Technology

The California Constitution authorizes the Legislature to exempt from taxation, in whole or in part, property that is used exclusively for religious, hospital, or charitable purposes, and is owned or held in trust by a nonprofit entity. Pursuant to that authority, existing law provides for a welfare exemption under which property used exclusively for an exempt purpose and owned and operated by specified entities, including foundations, limited liability companies, or corporations meeting certain statutory requirements is exempt from taxation. This bill would specify that for the purposes of the welfare exemption provisions above, "property used exclusively for religious, hospital, scientific, or charitable purposes" shall not include property, or any portion thereof, operated as a detention facility, as defined. The bill would declare that the above provision is declarative of, and not a change in, existing law.

The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information that is collected by a business, including the right to delete personal information. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. The CCPA excludes from the definition of "personal information" publicly available information. Existing law defines "publicly available" for these purposes to include 3 types of information. One type is information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media. This bill would revise that part of the definition of "publicly available" by removing the condition that the business have a reasonable basis to believe the information is lawfully made available. The CCPA also includes in that definition of "publicly available" information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. This bill would delete that part of the definition of "publicly available." This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

This measure would urge President Donald J. Trump and Congress to protect and maintain the historic investments made possible by the Bipartisan Infrastructure Law, the CHIPS and Science Act, and the Inflation Reduction Act of 2022.

Existing law, the California Emergency Services Act, establishes the California Cybersecurity Integration Center within the Office of Emergency Services to serve as the central organizing hub of state government's cybersecurity activities and to coordinate information sharing with various entities. Existing law also requires the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and information, as prescribed. This bill would require, on or before July 1, 2026, an operator, defined as a state agency responsible for operating, managing, overseeing, or controlling access to critical infrastructure, that deploys a covered artificial intelligence (AI) system, as defined, to establish a human oversight mechanism that ensures a human monitors the system's operations in real time and reviews and approves any plan or action proposed by the covered AI system before execution, except as provided. The bill would require the Department of Technology to develop specialized training in AI safety protocols and risk management techniques to oversight personnel. The bill would require oversight personnel for an operator to conduct an annual assessment of its covered AI systems, as specified, and to submit a summary of the findings to the department. The bill would make findings and declarations related to its provisions. The bill would preclude disclosure of specified information by the office. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.

Existing law generally regulates artificial intelligence, including by requiring the Office of Emergency Services to, as appropriate, perform a risk analysis of potential threats posed by the use of generative artificial intelligence to California's critical infrastructure, including those that could lead to mass casualty events. This bill would require the Attorney General to establish and maintain a specified program to build internal expertise in artificial intelligence, including its applications, risks, regulatory implications, and civil rights impacts. The bill would require, on or before July 1, 2027, and annually thereafter, the Attorney General to submit a public report to the Legislature describing the program, key developments in artificial intelligence law and policy, and recommendations for additional state oversight or safeguards.

Existing law requires a health facility, clinic, physician's office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both (1) a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and (2) clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person. Existing law exempts from this requirement a communication read and reviewed by a human licensed or certified health care provider. This bill would require developers and deployers, as defined, of an artificial intelligence system that produces a prediction, classification, recommendation, evaluation, or analysis that aids decisionmaking related to diagnosis or treatment, known as a clinical decision support system, to make reasonable efforts to identify clinical decision support systems developed for use by deployers that are known or have a reasonably foreseeable risk for biased impacts resulting from deployment of the system in health programs or activities. The bill would require developers to make a statement describing the intended uses and known or reasonably foreseeable risks associated with the use of the clinical decision support system and certain documentation available to deployers, as specified. The bill would require developers to make reasonable efforts to mitigate known or reasonably foreseeable risk for biased impacts resulting from use of the clinical decision support system in health programs or activities. The bill would require deployers to regularly monitor clinical decision support systems and take reasonable and proportionate steps to mitigate known or reasonably foreseeable risk of biased impacts. The bill would specify that a person, partnership, state or local governmental agency, or corporation may be both a developer and a deployer.

Existing law makes it unlawful for any person to use a bot to communicate or interact with another person in this state online with the intent to mislead the other person about its artificial identity for the purposes of knowingly deceiving the person about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election, unless the person using the bot discloses that it is a bot. Existing law defines a "bot" as an automated online account where all or substantially all of the actions or posts of that account are not the result of a person. This bill would require a person who uses a bot to autonomously communicate with another to ensure that the bot discloses to any person with whom the bot communicates when the bot first communicates with the person that the bot is a bot and not a human being, answers truthfully any query from a person regarding its identity as a bot or a human, and refrains from attempting to mislead a person regarding its identity as a bot. The bill would redefine "bot" to mean an automated online account or application that a reasonable person could believe is a human being and with respect to which substantially all of the actions or posts of that account or application are the outputs of generative artificial intelligence, as defined. The bill would exempt from its provisions a person who uses a bot that is required to comply with a more prescriptive disclosure scheme. This bill would authorize the Attorney General, a district attorney, a county counsel, a city attorney, or a city prosecutor to bring a civil action to punish noncompliance, as prescribed.

Existing law establishes the Department of Technology within the Government Operations Agency. Existing law requires the department to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law generally regulates artificial intelligence, including the Transparency in Frontier Artificial Intelligence Act, which, among other things related to the safety of certain artificial intelligence models, requires a large frontier developer to write, implement, comply with, and clearly and conspicuously publish on its internet website a frontier AI framework that applies to the large frontier developer's frontier models and describes how the large frontier developer approaches certain safety-related items. Existing law defines "artificial intelligence" as an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. This bill would require the Government Operations Agency to, no later than January 1, 2029, establish an AI Auditor Registry on the agency's internet website allowing AI auditors to register with the agency and allowing natural persons to report misconduct by a registered AI auditor, and require the agency to fix annual registration fees, as specified. The bill would, commencing January 1, 2029, prohibit an unregistered person from offering, selling, or conducting a covered AI audit, as defined, and would require the agency to, among other things, issue a unique registration number to each registered AI auditor and publish information provided by a registered AI auditor on the agency's internet website. The bill would require the registration number of a registered AI auditor to be clearly and conspicuously displayed on all advertising materials offering or soliciting covered AI audit services. The bill would authorize the agency to adopt regulations that are reasonably necessary to effectuate the purposes of the bill. This bill would require an AI auditor that registers with the agency to provide specified information to the agency and would impose various requirements on a registered AI auditor that conducts a covered AI audit, including, among other things, providing the auditee with a report that includes a signed and dated statement indicating that the audit was conducted according to the provisions of this bill. This bill would require a registered AI auditor to adhere to various standards of independence, objectivity, and integrity, including not seeking, soliciting, negotiating for, or accepting employment with an auditee while participating in the audit and not conducting a covered AI audit if the auditor has a financial, business, employment, or other interest or relationship that would reasonably be expected to impair the auditor's independence or objectivity. The bill would prohibit a registered AI auditor from preventing an employee from engaging in, or from retaliating against an employee who has engaged in, specified whistleblower activity. The bill would authorize the agency to investigate alleged violations of the bill, as specified, and provide that a violation constitutes grounds for removal from the registry and referral to the Attorney General or other appropriate enforcement authority. This bill would create the AI Auditors' Registration Fund within the State Treasury, to be administered by the agency, and would require that all moneys collected or received by the agency pursuant to the above-described provisions be deposited into the fund to be available, upon appropriation by the Legislature, to administer the above-described provisions. Existing law establishes the California Board of Accountancy, which is within the Department of Consumer Affairs, and requires the board to license and regulate accountants in this state. This bill would exempt a registered AI auditor licensed or authorized to practice public accountancy and a firm holding a permit to practice public accountancy issued by the California Board of Accountancy, as specified, from complying with certain requirements related to reporting information to the agency and standards of independence, objectivity, and integrity under the bill if certain requirements are met. The bill would require the Government Operations Agency to, if the agency determines that a certified public accountant, public accountant, or accounting firm in good standing has violated this bill, notify the accountant or firm and the California Board of Accountancy in writing, and would require the board to investigate the complaint and provide the agency with a report of its findings and any resulting action.

Existing law establishes the Office of Information Security within the Department of Technology for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. Existing law requires specified state entities to implement the policies and procedures issued by the office. Existing law additionally authorizes the office to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. Existing law requires every state agency, as specified, to certify, by February 1 annually, to the office that the agency is in compliance with all adopted policies, standards, and procedures and to include a plan of action and milestones, as specified. This bill would require every state agency, as specified, and subject to specified exceptions, to implement Zero Trust architecture for all data, hardware, software, internal systems, and essential third-party software, including for on-premises, cloud, and hybrid environments, to achieve prescribed levels of maturity based on the Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model, as defined, by specified dates. In implementing Zero Trust architecture, the bill would require state agencies to prioritize the use of solutions that comply with, are authorized by, or align to federal guidelines, programs, and frameworks and, at a minimum, prioritize multifactor authentication for access to all systems and data, enterprise endpoint detection and response solutions, and robust logging practices, as specified. The bill would require the office's chief to develop or revise uniform technology policies, standards, and procedures for use by all state agencies in Zero Trust architecture to achieve specified maturity levels on all systems in the State Administrative Manual and Statewide Information Management Manual. The bill would require the chief to update requirements for existing annual reporting activities to collect information relating to the progress state agencies are making to increase internal defenses of agency systems. The bill would authorize the chief to update existing annual reporting activities to include how a state agency is progressing with respect to specified goals. The bill would also state the Legislature's intent that the bill's provisions be implemented in a manner consistent with the state's timely compliance with requirements that are conditions to receipt of federal funds. The bill would also make related legislative findings and declarations.

This measure would state, among other things, the Legislature and the State of California's commitment to protecting, to the fullest extent of the law, all the data and information provided by students and their families to California's postsecondary education.