Last reviewed October 13, 2026. Change log: October 13, 2026, fixed two typographical errors and clarified which obligations apply to AI developers, businesses that use AI, and data brokers. October 6, 2026, replaced pre-approval wording with the approved CPPA deadlines (risk assessments by December 31, 2027; first attestation April 1, 2028) and added SB 53, the Transparency in Frontier Artificial Intelligence Act, to the frontier-law discussion. September 16, 2026, updated the CPPA regulation status, approval date, and phase-in deadlines to the approved text, and updated DROP status. August 10, 2026, added the California AI Transparency Act section.

California is establishing practical guardrails around the use of artificial intelligence and data through a combination of new regulations, targeted statutes, and robust enforcement. If your company builds or deploys AI, uses automated decision‑making in hiring or lending, or is a data broker, your obligations are changing.

This guide breaks down the three pillars you need to track right now:

1. CPPA's AI/ADMT, risk assessment, and cybersecurity audit rules (approved by the Office of Administrative Law on September 22, 2025; effective January 1, 2026).

2. AB 2013 (Generative AI training data transparency) with a January 1, 2026, documentation deadline.

3. The Delete Act and the state's one-stop DROP system, which is now live.

1) CPPA's AI/ADMT, Risk Assessment and Cybersecurity Audit Rules (Final; Effective January 1, 2026)

On July 24, 2025, the California Privacy Protection Agency (CPPA) Board voted to adopt a package of CCPA regulations covering automated decision‑making technology (ADMT), risk assessments, and cybersecurity audits. The Office of Administrative Law approved the package on September 22, 2025, and it took effect January 1, 2026. The rulemaking is complete, and the approved text is posted on the CPPA's website. California Privacy Protection Agency

What that means now:

• Status and timing. The regulations were approved and filed with the Secretary of State on September 22, 2025, and became effective January 1, 2026. Individual obligations phase in after that date (see the compliance cadence below). Alston & Bird Blog

• Scope. The rules (as adopted) establish consumer access and opt‑out rights for ADMT, mandate privacy risk assessments for certain processing, and require annual cybersecurity audits for covered businesses. (See CPPA's materials and modified rule text for definitions, thresholds, and detailed requirements.) California Privacy Protection

• Compliance cadence (approved text). ADMT obligations apply beginning January 1, 2027. Risk assessments for high-risk processing that began before January 1, 2026 and continues after that date must be completed by December 31, 2027; new activities require an assessment before they begin. The first submission of risk assessment information to the CPPA, with an attestation under penalty of perjury, is due by April 1, 2028. Cybersecurity audit certifications phase in by revenue: April 1, 2028 for businesses over $100 million, April 1, 2029 for $50 million to $100 million, and April 1, 2030 for under $50 million. JD Supra Wilson Sonsini

Context from Sacramento: Governor Newsom has urged caution about the breadth and cost of AI rules (e.g., projected first‑year compliance impacts) while acknowledging the need for consumer protections; the Board adopted the package, and OAL approved it on September 22, 2025. Politico, California Privacy Protection Agency

2) AB 2013: Generative AI Training Data Transparency (Documentation Deadline: Jan. 1, 2026)

Signed in September 2024, AB 2013 requires developers who make generative AI systems or substantial modifications available to Californians (publicly, free or paid) to post training‑data documentation on their websites by January 1, 2026, and again before each subsequent public release. Documentation must include a high‑level summary of datasets (sources/owners, types of data points, date ranges), and whether datasets include copyrighted works, personal information, were licensed/purchased, and whether synthetic data was used, among other items. LegiInfo

Takeaway: Even if you don't publish exact dataset titles, you must disclose categories, provenance, and treatment of training data at a meaningful level—plan your “model documentation” workflow now (legal + engineering + comms). LegiInfo

3) The Delete Act & DROP: A One‑Stop Consumer Deletion Mechanism Targeting Data Brokers

California's Delete Act (SB 362) expands data‑broker obligations and funds a Delete Request and Opt‑Out Platform (DROP)—a single portal through which consumers can direct all registered data brokers to delete their personal information. The DROP platform is live at privacy.ca.gov/drop. California Privacy Protection Agency

What businesses should do:

• If you are a data broker, ensure registration is current and systems can ingest DROP signals at scale.

• If you rely on brokers, revisit contracts and vendor management; the Delete Act puts the deletion duty on the broker, so ask for assurances that your partners honor DROP requests. California Privacy Protection Agency

4) The California AI Transparency Act (SB 942 / AB 853) — Operative August 2, 2026

California's AI Transparency Act (Bus. & Prof. Code, § 22757 et seq.) became operative on August 2, 2026. SB 942 created the regime in 2024; AB 853, signed in October 2025, delayed the operative date from January 1, 2026 to August 2, 2026 and added new categories of covered entities.

Who is covered. A “covered provider” is a person that creates, codes, or otherwise produces a generative AI system that is publicly accessible in California. The definition has no minimum number of visitors or users. Most California businesses are users of AI rather than covered providers — but the distinction matters, and vendor contracts should allocate the compliance obligation explicitly.

What it requires. Covered providers must offer a free disclosure verification tool and, to the extent technically feasible, include a latent disclosure in image, video, and audio content their systems create or alter, other than by minor modification. The current text does not require covered providers to add a manifest (visible) disclosure.

Penalties. Civil penalties are $5,000 per violation ($50,000, until January 1, 2029, for a covered provider that falsely represents that a system is designed primarily as assistive technology), and each day that a covered provider, large online platform, or capture device manufacturer is in violation is treated as a separate violation.

Phased obligations. Large online platform duties begin January 1, 2027, and capture-device manufacturer duties begin January 1, 2028.

What to do now. Identify whether your business creates, codes, or otherwise produces a generative AI system that is publicly accessible in California; if you license generative AI from a vendor, confirm in writing who bears the verification-tool and disclosure obligations, and whether provenance metadata will survive your publishing pipeline.

Enforcement Climate: Existing Laws Already Apply to AI

In January 2025, the California Attorney General issued a Legal Advisory reminding developers and deployers that existing California laws—consumer protection, civil rights, competition, data protection, and election‑misinformation statutes—already apply to AI. Translation: you don't need a brand‑new AI statute to face risk. Coalition of State  Attorneys General.

And enforcement pressure is building. In August 2025, AG Rob Bonta joined a bipartisan coalition of state attorneys general warning major AI companies that exposing children to sexualized content or similar harms will trigger accountability. Expect heightened scrutiny of chatbot safety, age‑appropriate design, and content controls. NAAG

Frontier AI: SB 1047 Was Vetoed, SB 53 Was Enacted

California's SB 1047, the much‑debated “frontier model” safety bill, was vetoed on September 29, 2024. The Governor's veto message cited concerns about scope and approach; the administration has pursued other AI policy avenues since. Governor of California

What did pass is SB 53, the Transparency in Frontier Artificial Intelligence Act (Bus. & Prof. Code, § 22757.10 et seq.), signed on September 29, 2025. It applies to developers of frontier models, not to businesses that use AI. Large frontier developers must publish a frontier AI framework describing how they assess and mitigate catastrophic risk, and must report summaries of assessments of catastrophic risk from internal use of their frontier models to the Office of Emergency Services. Frontier developers of any size also may not retaliate against a covered employee who reports to the Attorney General, with reasonable cause, a catastrophic-risk danger or a violation of the Act (Lab. Code, § 1107.1). If your company builds foundation models, those duties need a separate review. If it uses AI tools, your obligations come from the CPPA regulations, the AI Transparency Act, and existing consumer protection law. Attorney General SB 53 page

A Practical Compliance Checklist (Start Now)

Not every item below applies to every company. Items on training-data disclosure and frontier-model frameworks apply to developers that build or substantially modify models (AB 2013, SB 53). Items on risk assessments, automated decisionmaking, and cybersecurity audits apply to businesses covered by the CCPA that meet the triggers in the regulations; a risk assessment or a cybersecurity audit can be required of a business that uses no AI. Items on deletion and opt-out signals apply to data brokers registered under the Delete Act. Map your company to the right column before assigning work.

Data & Model Inventory

• Map all AI/ADMT uses (hiring, credit, insurance, content moderation, customer scoring, safety monitoring, etc.). Identify high‑risk contexts. California Privacy Protection Agency

Governance & Documentation

• Draft an AB 2013 Training‑Data Disclosure template: dataset sources/owners; data types/labels; copyright/personal‑information indicators; licensing; synthetic data use; collection timeframes. Coordinate with engineering to substantiate claims. LegiInfo

• Prepare ADMT notices and consumer request flows (access + opt‑out), aligned to CPPA definitions. California Privacy Protection Agency

Risk Management

• Stand up a risk assessment program that can scale to recurring updates and event‑driven reviews after material model changes. (Under the approved regulations, risk assessments for processing that began before January 1, 2026 and continues after that date are due by December 31, 2027, new processing needs one before it starts, and the first attestation to the Agency is due April 1, 2028.) JD Supra

• Schedule annual cybersecurity audits with independence criteria and board‑level visibility. California Privacy Protection Agency

Vendor & Data‑Broker Controls

• Refresh DPAs and broker contracts for DROP compliance and downstream deletion signal handling. Document enforcement mechanisms. California Privacy Protection Agency

Safety & Child‑Protection

• Implement content safeguards for chatbots and generative systems; test for age‑gating failures and unsafe prompts. Document mitigations in your risk assessment file. (AGs have placed platforms on notice.)

Public‑Facing Disclosures

• Publish plain‑English AI notices, including training‑data documentation for generative systems (AB 2013). Ensure updates are synchronized with releases. LegiInfo

Key Dates to Watch

• September 22, 2025: OAL approved the CPPA regulations; effective January 1, 2026. ADMT obligations apply from January 1, 2027. Alston & Bird Blog

• Jan. 1, 2026: AB 2013 training‑data transparency documentation due for covered generative AI systems and substantial modifications. LegiInfo

• 2026: The DROP platform is live, and registered data brokers must process DROP deletion requests beginning August 1, 2026. California Privacy Protection Agency

Frequently Asked Questions

Q1: Does AB 2013 force me to list every dataset by name?
A: No. It requires a “high‑level summary” of datasets and specific disclosures (e.g., sources/owners, types of data points, whether personal information or copyrighted works are included, licensing, time ranges), not necessarily dataset‑by‑dataset publication. LegiInfo

Q2: Are the CPPA's ADMT rules already enforceable?
A: Not yet, although the regulations are final. The Board adopted the package on July 24, 2025, the Office of Administrative Law approved it on September 22, 2025, and the rules took effect January 1, 2026. Businesses that use ADMT to make significant decisions must meet the ADMT-specific notice, access, and opt-out obligations beginning January 1, 2027, so the practical task now is building those processes before that date. California Privacy Protection Agency Alston & Bird Blog

Q3: How does the Delete Act affect a company that uses brokers rather than being one?
A: The Delete Act puts its deletion duties on data brokers, not on a company that only buys data from them; you can still ask brokers by contract to confirm they honor DROP requests. Reevaluate vendor due diligence, audit rights, and data‑flow maps. California Privacy Protection Agency

Q4: Didn't California already pass a sweeping “frontier AI” law?
A: Not a sweeping one. SB 1047 was vetoed in September 2024. California then enacted SB 53, the Transparency in Frontier Artificial Intelligence Act, in September 2025. SB 53 creates transparency and reporting duties for large frontier model developers; it does not impose new requirements on ordinary businesses that use AI. Their obligations come from the CPPA regulations, the AI Transparency Act, and existing law. Governor of California

How Kolmogorov Law, P.C. Can Help

We advise California businesses on AI governance, privacy, and platform compliance. We can:

• Build an AB 2013 training‑data disclosure that is accurate, defensible, and minimally sensitive.

• Design ADMT notices, consumer request workflows, and risk‑assessment templates that satisfy CPPA expectations.

• Conduct readiness reviews now. The regulations took effect January 1, 2026, and the ADMT obligations begin January 1, 2027.

Contact us today by filling out our online form or calling us directly at (909) 235-6116 to schedule a free 15-minute initial consultation.

We look forward to creating a productive business relationship.