Existing law requires a health facility, clinic, physician's office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both (1) a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and (2) clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person. Existing law exempts from this requirement a communication read and reviewed by a human licensed or certified health care provider. This bill would require developers and deployers, as defined, of an artificial intelligence system that produces a prediction, classification, recommendation, evaluation, or analysis that aids decisionmaking related to diagnosis or treatment, known as a clinical decision support system, to make reasonable efforts to identify clinical decision support systems developed for use by deployers that are known or have a reasonably foreseeable risk for biased impacts resulting from deployment of the system in health programs or activities. The bill would require developers to make a statement describing the intended uses and known or reasonably foreseeable risks associated with the use of the clinical decision support system and certain documentation available to deployers, as specified. The bill would require developers to make reasonable efforts to mitigate known or reasonably foreseeable risk for biased impacts resulting from use of the clinical decision support system in health programs or activities. The bill would require deployers to regularly monitor clinical decision support systems and take reasonable and proportionate steps to mitigate known or reasonably foreseeable risk of biased impacts. The bill would specify that a person, partnership, state or local governmental agency, or corporation may be both a developer and a deployer.
Existing law makes it unlawful for any person to use a bot to communicate or interact with another person in this state online with the intent to mislead the other person about its artificial identity for the purposes of knowingly deceiving the person about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election, unless the person using the bot discloses that it is a bot. Existing law defines a "bot" as an automated online account where all or substantially all of the actions or posts of that account are not the result of a person. This bill would require a person who uses a bot to autonomously communicate with another to ensure that the bot discloses to any person with whom the bot communicates when the bot first communicates with the person that the bot is a bot and not a human being, answers truthfully any query from a person regarding its identity as a bot or a human, and refrains from attempting to mislead a person regarding its identity as a bot. The bill would redefine "bot" to mean an automated online account or application that a reasonable person could believe is a human being and with respect to which substantially all of the actions or posts of that account or application are the outputs of generative artificial intelligence, as defined. The bill would exempt from its provisions a person who uses a bot that is required to comply with a more prescriptive disclosure scheme. This bill would authorize the Attorney General, a district attorney, a county counsel, a city attorney, or a city prosecutor to bring a civil action to punish noncompliance, as prescribed.
Existing law establishes the Department of Technology within the Government Operations Agency. Existing law requires the department to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law generally regulates artificial intelligence, including the Transparency in Frontier Artificial Intelligence Act, which, among other things related to the safety of certain artificial intelligence models, requires a large frontier developer to write, implement, comply with, and clearly and conspicuously publish on its internet website a frontier AI framework that applies to the large frontier developer's frontier models and describes how the large frontier developer approaches certain safety-related items. Existing law defines "artificial intelligence" as an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. This bill would require the Government Operations Agency to, no later than January 1, 2029, establish an AI Auditor Registry on the agency's internet website allowing AI auditors to register with the agency and allowing natural persons to report misconduct by a registered AI auditor, and require the agency to fix annual registration fees, as specified. The bill would, commencing January 1, 2029, prohibit an unregistered person from offering, selling, or conducting a covered AI audit, as defined, and would require the agency to, among other things, issue a unique registration number to each registered AI auditor and publish information provided by a registered AI auditor on the agency's internet website. The bill would require the registration number of a registered AI auditor to be clearly and conspicuously displayed on all advertising materials offering or soliciting covered AI audit services. The bill would authorize the agency to adopt regulations that are reasonably necessary to effectuate the purposes of the bill. This bill would require an AI auditor that registers with the agency to provide specified information to the agency and would impose various requirements on a registered AI auditor that conducts a covered AI audit, including, among other things, providing the auditee with a report that includes a signed and dated statement indicating that the audit was conducted according to the provisions of this bill. This bill would require a registered AI auditor to adhere to various standards of independence, objectivity, and integrity, including not seeking, soliciting, negotiating for, or accepting employment with an auditee while participating in the audit and not conducting a covered AI audit if the auditor has a financial, business, employment, or other interest or relationship that would reasonably be expected to impair the auditor's independence or objectivity. The bill would prohibit a registered AI auditor from preventing an employee from engaging in, or from retaliating against an employee who has engaged in, specified whistleblower activity. The bill would authorize the agency to investigate alleged violations of the bill, as specified, and provide that a violation constitutes grounds for removal from the registry and referral to the Attorney General or other appropriate enforcement authority. This bill would create the AI Auditors' Registration Fund within the State Treasury, to be administered by the agency, and would require that all moneys collected or received by the agency pursuant to the above-described provisions be deposited into the fund to be available, upon appropriation by the Legislature, to administer the above-described provisions. Existing law establishes the California Board of Accountancy, which is within the Department of Consumer Affairs, and requires the board to license and regulate accountants in this state. This bill would exempt a registered AI auditor licensed or authorized to practice public accountancy and a firm holding a permit to practice public accountancy issued by the California Board of Accountancy, as specified, from complying with certain requirements related to reporting information to the agency and standards of independence, objectivity, and integrity under the bill if certain requirements are met. The bill would require the Government Operations Agency to, if the agency determines that a certified public accountant, public accountant, or accounting firm in good standing has violated this bill, notify the accountant or firm and the California Board of Accountancy in writing, and would require the board to investigate the complaint and provide the agency with a report of its findings and any resulting action.
Existing law establishes the Office of Information Security within the Department of Technology for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. Existing law requires specified state entities to implement the policies and procedures issued by the office. Existing law additionally authorizes the office to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. Existing law requires every state agency, as specified, to certify, by February 1 annually, to the office that the agency is in compliance with all adopted policies, standards, and procedures and to include a plan of action and milestones, as specified. This bill would require every state agency, as specified, and subject to specified exceptions, to implement Zero Trust architecture for all data, hardware, software, internal systems, and essential third-party software, including for on-premises, cloud, and hybrid environments, to achieve prescribed levels of maturity based on the Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model, as defined, by specified dates. In implementing Zero Trust architecture, the bill would require state agencies to prioritize the use of solutions that comply with, are authorized by, or align to federal guidelines, programs, and frameworks and, at a minimum, prioritize multifactor authentication for access to all systems and data, enterprise endpoint detection and response solutions, and robust logging practices, as specified. The bill would require the office's chief to develop or revise uniform technology policies, standards, and procedures for use by all state agencies in Zero Trust architecture to achieve specified maturity levels on all systems in the State Administrative Manual and Statewide Information Management Manual. The bill would require the chief to update requirements for existing annual reporting activities to collect information relating to the progress state agencies are making to increase internal defenses of agency systems. The bill would authorize the chief to update existing annual reporting activities to include how a state agency is progressing with respect to specified goals. The bill would also state the Legislature's intent that the bill's provisions be implemented in a manner consistent with the state's timely compliance with requirements that are conditions to receipt of federal funds. The bill would also make related legislative findings and declarations.
This measure would state, among other things, the Legislature and the State of California's commitment to protecting, to the fullest extent of the law, all the data and information provided by students and their families to California's postsecondary education.
Existing law creates the California Computer Science Coordinator as a position within the State Department of Education to provide statewide coordination in, among other things, implementing the computer science content standards and leading the implementation of the Computer Science Strategic Implementation Plan, as provided. This bill would establish the California Computer Science Demonstration Grant Program for specified purposes, including increasing the number of public high schools offering a computer science course to increase pupil access to computer science education and increasing the computer science course access of pupils eligible for free or reduced-priced meals and pupils that are underrepresented in the field of computer science. The bill would also establish the California Computer Science Demonstration Grant Program Working Group that includes the coordinator and nonprofit organizations and private industry stakeholders with relevant expertise and experience in computer science education. The bill would authorize only public high schools that do not offer computer science courses to be eligible to voluntarily participate in the grant program. The bill would require the funding entity or funding entities, as defined, to administer the grant program. If there are multiple funding entities, the bill, among other things, would require each funding entity to determine how the funds that it contributes to the grant program will be spent, provided that expenditure aligns with the grant program's purposes, and require the funding entities to coordinate implementation of the grant program. The bill would require the funding entities, in coordination with the working group, to select the public high schools to participate in the grant program, as provided. The bill would require the grant program to be funded through contributions, gifts, grants, in-kind donations, and donations from the funding entity or funding entities, and would specify the allowable uses of those funds. The bill would require the funding entity or funding entities, in coordination with the working group, to evaluate the effectiveness of the grant program and submit an interim report to certain legislative committees on or before August 1, 2027, and a final report on or before July 1, 2028, as specified. The bill would repeal the grant program's provisions as of January 1, 2029. The bill would separately require the department, on or before June 30, 2028, and annually thereafter, to publicly post specified computer science course-related data on its internet website, as specified.
Existing law, the Electronic Communications Privacy Act, prohibits a government entity from compelling the production of, or access to, electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant to specified conditions. Existing law authorizes a government entity to access electronic device information by means of physical interaction or electronic communication with the device in certain circumstances, including, pursuant to the specific consent of the authorized possessor of the device or if the government entity, in good faith, believes that an emergency involving danger of death or serious physical injury to a person requires access to the information. Existing law requires a government entity that obtains electronic information pursuant to an emergency involving danger of death or serious physical injury to a person, within 3 court days after obtaining the electronic information, to file with the appropriate court an application for a warrant or order setting forth the facts giving rise to the emergency. Existing law requires the court to promptly rule on the application and to destroy all information obtained upon a finding that the facts did not give rise to an emergency or upon rejecting the application on any other ground. This bill would additionally authorize a government entity to access electronic device information with the specific consent of an individual who locates a tracking or surveillance device, as defined, and the device is reasonably believed to have been used to track or record the individual without their permission. The bill would require a government entity that obtains information through this method, within 3 court days after obtaining the electronic information, to follow the above process for applying for a warrant or order from a court by setting forth the facts that describe the circumstances and would require the court to promptly rule on the application and order the immediate destruction of all information obtained upon a finding that the facts were not as described. Existing law authorizes an individual whose information is targeted by a warrant, order, or other legal process, or other specified recipients of a warrant, that is inconsistent with the act or the California or United States Constitution, to petition the issuing court to void or modify the warrant, order, or process, or to order the destruction of any information obtained in violation of the act or the California or United States Constitution. This bill would recast the provisions described above to authorize an individual whose information is sought or obtained by a government entity in a manner that is inconsistent with the act or the California or United States Constitution, or other specified recipients of a warrant, order, legal process, request, or demand seeking the individual's information, to petition a court to void or modify the warrant, order, other legal process, request, or demand to order the destruction of the information.
Existing law requires the Public Utilities Commission to appoint a chief internal auditor who holds office at the pleasure of the commission. Existing law makes the chief internal auditor responsible for the oversight of the internal audit unit. Existing law requires the chief internal auditor to plan, initiate, and perform audits of key financial, management, operational, and information technology functions within the commission to improve accountability and transparency to executive and state management, and to report their findings and recommendations directly to an audit subcommittee of the commission. This bill would instead require the Governor to appoint an Inspector General, subject to Senate confirmation, to be responsible for the oversight of the internal audit unit and would instead require the Inspector General to plan, initiate, and perform audits of key financial, management, operational, and information technology functions within the commission to improve accountability and transparency to executive and state management. The bill would also require the Inspector General to ensure, among other things, that the commission administers funds and programs in a prescribed manner, fulfills mandated requirements, develops an annual audit plan, administers an effective enterprise risk management program, and monitors reporting compliance. The bill would provide for the appointment and removal of the Inspector General, as specified. The bill would authorize the Inspector General to access and examine all records, files, documents, accounts, reports, correspondence, or other property of the commission and public utilities, and would require other entities that are regulated by the commission and participate in programs administered by the commission, upon request of the Inspector General, to provide or make available to the Inspector General for examination all relevant records, files, documents, accounts, reports, correspondence, or other property pertaining to participation in those programs, as specified. The bill would require the Inspector General to report specified information to the Governor and the Legislature, as provided.
Existing law requires the governing board of a school district that maintains one or more schools containing any of grades 7 to 12, inclusive, to establish a policy regarding participation in extracurricular and cocurricular activities by pupils in those grades as a condition for the receipt of specified school funding allocations. This bill, commencing with the 2027–28 school year, would prohibit a school district, county office of education, or charter school from excluding a pupil from participating in any extracurricular activity, including sports and clubs, due to the pupil not having or using addictive feeds, as defined. Existing law provides that parents and guardians of children enrolled in public schools have the right and should have the opportunity, as mutually supportive and respectful partners in the education of their children within the public schools, to be informed by the school, and to participate in the education of their children, as specified, including by, among other things, to be notified on a timely basis if their child is absent from school without permission. This bill, commencing with the 2027–28 school year, would prohibit a school district, county office of education, or charter school from using addictive feeds, as defined, as the only means of contacting pupils or pupils' parents or guardians.
The California Fair Employment and Housing Act establishes the Civil Rights Department within the Business, Consumer Services, and Housing Agency and requires the department to, among other things, bring civil actions to enforce the act. Existing law requires, on or before September 1, 2024, the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. This bill would generally regulate the development and deployment of an automated decision system (ADS) used to make consequential decisions, as defined. The bill would define "automated decision system" to mean a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is designed or used to assist or replace human discretionary decisionmaking and materially impacts natural persons. This bill would require a developer of a covered ADS, as defined, to take certain actions, including providing a potential deployer instructions explaining how the covered ADS should be used by the deployer to make or facilitate a consequential decision. This bill would require a deployer of a covered ADS to take certain actions, including provide certain disclosures to a subject of a consequential decision made or facilitated by the covered ADS that results in an adverse outcome, as defined, and provide the subject with an opportunity to appeal the outcome of the consequential decision, as prescribed. This bill would authorize the Attorney General to bring a specified civil action for noncompliance.
