Throughout the year, we saw a host of executive orders, proposals and eventually chaptered bills that will affect the flow of state IT operations and the vendors that support that work.
In the flurry of end-of-session bills signed by Gov. Gavin Newsom, we saw several that expand the regulatory landscape with regard to AI and data privacy worth mentioning.
Here are just a couple of the more prominent ones we've been watching:
SB 813 and AB 1405 — New GovOps AI Oversight Functions
Several weeks before the Sept. 30 legislative deadline, Gov. Gavin Newsom signed a pair of bills that would, among other things, position the Government Operations Agency (GovOps) as the oversight body for the organizations that audit and assess AI models, known as independent verification organizations (IVO). Senate Bill 813 outlines the new IVO oversight duties, stating that GovOps would be required to create working groups, solicit input from stakeholders, develop IVO application requirements and recommend to the Legislature no later than May 1, 2027 (an expedited deadline created through executive order).
Assembly Bill 1405, meanwhile, would require GovOps to create an “AI Auditor Registry” on the agency’s website, while also setting annual registration fees and operating standards. This registry faces a Dec. 1, 2027, deadline (also expedited via executive order).
It’s worth noting that SB 813 underscores that audits are not a condition of creating or deploying AI tools in the state.
SB 947 — Public Agency Use of AI to Manage Employees
Signed Sept. 30, SB 947 outlines new rules about how employers, including state and local government entities, use automated decision systems to terminate or discipline their employees.
Beginning July 1, 2027, public employers would no longer be allowed to rely solely on these systems for employment decisions, and would be required to keep a human in the loop and provide post-use notice of the technology’s use, as well as the employee data being used in the decision process.
AB 2392 — AI and Public Higher Ed
AB 2392 was also signed by Newsom Sept. 30 and requires the California Community Colleges Chancellor’s Office and California State University to create a working group and provide recommendations for new generative AI procurement standards by Jan. 1, 2028.
Additionally, the public higher education institutions would also be required to meet and regularly review new training requirements for their stakeholders and provide a written report of their methodologies and processes to the Legislature.
SB 923 — Expansion of Data Deletion Rules
SB 923, signed Sept. 27, expands on the data protections outlined under the California Consumer Privacy Act of 2018 by including the ability to request that data collected by businesses through third-party vendors be deleted.
The bill also sets the requirement that online-only businesses provide a method to make data deletion requests, namely a portal or webform.
Legislative Close Sees Flood of Bills Impacting IT, AI and Data
Gov. Gavin Newsom signed a flurry of legislation last month as the end of the session neared. Here's a rundown of a few of the higher-profile IT bills we've been watching.
