0
Automated decision-making technologies (ADMT) in employment decisions

Using AI’s Tools in Hiring, Firing, and Compensation Decisions

AI & Algorithms

What Employers Need to Know About Using ADMT in Employment Decisions

Decisions about hiring, termination, and compensation represent substantial administrative costs for employers. Automated decision-making technologies (“ADMT”) can significantly streamline the process. However, employers using ADMT should be aware of recent and existing regulations governing the use of AI tools in evaluating prospective and current employees.

In addition to recent AI-specific regulation, use of AI tools in making employment decisions may be regulated by existing anti-discrimination statutes. Use of an algorithm that discriminates against a protected class identified in federal statutes – most notably Title VII of the Civil Rights Act and the Americans with Disabilities Act (ADA) – may expose employers to liability. What is ADMT? ADMT, or automated decision-making technology, is any technology that processes personal information and uses computation to replace or substantially replace human decision-making. AI tools used in employment may be one type of ADMT available to employers. In the context of ADMT, significant employment decisions may include:
  • Hiring
  • Allocating work or compensation
  • Promotion and demotion
  • Suspension and termination
State and local compliance requirements may create exceptions for businesses that do not use the AI tool’s recommendations as a substitute for human discretion. However, this may be a high bar to overcome, and not all types of human involvement qualify for an exception. For further explanation, please refer to the “Best Practices for Employers” section below. What are the risks of employment discrimination? AI and other ADMT tools involved in significant employment decisions may pose two key risks regarding employment discrimination. There is a risk they may: 1) Exclude or disadvantage applicants from a protected group identified in Title VII or applicants with disabilities. Groups are protected by the statute on the basis of race, color, sex, religion, or national origin. This may apply even if there is no intent to discriminate: If the technology is shown to have a disproportionate effect on a protected group, the employer may be vulnerable to a lawsuit. For example, if ADMT tends to exclude candidates with names that suggest a particular racial or national identity, this could pose risk to the employer using this ADMT. 2) Screen out candidates based on aspects of their application that characterize a disability recognized by the ADA. This screening process may apply to a seemingly neutral selection criterion. For example, an AI tool that screens employees out for a resume gap lasting longer than four months could raise a risk of liability if the individual has a disability requiring substantial recovery periods after medical intervention. What types of ADMT pose particular risks of discrimination? Certain types of ADMT may pose particular risks of violating state and federal regulations. This may include AI-hiring tools with algorithms that:
  • Fail to take into account reasonable accommodations or available workplace alternatives in their assessment of a candidate’s ability to uphold the employer’s performance standards
  • Fail to include measures to mitigate against sensitivity to names of candidates – which contain information as to the gender and/or ethnic or racial origins of the applicant
  • Are overly reliant on inferences between the applicant and existing successful employees, which may reinforce existing hiring biases
  • Fail to account for possible reasonable accommodations related to their disability that are available to the applicant
  • Rely on an empirical evaluation of an individual’s conformity with a subjective standard such as “culture fit”.Additionally, video-interviewing software that includes emotion-recognition technology without human involvement in their hiring decision, and hiring tools that require the applicant to provide medical information prior to employment may also create additional risk.
Best Practices for Employers When selecting an AI tool for use in your employment decisions, there are measures employers can take to potentially reduce the risk of discrimination. 1. Transparency. Measures may include requesting transparency from the developer about mitigating measures to insulate decisions against particular risk factors.For example, seek tools that do not weigh factors posing particular risks of discrimination in the scoring process so heavily that they disqualify candidates. Transparency is also useful in preparing risk assessments which may be required by state and local regulations when using AMDT. 2. Human Involvement. Employers may also consider assessing the degree of human involvement in the decision-making process to see if the applied use qualifies for an exception from the regulation. If seeking an exception, a certain degree of human involvement may be required. Examples of insufficient degrees of human involvement may include situations where the decision-maker:
  • Is tasked with merely reviewing AI output
  • Lacks authority to change the decision
  • Lacks access necessary to make an independent decision
  • Operates under time constraints insufficient for substantive review
  • Only intervenes for obvious mistakes
In general, businesses should not recommend that the human decision-maker follow the AI’s decision by default in policy or in practice and should encourage independent human review. 3. Preparation. When using AI to assist in employment decisions, businesses may want to consider:
  • Conducting and submitting a risk assessment evaluating the risks of potential discrimination or data privacy balanced against the benefit to the business
  • Disclosing use of an AI tool in the applicant selection process before an applicant submits their application
  • Consulting state and local regulations to confirm compliance with required procedures and components. For example, CA, NY, IL, and CO are among the states that mandate some type of pre-disclosure when using ADMT or similar tools. Depending on the jurisdiction, it may be helpful for employers to consult relevant statutes to determine specific compliance requirements and timelines for disclosure.
  • Maintaining alternative processes to ADMT for selecting qualified candidates and allow potential applicants to opt-out of its use in evaluating their application. For candidates with disabilities, this may also include providing candidates with reasonable accommodations, including specialized equipment or extended timing or other modifications for timed skill assessments.
  • Establishing an appeal process for employment decisions made using AI tools.
  • Anticipating possible requests for deletion of personal data in response to evolving privacy rights across various jurisdictions. For example, in California, applicants may have existing privacy protections that include the rights to:
    • Be notified regarding a business’s use of AI in making employment decisions
    • Know what data is being collected, its purpose, and with whom it will be shared
    • Request deletion of personal information
    • Correct inaccurate personal information
    • Stop or limit the sale of sensitive personal information
    • And non-discrimination for exercising the rights provided.
What’s Next? The recent Executive Order suggests that national policy may soon tend away from allowing applicants and/or employees to bring claims based on an AI tool’s disproportionate effect on a protected group. (Executive Order, Ensuring a National Policy Framework for Artificial Intelligence, Sections 6 & 9, issued December 11, 2025). However, as state and local-level protections take effect and as federal minimum standards continue to be fleshed out, some caution is required as these standards are interpreted by relevant state and federal agencies.
0
California Sets Rules for AI Nationwide

California Sets National AI Policy

California
 

In The Vacuum Of Federal Legislation, California Sets National AI Policy by Lily Li | Founder of Metaverse Law | Cybersecurity & AI Lawyer

Within a day of taking office, President Trump overturned Biden’s Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence.[1] The agencies quickly followed suit. The EEOC and DOL withdrew their guidance on AI and workplace discrimination, and the HHS stalled on its proposed updates to the HIPAA security rule in the face of a Texas court order. This past summer, the House added a ten-year moratorium on state AI laws in the “One Big Beautiful Bill Act,” only to have this provision repealed 99-to-1 in the Senate.[2] Overall, the message from the White House is clear: deregulate AI. These federal efforts may have created a backlash, however, by spurring an aggressive state response. Regardless of your politics and whether you think this is a good thing or a bad thing, California has stepped into the vacuum to set national AI policy. The state’s 2025 legislative session was a banner year, setting records for the number and scope of new AI laws. From AI Safety to AI Transparency & Risk Assessments On September 29, 2025, Governor Gavin Newsom signed Senate Bill 53 into law, the Transparency in Frontier Artificial Intelligence Act. Starting in January 2026, California will require large frontier AI developers to publish a framework detailing how they incorporate safety, security, and testing standards into their AI models. SB 53 also creates a mechanism for AI developers and the public to report critical safety incidents, and protects internal whistleblowers who report risks posed by frontier AI models. The law establishes significant penalties for companies who fail to comply, with fines of up to $1 million per violation. Governor Newsom signed this law in order to spur federal action. In his signing note, he stated that if the federal government adopted similar or more demanding national AI standards, further action would be taken to align the policy to the national standard. Per Governor Newsom, “In enacting this law, we are once again demonstrating our leadership, by protecting our residents today while pressing the federal government to act on national standards.”[3] Governor Newsom’s action on SB 53 contrasts with his position on AI legislation a year ago. On September 29, 2024, exactly a year before signing SB 53, he vetoed SB 1047 (the Safe and Secure Innovation for Frontier Artificial Intelligence Models Act) – the precursor bill to SB 53. The veto message pointed to the importance of the AI industry to California, and noted that the proposed legislation may overlook smaller, more dangerous models, among other concerns. Just as importantly, the veto message pointed to growing federal standards under the NIST’s U.S. AI Safety Institute, and Governor Newsom’s hope to coordinate with federal partners and experts.[4] With the U.S. AI Safety Institute scrapped and federal AI efforts under fire, Governor Newsom’s about-face on SB 53 seems less about the surface-level changes between SB 53 and SB 1047, and more about the growing political divide on AI legislation. The California approach to AI transparency and safety legislation also needs to be read in conjunction with the California Privacy Protection Agency’s (CPPA’s) recently approved regulations. In addition to more traditional privacy concerns, the CPPA’s most recent 127-page rulemaking package contains requirements governing cybersecurity audits, risk assessments, and automated decision-making technology (ADMT).[5] AI developers and systems that process personal information and meet certain California privacy thresholds will now face substantial cybersecurity audit and risk assessment requirements. In addition, if they engage in automated and significant decisions concerning the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services, they will also have significant notice, opt out and risk assessment requirements. These ADMT regulations also have a history. They are five years in the making and stem from Prop 24, a 2020 ballot initiative to amend California’s privacy laws. During the CPPA’s consideration of these draft ADMT regulations, Governor Newsom sent a letter to the Agency, asking them to pare down the scope of the regulations. Per Governor Newsom, “enacting these regulations could create significant unintended consequences and impose substantial costs that threaten California’s enduring dominance in technological innovation.”[6] The final version was a compromise, paring away references to generative AI and artificial intelligence generally, but maintaining the bulk of the remaining requirements. Thus, we see the unique political circumstances of California play out in AI regulation. A double whammy through SB 53 by the state legislature, and through ADMT regulations by the CPPA (founded through the direct democracy of California’s ballot initiative process). Civil Rights, Employment Bias, and Discrimination In 2023, the EEOC issued guidance that cautioned employers to use AI workplace tools responsibly, addressed the use of AI software and algorithms in the employment selection processes under Title VII and employers’ compliance responsibilities related to the ADA. In 2024, the DOL further issued a document entitled “Artificial Intelligence and Worker Well-Being – Principles and Best Practices for Developers and Employers.”[7] This document recommended that employers include workers in the AI adoption process, bargain with unions in good faith regarding the adoption of AI technologies, establish AI governance and human oversight, not rely on AI systems in making “significant employment decisions” without “meaningful human oversight,” and monitor AI to safeguard worker rights, including leaves of absence, accommodations, wages, and break times. While President Trump’s recission of Biden’s executive order on AI did not expressly rescind these guidance documents, the EEOC and DOL removed these publications from their websites.[8] In contrast, California’s Civil Rights Council promulgated regulations that implemented California’s civil rights laws, explicitly stating that California’s antidiscrimination laws apply to AI workplace tools. On October 1, 2025, these new regulations went into effect.[9] Per the new regulations, it is unlawful for an employer to use automated-decision systems or selection criteria that discriminates based on a basis protected by existing California law. Relevant to any such claim or available defense is evidence, or lack thereof, of anti-bias testing or similar proactive efforts to avoid unlawful discrimination, including the quality, efficacy, recency and scope of such an effort, the results of the testing, and the response to the results. Healthcare AI and Chatbots California is also taking the stage in healthcare and AI regulation. In January of 2025, California Attorney General Rob Bonta issued a “Legal Advisory on the Application of Existing California Law to Artificial Intelligence in Healthcare.”[10] This advisory set forth California’s existing consumer protection, civil rights, competition, and data privacy laws governing healthcare and highlighted the passage of several healthcare AI bills in 2024. In 2025, California continued to advance healthcare AI legislation with the passage of AB 489, prohibiting AI systems from falsely indicating or implying possession of a medical license or certificate through marketing or other functionality.[11] AI Safeguards for Children: Converging Standards While California and the federal government may be at odds on broad AI legislation, there is convergence in one area: protection of minors. Lawmakers on both sides of the aisle agree that children should be protected from harmful AI content, whether it is suicidal ideation, self-harm, or sexually explicit imagery. Partly, this is spurred by the tragic suicides of a teenager in Orange County, California and another in Florida, both of whom formed close relationships with generative AI systems before their deaths.[12] Partly, this is driven by the furor over a leaked internal Meta document, disclosing content standards that allowed AI systems to “engage a child in conversations that are romantic or sensual.”[13] In California, for instance, Governor Newsom signed SB 243, landmark AI chatbot legislation that require “companion chatbots” to address suicidal ideation, sexually explicit imagery, and extended use by minors.[14] This law applies to chatbots that provide human-like interactions and capable of sustaining relationships across multiple interactions, and requires AI disclosures, referrals to suicide hotlines or crisis text lines, and break reminders. SB 243 further requires companion chatbots to institute reasonable measures to prevent the chatbot from producing visual material of sexually explicit conduct or directly stating that the minor should engage in sexually explicit conduct. The legislation includes a private right of action to individuals who suffer “an injury in fact” with statutory damages of one thousand dollars ($1,000) per violation, or actual damages if greater. California also passed companion bills AB 1043 and 56, which further require age verification and warning labels for covered online platforms. At the federal level, the FTC launched inquiries into seven major consumer-facing chatbot companies, asking for information on how these firms measure, test, and monitor potentially negative impacts of this technology on children and teens.[15] This followed investigations by the Texas AG into Meta and Character.AI for alleged unfair and deceptive practices towards children.[16] The Attorney Generals of fourty-four different states signed onto a letter following the alarming reports of Meta AI chatbots engaging in sexually inappropriate conversations with children.[17] Given the common interests in protecting children online, we anticipate further efforts at both the state and federal level in 2026 to impose online age verification, parental consents and additional guardrails on children’s interactions with AI systems. Why Follow California? While California might be motivated to set AI national policy, why do businesses and lawmakers in other states follow California’s lead? Partially, this is due to practicality. The largest AI companies train and deploy systems at scale. It does not make sense creating a different user interface and back-end system for each state, rather than embedding the highest privacy, security, and safety controls into the system as a whole. Partially, this is due to risk appetite. Unlike other state and federal AI laws, California’s legislature is far more willing to adopt private rights of action and statutory damages in its legislation – incentivizing lawsuits. This in turn develops a whole body of law that provides guidance and interpretation for statutory language that might be similar across state lines. Finally, let’s not forget that California is home to some of the largest AI companies in the world. Even a world of AI, remote work, and borderless systems, sometimes there still is a hometown advantage. ENDNOTES [1] White House, Initial Rescissions of Harmful Executive Orders and Actions (Jan. 20, 2025), https://www.whitehouse.gov/presidential-actions/2025/01/initial-rescissions-of-harmful-executive-orders-and-actions/ [2] Senate Strikes AI Moratorium from Budget Reconciliation Bill in Overwhelming 99-1 Vote, (July 1, 2025) https://www.commerce.senate.gov/2025/7/senate-strikes-ai-moratorium-from-budget-reconciliation-bill-in-overwhelming-99-1-vote/8415a728-fd1d-4269-98ac-101d1d0c71e0 [3] Office of the Governor, SB 53 Signing Message, (September 29, 2025) https://www.gov.ca.gov/wp-content/uploads/2025/09/SB-53-Signing-Message.pdf [4] Office of the Governor, SB 1047 Veto Message, (September 29, 2024) https://www.gov.ca.gov/wp-content/uploads/2024/09/SB-1047-Veto-Message.pdf [5] CA Privacy Protection Agency, TEXT OF REGULATIONS (CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations), https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf [6] Tyler Katzenberger, Big Tech has another California problem (04/25/2025 10:00 AM EDT), Politico, https://www.politico.com/news/2025/04/25/big-tech-california-data-privacy-regulation-fight-newsom-00309171 [7] Department of Labor releases AI Best Practices roadmap for developers, employers, building on AI principles for worker well-being (October 16, 2024), https://www.dol.gov/newsroom/releases/osec/osec20241016 [8] Gone but Not Forgotten: Federal Laws Still Apply Despite AI Guidance Disappearance Act, Cooley Alert (February 21, 2025), https://www.cooley.com/news/insight/2025/2025-02-21-gone-but-not-forgotten-federal-laws-still-apply-despite-guidance-disappearance-act [9] Civil Rights Council Secures Approval for Regulations to Protect Against Employment Discrimination Related to Artificial Intelligence (June 30, 2025), https://calcivilrights.ca.gov/2025/06/30/civil-rights-council-secures-approval-for-regulations-to-protect-against-employment-discrimination-related-to-artificial-intelligence/ [10] https://oag.ca.gov/system/files/attachments/press-docs/Final%20Legal%20Advisory%20-%20Application%20of%20Existing%20CA%20Laws%20to%20Artificial%20Intelligence%20in%20Healthcare.pdf [11] https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB489 [12] Associated Press, Parents of teens who died by suicide after AI chatbot interactions to testify to Congress, Orange County Register (September 16, 2025, 12:54 PM PDT), https://www.ocregister.com/2025/09/16/chatbots-teens-safety-congress/ [13] Jeff Horwitz, Meta’s AI rules have let bots hold ‘sensual’ chats with kids, offer false medical info, (Aug. 14, 2025, 6 a.m. GMT), Reuters, https://www.reuters.com/investigates/special-report/meta-ai-chatbot-guidelines/ [14] Governor Newsom signs bills to further strengthen California’s leadership in protecting children online (Oct. 13, 2025), https://www.gov.ca.gov/2025/10/13/governor-newsom-signs-bills-to-further-strengthen-californias-leadership-in-protecting-children-online/ [15] FTC Launches Inquiry into AI Chatbots Acting as Companions (September 11, 2025) https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-launches-inquiry-ai-chatbots-acting-companions [16] Attorney General Ken Paxton Investigates Meta and Char​ac​ter​.AI for Misleading Children with Deceptive AI-Generated Mental Health Services (August 18, 2025) https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-investigates-meta-and-characterai-misleading-children-deceptive-ai [17] National Association of Attorneys Generals (August 25, 2025) https://oklahoma.gov/content/dam/ok/en/oag/news-documents/2025/august/AI%20Chatbot_FINAL.pdf Lily Li is an AI, data privacy, and cybersecurity lawyer and founder of Metaverse Law. She is a certified information privacy professional for the United States and Europe and is a GIAC Certified Forensic Analyst for advanced incident response and computer forensics. She can be reached at info@metaverselaw.com.
0

CalPrivacy’s Data Broker Enforcement Strike Force: updates and enforcement actions

Adtech, California, Data / Web Scraping, Data Brokers
On November 26, 2025, CalPrivacy (previously the CPPA) issued a decision requiring ROR Partners LLC to pay $56,600 for failure to register as a data broker under California’s Delete Act. According to the decision, the company used “billions of data points” from over 262 million Americans to create consumer profiles and audience lists, which ROR’s clients could then use for targeted advertising. This action was brought as part of CalPrivacy’s Data Broker Enforcement Strike Force, designed to investigate privacy violations by the data broker industry. As part of this effort, CalPrivacy recently issued an Enforcement Advisory highlighting data broker registration requirements related to trade names, websites and parent/subsidiary entities of data brokers. What is a data broker? By law, a data broker is defined as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship,” with limited exceptions for certain entities covered under other sector-specific laws. In short, they are companies that collect and sell a consumer’s personal information without directly interacting with that consumer. Data brokers commonly collect information such as email, phone number, browsing history, or location data from places like public records, commercial data, and other sources. Data brokers often then analyze, bundle and sell these profiles about consumers to other businesses. According to CalPrivacy’s DROP website, “[t]his information can be used to influence you – to buy certain products, to feel certain emotions, or even take certain actions. It can put you at greater risk of identity theft, fraud, or AI impersonations. It can also increase the chances your data is leaked or hacked.” What is the Data Broker Enforcement Strike Force? On November 19, one week prior to the ROR decision, CalPrivacy announced its creation of the Data Broker Enforcement Strike Force within its Enforcement Division. According to the announcement, “[t]he Enforcement Division will be reviewing the [data broker] industry for compliance with the data broker registration requirement in the Delete Act, as well as for compliance with the state’s comprehensive privacy law, the California Consumer Privacy Act (CCPA).” This is not the first time the California regulator has targeted data brokers. In 2024, the Enforcement Division conducted a public investigative sweep of data broker registration with a similar goal of verifying compliance with the Delete Act and the CCPA. What is the Delete Act? The Delete Act is a law that applies to data brokers and requires them to register with CalPrivacy and pay an annual fee. Additionally, data brokers must also disclose:
  • The number of consumer deletion requests they have received, as well as their average response time;
  • Whether the data broker collects certain types of sensitive information or the personal information of minors; and,
  • A link on their website informing customers of their rights under the CCPA.
Entities covered under the Act must register by January 31 if they operated as a data broker in the previous year, and they face a $200 penalty per day for failure to register. As of 2024, the data broker registry is maintained by CalPrivacy. The annual fee funds the registry, along with the new mechanism for allowing deletion of personal information from data brokers, called “DROP.” What is DROP? The first-of-its-kind deletion mechanism, the Data Broker Requests and Opt-Out Platform (DROP) will allow consumers to file a single request, which directs all registered data brokers to delete the consumers’ personal information immediately, and continuously every 45 days. According to the DROP website, the data that is subject to DROP may include:
  • Basic identifiers, including name, phone number, or email.
  • Behavioral data, including social media or browsing history, likes and dislikes.
  • Financial-related data, including payment history or spending habits.
  • Health-related data, including your usage of health-related apps, wearables, trackers or websites.
  • Location data, including where you go and how often you visit certain places.
  • Relationships, including your family and friends and how often you interact with them.
  • Inferences, including those about your lifestyle, hobbies, incomes, or even religious or philosophical beliefs, which can include history of the videos you watch, articles you read, or topics you search for.
However, the law has certain exemptions for information that is not required to be deleted. This includes information that the government makes public (property records, court filings, etc.) or information controlled by other state or federal laws, such as certain financial or health information. The intent behind the mechanism is to give consumers more control over their personal information and helps protect their privacy. DROP is expected to be available to consumers on January 1, 2026. What’s next? With the release of DROP and the establishment of the Data Broker Enforcement Strike Force, California is positioned to take data broker enforcement seriously. The decision against ROR Partners LLC was finalized one week after the Strike Force was announced, and all signs say this is the first of many enforcement efforts under this regulatory push. If your company or organization may be acting as a data broker, it is important that you understand your obligations under laws like the California Delete Act, but also other state laws. These laws may have requirements like registering as a data broker, publishing a clear privacy notice, providing specific opt-outs, and reporting certain disclosures.
0
Flag of California, depicting a large brown bear beside a red star, above the words "California Republic."

California: New AI laws in California – roundup of the 2025 legislative session

AI & Algorithms, California, Children, Employment Law, Healthcare, Social Media , , , , , , , ,
This article was originally published by OneTrust DataGuidance on November 24, 2025 and can be found on the DataGuidance website here.

California introduces comprehensive AI laws focusing on transparency, children’s safety, healthcare, antitrust, and law enforcement.

California has taken an aggressive stance towards artificial intelligence (AI) legislation and will likely set the standard for other US states. Back in 2024, Governor Newsom vetoed comprehensive AI safety legislation under bill SB 1047 and advised caution on regulations for this nascent and important technology. This year, Governor Newsom pressed ahead with a full slate of new AI laws. The reasons for this change in approach are many, including but not limited to the lack of federal AI legislation, the growing concern over children’s interactions with AI, especially sexualized content, and harmonization with more stringent requirements in the EU and elsewhere.

This year’s legislative session set records for the number and scope of new AI laws. For the roundup this year, Lily Li, of Metaverse Law Corporation, breaks down the new AI laws by scope and sector, noting where this may add on to existing California legislation and rulemaking from 2024-2025.

General AI safety, transparency, and risk assessments

  • SB 53: Transparency in Frontier Artificial Intelligence Act (Wiener) – Starting in January 2026, California will require large frontier AI developers to publish a framework detailing how they incorporate safety, security, and testing standards into their AI models. SB 53 also creates a mechanism for AI developers and the public to report critical safety incidents, and protects internal whistleblowers who report risks posed by frontier AI models. The law establishes significant penalties for companies that fail to comply, with fines of up to $1 million per violation.
  • AB 316: Artificial Intelligence defenses (Krell) – This amends California’s Civil Code. If a party to a lawsuit develops, modifies, or uses AI, this law prohibits them from asserting as a defense that the AI autonomously caused the harm.
  • AB 853: California AI Transparency Act (Wicks) – This bill expands the existing AI Transparency Act and modifies the effective date from January 1, 2026, to August 2, 2026. The California AI Transparency Act requires covered generative AI developers to provide an AI-detection tool to assess whether image, video, or audio content is created or altered by generative AI. This bill adds to the existing law by requiring large online platforms to embed provenance data into generated content. Starting January 1, 2028, users will also have the option to include latent disclosures on ‘capture devices’ such as cameras, video recorders, and other recorders.

This new California approach to AI transparency and safety legislation needs to be read in conjunction with the following existing laws.

  • California Privacy Protection Agency’s (CPPA’s) recently approved Cyber, Risk, ADMT, and Insurance Regulations – The CPPA’s most recently updated 127-page regulation package contains requirements governing cybersecurity audits, risk assessments, and automated decision-making technology. AI developers and systems that process personal information and meet certain California privacy thresholds will now face new cybersecurity audit and risk assessment requirements. In addition, automated and significant decisions concerning the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services will trigger significant notice, opt-out, and risk assessment requirements.
  • AB 2013: AI Training Data Transparency Act (Irwin-2024) – Passed last year, this law will require covered generative AI developers to publish online a high-level summary of the datasets used in the development of the generative AI system or service, including but not limited to whether personal information or copyrighted information is included in the training data. The law is scheduled to go into effect on January 1, 2026.

Children’s safety, age verifications, and companion chatbots

  • SB243: Companion Chatbots (Padilla) – This law applies to chatbots that provide human-like interactions and are capable of sustaining relationships across multiple interactions. Beginning July 1, 2027, developers of these ‘companion chatbots’ will need to develop and report protocols addressing suicidal ideation and self-harm to regulators and the public. The law requires AI disclosures, referrals to suicide hotlines or crisis text lines, and break reminders. SB 243 further requires developers to institute reasonable measures to prevent the chatbot from producing visual material of sexually explicit conduct or directly stating that the minor should engage in sexually explicit conduct. The legislation includes a private right of action to individuals who suffer ‘an injury in fact’ with statutory damages of $1,000 per violation, or actual damages if greater.
  • AB 1043 – Digital Age Assurance Act (Wicks) – Starting January 1, 2027, operating systems and covered application stores will be required to obtain age data from users and pass on age bracket data to developers when users download and launch an application.
  • AB 56: Social Media Warning Law (Bauer-Kahan) – Starting January 1, 2027, covered social media platforms will need to display a warning label to minors the first time a user accesses the platform each day, after three hours of active use, as well as once per hour of cumulative active use after that. The warning label must say ‘The Surgeon General has warned that while social media may have benefits for some young users, social media is associated with significant mental health harms and has not been proven safe for young users.’
  • AB 621: Deepfake pornography (Bauer-Kahan) – This amends California’s Civil Code and expands protections against deepfake pornography. The law explicitly provides a cause of action against individuals who create or disclose deepfake pornography if they know, or reasonably should know, that the depicted individual was a minor and also provides a cause of action against individuals who knowingly facilitate or recklessly aid or abet the creation or disclosure of such nonconsensual deepfake pornography. The bill confirms that a minor cannot consent to the creation or distribution of deepfake pornography.

California’s approach to AI and children has a long and complicated history, and these new laws should be read in conjunction with the following laws on the books.

  • California Age Appropriate Design Code (Wicks) – This law was signed on September 15, 2022, and was scheduled to go into effect on July 1, 2024. Modeled after the UK Age Appropriate Design Code, this law requires businesses to conduct impact assessments, provide Privacy by Default, estimate the age of all users, and restrict dark patterns. The law was enjoined in March 2025, but is being appealed by the California Attorney General.
  • Protecting Our Kids from Social Media Addiction Act (Skinner-2024) – This law is scheduled to go into effect on January 1, 2027, and prohibits covered social media platforms from providing addictive feeds to minors without verifiable parental consent. The law has so far escaped a constitutional challenge, but may face other court challenges prior to the effective date.

Healthcare AI and chatbots

  • AB 489: Health care professions: deceptive terms or letters: artificial intelligence (Bonta) – This law prohibits AI systems from falsely indicating or implying possession of a medical license or certificate through advertising, marketing, or other functionality. AB 489 also makes AI developers directly subject to the healthcare professional licensing board or enforcement agency if they develop such a system. Each use of a prohibited term, letter, or phrase shall constitute a separate violation.

California’s approach to AI in healthcare also needs to be read in conjunction with the following laws and guidance.

  • Legal Advisory on the Application of Existing California Law to Artificial Intelligence in Healthcare – In January 2025, California Attorney General Rob Bonta issued this advisory, setting forth California’s existing consumer protection, civil rights, competition, and data privacy laws governing healthcare AI.
  • SB 1120: Physicians Make Decisions Act (Becker-2024) – This law prohibits covered healthcare service plans from denying, delaying, or changing healthcare services based, in whole or in part, on medical necessity using AI, algorithms, or other software tools. Such determinations shall require a physician or licensed healthcare professional and review of individual circumstances. This law also requires written policies and procedures governing such determinations.
  • AB 3030: Artificial Intelligence in Health Care Services (Calderon – 2024) – This law applies to health facilities, clinics, physicians’ offices, or other health group practices that use generative AI for communications about patient clinical information. Under this bill, generative AI, which pertains to clinical information, must include:
    • a disclaimer that indicates the communication was generated by AI at the beginning of the interaction; and
    • clear instructions on how the patient can contact the appropriate person.

Antitrust and pricing discrimination

  • AB 325: Cartwright Act violations (Aguiar-Curry) – This amends California’s existing antitrust law, the Cartwright Act, to explicitly cover ‘common pricing algorithms.’ The law prohibits:
    • the use or distribution of a ‘common pricing algorithm’ as part of a contract, combination in the form of a trust, or conspiracy to restrain trade or commerce; or
    • coercion to set or adopt a recommended price or term, recommended by the common pricing algorithm for the same or similar products or services.

Complaints shall not be required to allege facts tending to exclude the possibility of independent action.

Law enforcement use of AI

  • SB 524 Law Enforcement Agencies (Arreguín) – SB 524 requires law enforcement to disclose if an official report was written either fully or in part using AI, as well as retain the first draft created by AI and an associated audit trail that, at minimum, identifies both the officer who used AI to create a report and the video and audio footage used to create a report, if any. SB 524 also prohibits AI vendors from sharing, selling, or otherwise using information, except as provided in the bill (e.g., troubleshooting, bias mitigation, quality control, legal purposes, etc.).

Employment and bias

While Governor Newsom vetoed SB 7, the No Robo Bosses Act, the Governor’s veto letter pointed to the CPPA’s ADMT regulations as addressing some of the bill’s requirements. Per Governor Newsom, SB 7 is ‘partially covered’ by these regulations, as they ‘allow employees and independent contractors to better understand how their personal data is used by automated decision technology.’ In addition, the California Civil Rights Council’s recently promulgated regulations state that California’s antidiscrimination laws apply to AI workplace tools. These regulations address another concern raised in SB 7, which sought to prohibit ADS systems from inferring a worker’s protected status.

0
Image of a cellular phone with the ChatGPT app open.

Overview: The EU General-Purpose AI Code of Practice

AI & Algorithms, Cybersecurity, EU , , , ,

Why Do We Need a Code of Practice?

On August 2, 2025, the general-purpose AI (GPAI) provisions of the EU AI Act went into effect. GPAI models (including models that support most generative AI, like ChatGPT), now face certain obligations in the EU, including requirements around transparency, copyright and systemic risk. However, the EU AI Act is a framework: it defines obligations but leaves technical details to harmonized standards and codes of practice. While this approach sets certain expectations and allows the EU AI Act to remain technology-neutral, it also leaves questions about how businesses substantially comply with the EU AI Act. To bridge this gap, a multi-stakeholder group drafted the General-Purpose AI Code of Practice (GPAI Code). On August 1, 2025, the European Commission issued a formal opinion confirming the GPAI Code is an “adequate tool” to help demonstrate compliance with the EU AI Act. Why is the Code significant? This opinion signals that organizations who adopt the GPAI Code may be able to demonstrate good-faith efforts to comply with the relevant provisions of the EU AI Act –  according to the Commission’s website: “The Code of Practice helps industry comply with the AI Act legal obligations…of general-purpose AI models.” In its opinion, the Commission notes that the Code provides actionable commitments and reporting mechanisms, especially for high-risk models. Additionally, the Commission emphasized that the Code provides a practical framework to demonstrate regulatory compliance. Following this endorsement, providers of GPAI models can voluntarily sign the Code, which “will reduce their administrative burden and give them more legal certainty than if they proved compliance through other methods.” Still, signatories should be aware that the Code explicitly states that adherence to the Code does not necessarily constitute evidence of compliance with the EU AI Act.

What is a General-Purpose AI Model?

A GPAI model is a component of an AI system with a wide range of possible uses, whether intentional or unintentional. It is important to note that these models are not systems in themselves but are part of AI systems. Additional elements, like user interfaces, are necessary to make these models fully operational systems. Under Article 3(63) of the EU AI Act, a GPAI model includes those trained on a “large amount of data using self-supervision at scale.”  They can be applied across sectors or tasks, usually without substantial modification, meaning GPAI models “can be integrated into a variety of downstream systems or applications.” Recital 98 of the EU AI Act states that the generality of the model can also be determined by the number of parameters, and “models with at least a billion parameters…should be considered to display significant generality and to competently perform a wide range of distinctive tasks.” GPAI models are sometimes called “foundation” or “frontier” models, and while they may include large language models (LLMs), they can also process audio, physical, textual or visual data, powering systems like DALL-E, GPT-4, Gemini, LaMDA, SEER, ALIGN, and more.

How are general-purpose AI models regulated?

Under the EU AI Act, the chapter on GPAI both addresses generative AI and outlines some of the most stringent requirements under the Act. However, all requirements for GPAI under the EU AI Act are directed to providers as opposed to deployers. Providers of GPAI models have a range of obligations under the EU AI act, both directly to supervising authorities and onward to AI providers who integrate the GPAI models into their systems. Obligations of Providers of GPAI Models If a provider places a GPAI model on the EU market, or integrates such a model into its own AI system on the EU market, it must:
  • Prepare and maintain technical documentation for regulators. This should include at least a general description of the GPAI model, including the tasks it’s designed to perform and the types of systems in which it can be integrated; acceptable use policies; and information on training process.
  • Prepare and maintain documentation for downstream providers. This should include information that allows the downstream AI system providers to comply with their own obligations under Article 53(1)(b). Similar to the technical documentation, this includes but is not limited to a general description of the model, and a description of its elements and development process.
  • Prepare an EU copyright policy. This policy should establish a means to comply with EU regulations on copyright and related rights.
  • Prepare and publish a summary of training content. Using the template provided by the AI Office, providers of GPAI must share a comprehensive summary of AI training information. This should allow stakeholders to exercise their rights by informing them of the information used to train the GPAI model.
  • Cooperate with relevant authorities and appoint an authorized representative. Providers must also cooperate with relevant authorities, and if they are established outside the EU, appoint an authorized representative located in the EU.
It is notable that under Recital 85, the EU AI Act states that GPAI systems “may be used as high-risk systems by themselves or be components of other high-risk systems.” Therefore, the providers of GPAI systems must work closely with providers of high-risk AI systems to ensure compliance with any requirements of high-risk systems under the Act. Obligations of Providers of GPAI Models with Systemic Risk What does “systemic risk” mean? GPAI models with systemic risk include models that reasonably pose foreseeable negative effects relating to major accidents, disruption of critical sectors, serious consequences to public health and safety, public and economic security, democratic processes, and the dissemination of false or discriminatory content, or other similar effect. Under Article 51(1) of the EU AI Act, a GPAI model will be classified as having systemic risk if:
  • It has high impact capabilities, or
  • It is designated by the Commission to have high impact capabilities based on the criteria in Annex XIII (i.e., the number of parameters in the model, the size of the data set, the amount of computation used to train the model, etc.).
What are the additional obligations for these models? In addition to the requirements for all GPAI models, those with systemic risk have additional obligations related to:
  • Model evaluation, assessment, and mitigation of systemic risks;
  • Incident management and reporting; and
  • Cybersecurity protections and technical documentation.
Because there are differences in the obligations between GPAI systems generally and GPAI systems with systemic risk, this classification procedure should be noted by providers of GPAI systems; it is essential to understand where each GPAI model falls, and what requirements the model has under the EU AI Act. According to Article 52(6), a list of GPAI models with systemic risk will be published and updated by the European Commission, but it has not been published at the time of writing.

What is the General-Purpose AI Code of Practice?

While not legally binding, providers of GPAI models can use the Code of Practice to demonstrate compliance with their obligations under the EU AI Act. The Code consists of three chapters on 1) transparency, 2) copyright, and 3) safety and security. The first two chapters apply to all providers of general-purpose AI models, providing a way to demonstrate compliance with obligations under Article 53 of the AI Act. The final chapter applies only to general-purpose AI models with systemic risk under Article 55 of the AI Act. Chapter 1: Transparency Among other things, this chapter requires signatories to create and maintain documentation for all GPAI models distributed within the EU for up to ten years. There are exceptions for models that are free, open-source, and do not pose systemic risk. When completing this documentation, signatories must use a standard Model Documentation Form, which includes information on licensing, technical specifications, training data, and other parameters of the GPAI model. The Code encourages publication of this information to promote transparency. Chapter 2: Copyright This chapter requires signatories to create and maintain a copyright policy that complies with the EU’s legal standards. This includes, but is not limited to, ensuring that data collected by web crawling is lawfully accessible, and certain websites flagged for copyright infringement are avoided. Importantly, signatories must designate a contact for copyright holders to submit complaints, along with a process for handling those complaints. Chapter 3: Safety & Security (GPAI with systemic risk only) One of the main elements of this chapter is the requirement for signatories to develop a state-of-the-art Safety and Security Framework before releasing any GPAI model categorized as posing a systemic risk. Additionally, systemic risks should be identified and inventoried, and before progressing with development or deployment, the signatories should weigh the relative risks and determine if they are acceptable, among other requirements.

What’s next?

The Code will be monitored and reviewed at regular intervals by the AI Office, and may be updated in response to emerging risks, technological developments, or incidents involving general-purpose AI models.
1 2 3 4 5 6 … 29