantly affect the Hollywood industry by imposing stringent rules governing the use of digital replicas of performers. This regulation requires explicit agreement for any utilisation of an actor’s digital likeness, which safeguards the performer’s rights and intellectual property (IP). The entertainment industry is an integral part of California’s economy, generating billions in revenue. Safeguarding this industry is essential for both economic stability and the preservation of artists’ creative integrity and personal rights. AB 2602’s introduction signifies a proactive strategy for tackling the legal and ethical challenges presented by breakthroughs in AI technology.

California seeks to preserve actors’ ownership over their digital identities to prevent unlawful exploitation and potential misuse of digital replicas, promoting a secure and respectful workplace for creative professions. This legislative framework emphasises California’s intention to strike a balance between protecting individual rights and fostering innovation so that the entertainment industry grows fairly and equitably.

Automated vehicles

California’s legislative framework for AI, especially in the autonomous car sector, is set to significantly affect the industry’s growth and operational dynamics. The California Department of Motor Vehicles (DMV) has implemented a proactive AI approach, prioritising safety and innovation. Senate Bill 1298, enacted in 2012, established the framework for the use of autonomous vehicles on public highways, subject to compliance with specific safety and performance standards. Assembly Bill 1592 expanded this framework by allowing limited testing of autonomous vehicles free of a driver, steering wheel or pedals in designated zones. Waymo and Zoox, both based in California, are leading this advancement in technology. Waymo, functioning in San Francisco, has documented over 25 million miles driven autonomously on public roadways, demonstrating progress in safety and reliability.

The achievements of these businesses highlight the value of safeguarding the industry of autonomous vehicles in California, as it offers economic advantages, job creation and advancements in transportation safety and efficiency. The state’s legislative initiatives, including SB 1298 and AB 1592, are essential for promoting an environment open to innovation while ensuring public safety.

Healthcare

California has led in advocating the use of AI in healthcare while maintaining patient protection. The passage of the CCPA and the California Privacy Rights Act (CPRA) highlights the state’s dedication to protecting sensitive health information. These regulations impose rigorous privacy and security protocols, which are crucial in an industry that manages vast quantities of personal health data. Assembly Bill 3030 aims to ensure transparency and accountability in AI applications within healthcare by requiring that health facilities, clinics, physicians’ offices and group practices disclose the use of generative AI when communicating clinical information about patients’ health status, and by providing clear guidance for patients on how they can reach a human regarding the message. Senate Bill 1120 governs the use of AI algorithms and other software tools by healthcare service plans and insurers to ensure compliance with established rules, including standards of fairness and non-discrimination, in the approval of requests.

California aims to foster trust in AI technologies through the adoption of stringent rules, ensuring that they improve medical care while protecting privacy and equity. These regulations are expected to establish a precedent for other states, underscoring California’s leadership in technological innovation and consumer safety.

Data Protection and AI

As AI continues to evolve, compliance with data protection laws becomes increasingly critical. California has enacted several standalone laws to ensure that AI systems adhere to stringent data protection standards. The following provides an overview of compliance requirements under the CCPA and the CPRA, standalone AI laws, guidance from regulatory bodies, and key principles for AI developers.

Compliance with California’s data protection laws

California’s CCPA and CPRA set the foundation for data protection in AI systems. These laws require businesses to handle personal information responsibly and transparently. Key amendments to these acts include:

• personal information definition – the CCPA now includes various formats of personal information, such as physical documents, digital files and AI-generated data (AB 1008);
• sensitive personal information – the definition has been expanded to include neural data (SB 1223); and
• opt-out rights – businesses must honour consumer opt-out preferences even in mergers or acquisitions (AB 1824).

Key principles for AI compliance

To comply with California’s data protection laws, AI developers should focus on the following principles:

• fairness – ensure that AI systems do not discriminate and are designed to treat all individuals equitably;
• accountability – maintain clear documentation and be prepared to demonstrate compliance with data protection laws;
• transparency – provide detailed information about the data used to train AI systems (under AB 2013, developers must post high-level summaries of their training datasets, including sources, types of data, and any modifications made);
• lawfulness – adhere to all relevant laws and regulations, including by obtaining all necessary consents and ensuring that data is collected and used legally; and
• accuracy – regularly review and update AI systems to ensure that their data is current and accurate.

Procurement of AI

As businesses increasingly adopt AI tools to enhance operations, understanding the procurement process is crucial. California has established comprehensive guidelines for public sector procurement of generative AI (GAI) technology, which can serve as a valuable reference for private sector businesses. These guidelines emphasise identifying AI elements in procurement processes and ensuring compliance with established protocols.

Best practices for businesses procuring AI tools

When procuring AI tools, businesses should follow these best practices to ensure successful integration and compliance:

• identify business needs – clearly define the business needs and objectives that the AI tool must address;
• engage stakeholders – collaborate with end users and stakeholders to understand the impact of AI on operations, and gather feedback;
• risk assessment – conduct thorough risk assessments to evaluate potential risks associated with deploying AI technology; and
• training – provide comprehensive training for employees on using and managing of AI tools to ensure proper implementation and usage.

Key areas of risk

When procuring AI tools, businesses must be aware of several key areas of risk:

• origin of training data – ensure that the data used to train AI models is sourced ethically and legally, and verify the accuracy and reliability of the data to avoid biases and inaccuracies;
• IP rights – clarify IP rights related to AI tools, including ownership of the AI models and any generated content;
• personal data – protect personal data by complying with privacy regulations and implementing robust data security measures; and
• confidentiality – maintain the confidentiality of sensitive information processed by AI tools to prevent unauthorised access and data breaches.

Government guidelines and policies for AI procurement

The California Generative AI Procurement Guidelines provide a structured approach for state entities and can be adapted by businesses to enhance their AI procurement processes. Additional key aspects of these guidelines include:

• mandatory disclosure – all AI-related solicitations must include disclosure notifications to inform bidders of AI requirements;
• written solicitations – ensure that all AI procurements are documented in writing to maintain transparency and accountability;
• risk evaluations – conduct risk evaluations for all AI procurements and consult with relevant authorities if the risk level is moderate or high;
• special provisions – incorporate special provisions in AI contracts to address specific requirements and risks associated with AI technology; and
• reporting and monitoring – regularly report AI technology contracts and assign subject matter experts to monitor and validate contract deliverables.

By adhering to these best practices and being mindful of key risk areas, businesses can effectively procure and integrate AI tools while mitigating potential risks. The California guidelines offer a robust framework that can be tailored to meet the specific needs of private sector organisations, ensuring a smooth and compliant AI procurement process.

Consumer Protection

California’s AI regulations have been enacted with the overarching goal of fostering innovation while protecting consumers. This was most recently reiterated in January 2025, in two Legal Advisories issued by California Attorney General Rob Bonta, which summarise AI-related law applicable to businesses that develop, sell or use AI. The following discusses key points from the advisories.

Legal obligations for AI developers and users

AI-associated businesses must comply with various California laws, including consumer protection, civil rights, competition and privacy laws. Key obligations include:

• transparency – businesses must inform consumers about the use of AI and how their data is being utilised;
• testing and validation – AI systems must be rigorously tested and validated to ensure that they are safe, ethical and lawful; and
• accountability – businesses can be held accountable for harm caused by AI, particularly if used negligently.

Consumer protection laws

California’s Unfair Competition Law (UCL) is designed to protect residents from unlawful, unfair or fraudulent business practices, including those involving AI. The law’s broad language covers traditional and novel forms of deception, making it applicable to AI-related activities such as false advertising, creating deepfakes, and unauthorised use of personal likenesses. Violations of other laws are also actionable under the UCL, extending its reach to various contexts where AI might be misused. Businesses and developers using AI must ensure compliance with these protections to avoid legal repercussions.

Civil rights laws

AI systems must not discriminate based on protected characteristics. AI systems must comply with California’s civil rights laws, including the Civil Rights Act and the Fair Employment and Housing Act (FEHA). Businesses must ensure that AI does not perpetuate biases and must provide specific reasons for adverse actions influenced by AI.

Privacy laws

California’s privacy laws impose strict requirements on the collection, use and sharing of personal information. Businesses must ensure that AI systems respect consumers’ privacy rights.

New AI legislation

Effective as of 1 January 2025, new laws impose additional requirements on AI developers and users, including:

• disclosure requirements – AI developers must disclose information about their training data;
• unauthorised use of likeness – strict regulations on using individuals’ likenesses in AI-generated content;
• election and campaign materials – AI-generated campaign ads must include specific disclosures; and
• healthcare supervision – licensed physicians must supervise AI tools used in healthcare settings.

The Legal Advisories outline how existing consumer protection, civil rights, competition and privacy laws, as well as newly enacted AI laws, apply to the development and use of AI.

AI in Litigation

California legal institutions have been active in exploring and regulating the use of AI with respect to litigation. 

In 2024, the Chief Justice of the California state courts launched a new judicial branch task force to evaluate GAI for its potential benefits to courts and court users while mitigating risks to safeguard the public. The task force will suggest policies that enable courts to implement the safe and responsible use of AI in court administration. 

The State Bar of California issued guidance for lawyers using GAI in their legal practice. This guidance emphasises the need to adhere to professional responsibilities, to understand GAI’s risks and benefits, and to ensure that client confidentiality is maintained.

Use of AI in judicial processes

Lawyers must review all GAI outputs, including analysis and citations, for accuracy before court submission, and must correct any errors or misleading statements. Additionally, they should check for any rules, orders or other requirements in the relevant jurisdiction that may necessitate the disclosure of GAI use.

Guidance for legal professionals on AI use

Lawyers should ensure confidentiality by not inputting sensitive client information into GAI solutions without adequate security measures. They must understand GAI’s benefits, risks and limitations and avoid overreliance on AI by validating outputs with human analysis. Managerial lawyers should establish clear policies and provide training on GAI use, ensuring compliance with professional obligations. Communication with clients about GAI use should be evaluated based on the technology’s novelty and client sophistication. Lawyers may charge for actual time spent on GAI tasks but not for time saved, with fee agreements clearly explaining all fees and costs.

Future Trends and Developments

In light of the Trump administration’s efforts to deregulate the use of AI, it may be that state regulations become the primary regulations for the foreseeable future. While California has already been proactive and has enacted the most comprehensive set of state laws regarding AI, given the fast pace at which AI technology is developed and the new issues that arise in connection with such developments, the authors expect that California government officials will continue to closely monitor such developments and consider additional regulations.

As a result of the Governor’s veto of SB 1047, which some considered to be a potential blueprint for national AI legislation, the authors expect that California will revisit passing a broad framework to govern AI safety. The failures with SB 1047 have made it clear that a broad regulatory framework governing AI will require the support of government officials, industry leaders and technology companies across the spectrum (both small and large companies). Aggressive regulations that may burden the state’s leading AI companies will be a challenge to enact as California is focused on enabling tech companies to compete in the global AI race. Regulations must be equitable and take into account that technology from smaller or newer companies may raise the same issues as those presented by technology from larger companies.

California lawmakers will continue to explore the broad range of issues that are implicated by AI, including ethical implications, privacy and security issues, algorithmic bias, and AI’s economic impact on the workforce. Lawmakers will also look at international standards as precedent of what other jurisdictions are regulating with respect to AI. Consistent regulations across the globe help facilitate international co-operation, trade and innovation. They also ensure that AI systems developed in California can compete in the global market and adhere to best practices recognised worldwide.