Owners searching “California AI laws” in 2026 usually find one of two unhelpful answers: a law-firm alert written for a general counsel at a 2,000-person company, or a content-mill roundup that lists every AI bill from the last session as if they all apply equally to a 15-person firm using ChatGPT. Almost none of them apply to that firm. California passed real AI legislation in 2025, but nearly all of it binds the companies that build AI models, not the businesses that subscribe to one. This article sorts the 2026 California AI landscape into exactly two buckets, developer obligations and employer obligations, with the dates and bill numbers verified against primary sources rather than repeated from a summary, so an owner can tell in five minutes which rules are actually theirs to worry about.
The sort that matters: developer laws vs. employer laws
Every California AI law from the 2025–2026 legislative session falls into one of two categories, and the category determines whether it reaches your business at all.
Developer laws regulate the companies that build and release AI models, such as OpenAI, Anthropic, and Google. They require those companies to publish disclosures, safety frameworks, or training-data documentation. A business that merely buys a subscription to one of those companies’ products has no obligations under these laws, full stop. Two statutes fall here: SB 53 and AB 2013.
Employer laws regulate what a business does with AI once it has one, specifically when a business uses an automated tool to make decisions about people: who gets hired, promoted, disciplined, or fired. These laws bind employers directly, regardless of which AI vendor the tool comes from. Two rules fall here: the Civil Rights Council’s automated-decision regulations, already in effect, and the California Privacy Protection Agency’s automated decisionmaking technology (ADMT) rules, phasing in through 2027 and beyond.
A third category exists too: bills that got real attention and did not become law. SB 7, the “No Robo Bosses Act,” is the one readers ask about most, and it belongs in neither bucket because Governor Newsom vetoed it.
The developer laws: SB 53 and AB 2013
SB 53, the Transparency in Frontier Artificial Intelligence Act, took effect January 1, 2026. It requires “large frontier developers” to publish a framework describing how they identify and mitigate catastrophic risk from their most powerful models, and to report critical safety incidents to the state. Coverage is narrow by design: a company must meet both an annual gross revenue threshold of $500 million or more and have trained a model using more than 10^26 floating-point operations before most of the law applies. The Attorney General enforces it, with civil penalties up to $1 million per violation and no private right of action. None of that reaches a business that has never trained a model; it reaches the handful of companies that build the ones everyone else uses.
AB 2013, the Generative AI Training Data Transparency Act, also took effect January 1, 2026, after being signed in September 2024. It requires developers of generative AI systems released on or after January 1, 2022 and made publicly available to Californians to publish documentation about what went into training the model: data sources, categories of data, whether copyrighted material was used, and whether personal information was included. The developer posts this on its own website before release and after any substantial update. Enforcement runs through California’s Unfair Competition Law, still against the developer, not the customer.
If your firm’s total exposure to AI is a ChatGPT Team subscription, a Claude Pro seat, or Microsoft Copilot bundled into your Microsoft 365 plan, SB 53 and AB 2013 are worth understanding as context. They tell you what OpenAI, Anthropic, or Google are required to disclose about their own models. They create no filing, notice, or recordkeeping duty for you. Treat any article that describes these as new compliance burdens on AI users as either confused or written for a different audience.
The employer law already in effect: the Civil Rights Council’s automated-decision regulations
This is the first rule in this article that can actually reach a small California employer, and it has been in force since October 1, 2025. California’s Civil Rights Council finalized regulations amending the Fair Employment and Housing Act (FEHA) framework to clarify how existing anti-discrimination law applies to an employer’s use of an automated decision system, defined broadly enough to include résumé screeners, algorithmic candidate ranking, and automated interview scoring used in hiring, promotion, discipline, or termination decisions.
The regulations apply to any California employer with five or more employees. Three provisions matter most for a small firm:
- Recordkeeping. Employers must retain records related to automated-decision data, including the criteria a tool used, for at least four years.
- Vendor liability doesn’t shift. If a third-party vendor’s tool produces a discriminatory outcome, in disparate treatment or disparate impact, the employer is still responsible. Buying the tool from someone else is not a defense.
- Medical-inquiry risk. Certain automated assessments, including some personality tests, timed puzzle-style screenings, or games used in hiring, can constitute an unlawful medical inquiry if they elicit information about a disability, even indirectly.
The practical read for a 5-to-50-person firm: if you use ChatGPT or Claude to draft a job posting or summarize a candidate’s résumé, and a human makes every hiring call, you are not the target of this regulation. If you use an automated applicant-tracking feature that scores or ranks candidates without a human reviewing the logic, or a scheduling tool that auto-generates discipline flags from attendance data, you are squarely inside it, and the burden of proof about how the tool works sits with you, not the vendor.
The employer rule still coming: the CPPA’s ADMT regulations
The California Privacy Protection Agency finalized a separate, related set of rules covering “automated decisionmaking technology” (ADMT) under the CCPA. The Office of Administrative Law approved the regulations on September 23, 2025, and they took effect January 1, 2026, but the ADMT-specific obligations that actually bind businesses phase in later: pre-use notice, opt-out rights, and access rights for ADMT used in “significant decisions” (employment, financial, housing, healthcare, or education outcomes among them) carry a compliance deadline of January 1, 2027. Risk-assessment documentation phases in further out, with the first attestations due to the CPPA by April 1, 2028, and cybersecurity-audit requirements phasing in by revenue tier between 2028 and 2030.
The detail that trips up most owners: these ADMT obligations apply only to businesses that already meet the CCPA’s own coverage thresholds (see below). Most small businesses this article is written for fall under all three thresholds and are not CCPA-covered at all, which means the 2027 ADMT rules don’t reach them regardless of what AI tools they use internally. Confirm the current thresholds directly against the statute at leginfo.legislature.ca.gov before assuming either way, since thresholds are reviewed periodically.
The one that died: SB 7, the “No Robo Bosses Act”
SB 7 is the single most-searched California AI bill among small-business owners, and the honest answer is that it is not law. The bill, introduced by state Senator Jerry McNerney, would have required employers to notify workers before deploying an automated decision system that could affect their employment, and would have barred employers from relying solely on such a system for discipline, termination, or deactivation decisions. It passed the Legislature and reached Governor Newsom’s desk, and he vetoed it on October 13, 2025.
Newsom’s veto message did not dispute the underlying concern about AI in employment decisions. It objected to the bill’s breadth: SB 7’s notice requirement, as written, would have applied to “the most innocuous tools,” including ordinary scheduling and workflow-management software, not just high-risk hiring or discipline algorithms. He also noted that some of the same ground was already partially addressed by the CPPA’s forthcoming ADMT regulations described above.
There is no current California statute requiring an employer to notify staff before using AI tools generally. A narrower version of SB 7 is a reasonable bet for a future legislative session, and this section will be updated if one is introduced, but as of this writing, nothing requires the notice SB 7 would have mandated.
Does the CCPA even apply to your business?
Because the CPPA’s ADMT rules only reach CCPA-covered businesses, this is the threshold question worth answering before worrying about any of them (full test in the FAQ below). Employee count alone doesn’t decide it: a five-person firm running a high-volume online storefront can be covered, while a fifty-person professional-services firm with a small, static client list may not be. Check the current statutory language directly, since thresholds are reviewed and can shift.
What this means if you just use ChatGPT, Claude, or Copilot to draft documents
For most firms this article is written for, drafting emails, summarizing documents, analyzing spreadsheets, generating first-pass proposals, the honest 2026 answer is that no California AI-specific statute currently regulates that use. SB 53 and AB 2013 regulate the model builders. The Civil Rights Council’s rules and the CPPA’s ADMT rules both target automated decisions about people, not general-purpose drafting where a human reviews the output before it goes anywhere. That doesn’t mean “anything goes”: ordinary confidentiality and data-handling obligations that predate AI still apply, and belong in an internal AI-use policy regardless of what state law requires.
What this means if you use AI in hiring, discipline, or performance decisions
This is the narrower group that should be building a compliance checklist now, not waiting for 2027. If your applicant-tracking system scores résumés, a scheduling or HR platform auto-flags attendance issues that feed into discipline, or any tool ranks or scores people algorithmically, the Civil Rights Council’s regulations already apply if you have five or more California employees, and you need a four-year recordkeeping practice in place. The CPPA’s ADMT rules add a second, later layer if your business also meets the CCPA’s thresholds. In both cases, a human reviewing and able to override the tool’s output is the practical difference between an assistive tool and a regulated automated decision system.
A one-page reference table
| Law or rule | Who it binds | Status |
|---|---|---|
| SB 53 (Transparency in Frontier Artificial Intelligence Act) | AI developers with $500M+ revenue and models above 10^26 FLOPS | Effective January 1, 2026 |
| AB 2013 (Generative AI Training Data Transparency Act) | Developers of generative AI systems made available to Californians | Effective January 1, 2026 |
| Civil Rights Council automated-decision regulations (FEHA) | California employers with 5+ employees using automated tools in hiring, promotion, or discipline | Effective October 1, 2025 |
| CPPA ADMT regulations | CCPA-covered businesses using ADMT for “significant decisions” | ADMT compliance deadline January 1, 2027; risk-assessment and audit deadlines phase in through 2028–2030 |
| SB 7 “No Robo Bosses Act” | Would have applied to employers using any automated decision system | Vetoed October 13, 2025 — not law |
Frequently asked questions
Does SB 53 apply to a small business that uses ChatGPT?
No. SB 53 applies only to “large frontier developers,” companies with at least $500 million in annual revenue whose AI models were trained using more than 10^26 floating-point operations. A business that subscribes to a product built by one of those companies has no obligations under SB 53.
Does AB 2013 apply to a small business that uses AI tools?
No. AB 2013 requires developers of generative AI systems to publish documentation about their training data on the developer’s own website. It creates no obligation for a business that uses those systems as a customer.
Is the “No Robo Bosses Act” (SB 7) law in California?
No. Governor Newsom vetoed SB 7 on October 13, 2025, citing concerns that its notification requirements were too broad and would have reached ordinary scheduling and workflow software, not just high-risk hiring or discipline tools. There is no current California statute requiring general notice before using AI at work.
What changed for California employers on October 1, 2025?
The Civil Rights Council’s automated-decision regulations took effect that day, clarifying that existing FEHA anti-discrimination protections apply to AI and automated tools used in hiring, promotion, discipline, or termination decisions at businesses with five or more California employees, with a four-year recordkeeping requirement.
When do the CPPA’s automated decisionmaking rules start?
The regulations themselves took effect January 1, 2026, but the specific ADMT compliance obligations, including pre-use notice and opt-out rights for AI used in significant decisions, carry a deadline of January 1, 2027, and only apply to businesses that already meet the CCPA’s coverage thresholds.
Does the CCPA apply to my small business?
Only if you meet one of three tests: more than $25 million in average annual gross revenue, buying, selling, or sharing personal information of 100,000 or more consumers or households annually, or deriving 50% or more of revenue from selling or sharing personal information. Employee count alone does not determine coverage.
If none of these laws apply to me, is there any risk in using AI tools at work?
State AI-specific statutes are only part of the picture. Ordinary confidentiality obligations, client-data agreements, and professional-responsibility rules that predate AI still apply to what an employee pastes into a chatbot. Most real incidents come from a well-meaning employee sharing sensitive data with a consumer-tier AI account, not from a gap in state AI law.
Will more California AI employment laws pass in 2026?
Likely, at least in a narrower form. SB 7’s veto message specifically invited a more targeted bill focused on genuinely high-risk automated decision tools rather than all workplace software with any automated feature. Treat this article’s “vetoed, not law” status for SB 7 as current as of this writing and worth rechecking if you’re reading it well after publication.
Key takeaways
- SB 53 and AB 2013, both effective January 1, 2026, regulate AI model developers like OpenAI, Anthropic, and Google. They create no compliance obligation for a small business that simply uses ChatGPT, Claude, or Copilot.
- The Civil Rights Council’s automated-decision regulations, effective October 1, 2025, are the first California AI rule that reaches small employers directly: any business with five or more California employees using automated tools in hiring, promotion, or discipline decisions is covered now.
- The CPPA’s ADMT rules add a second layer starting with a January 1, 2027 compliance deadline, but only for businesses that already meet the CCPA’s revenue or data-volume thresholds.
- SB 7, the “No Robo Bosses Act,” was vetoed on October 13, 2025. It is not law, despite how often it’s searched as if it were.
- The dividing line that matters most: are you using AI to draft and analyze your own documents, or to make automated decisions about people? The first is largely unregulated by California AI-specific law today; the second is where the real obligations sit.
Building an AI use policy or getting your team trained often surfaces exactly these questions, where automated-decision risk actually starts for your specific workflows. That’s true whether the team sits in San Francisco or anywhere else in the state. Businesses that want that mapped out for their own team can book a free AI-readiness call or see how a structured program works on the Team Training page, and read the full California AI training playbook for the funding side of the picture.
Dirk Jan van Veen, PhD
