California AI laws. Five at once.

01 / Who's covered

Pick the law that matches what you actually do.

California's stack is vertical, not horizontal. Each law targets a specific AI activity. Which apply to you depends entirely on what you do.

• You train large foundation models. SB 53 applies if you exceed the compute or spend thresholds.
• You provide a generative AI service. AB 2013 applies; SB 942 applies if your service has more than 1 million California users monthly.
• You publish or post AI-generated content at scale. SB 942 applies.
• You're a healthcare provider, payor, or vendor using AI in clinical workflows. AB 489 applies.
• You operate an AI chatbot used for companionship, including products marketed as friends, partners, or therapists. SB 243 applies.

If none of those describe you, California's AI stack is mostly background context. Your bigger California exposure is probably CCPA + the Colorado AI Act + the EU AI Act, depending on where your customers and employees are.

02 / SB 53: California Transparency in Frontier AI Act

Risk frameworks, incident reporting, whistleblower protection.

SB 53 is California's frontier AI law. It targets developers training the largest foundation models, defined by compute and spend thresholds. Most companies are not in scope.

If you are in scope, SB 53 requires you to:

• Publish a risk management framework that explains how you assess and mitigate catastrophic risks before deploying frontier models.
• Report critical safety incidents to a designated state body, on a defined timeline.
• Implement whistleblower protections for employees and contractors who flag safety concerns.
• Provide pre-deployment safety testing documentation on request.

SB 53's enforcement leans on disclosure and documentation rather than approval. The California AG can pursue civil penalties for material misstatements or omissions in the published risk framework.

03 / AB 2013: Training-data transparency

Publish what your model learned from.

AB 2013 requires generative AI service providers to publish, on their public website, a summary of the data used to train their generative AI systems. The summary must describe data sources at a category level (for example, "publicly available web data," "licensed text from publishers," "user-generated content under [identified] terms"), the rough timeframes of collection, whether copyrighted material was included, and the data-cleaning practices applied.

The disclosure does not require revealing exact datasets or proprietary methods. It does require a summary detailed enough that a reader can understand at a category level what the model was trained on.

Most SMBs are downstream consumers of generative AI, not providers. AB 2013 affects you indirectly when your vendor publishes its summary; that's relevant input for your own risk assessments.

04 / SB 942: California AI Transparency Act

Watermarks, labels, detection tooling.

SB 942 requires generative AI providers serving more than 1 million California users monthly to:

• Embed disclosures in AI-generated content. Visible labels and invisible cryptographic watermarks both count.
• Provide free, publicly accessible detection tooling that lets anyone check whether content was generated by the provider's system.
• Require licensees of their systems to maintain the embedded disclosures.

Smaller services have a notification obligation, asking users to disclose when they share AI-generated content. The watermark machinery falls primarily on the largest providers.

If you republish AI-generated content (advertising agencies, content marketplaces, news organizations using AI assistance), the obligations cascade. Your contracts with AI vendors should require them to deliver content with the SB 942 disclosures intact.

05 / AB 489: Healthcare AI disclosures

Clinical AI must say what it is.

AB 489 covers AI used in healthcare. The core obligations:

• AI cannot communicate with a patient in a way that suggests a licensed healthcare professional generated the communication when one did not.
• Clinicians and providers using AI to influence diagnosis, treatment, or coverage decisions must disclose AI involvement to patients.
• AI vendors selling into healthcare must provide adequate documentation for the disclosures.

Healthcare is the domain with the highest overlap to other AI laws (HIPAA at the federal level, the Colorado AI Act for "consequential decisions" in healthcare, and the EU AI Act for healthcare AI in EU markets). Healthcare deployers running US-state-level audits often need an evidence pack that satisfies all four at once.

06 / SB 243: Companion chatbot safety

Safety duties for chatbots that act like friends.

SB 243 covers AI companion chatbots: products marketed or used as friends, partners, therapists, or persistent emotional companions. Operators of these products must:

• Operate self-harm and suicide protocols, including referral to crisis resources.
• Periodically remind users that the chatbot is not a human.
• Implement age-appropriate content controls when minors are users.
• Maintain incident reporting on safety events.
• Publish a public safety report on a defined cadence.

SB 243 sits next to several other US state laws (notably the New York RAISE Act amendments) that focus on AI-companion safety. If your product has any companion-style affordance and any California users, take this one seriously even if "companion chatbot" was not your design intent.