California SB 53 — Transparency in Frontier AI Act

California SB 53, the Transparency in Frontier Artificial Intelligence Act (TFAIA), is a state law requiring large frontier AI developers to publish and follow frontier AI frameworks for managing catastrophic risk, requiring frontier developers to publish transparency reports and report critical safety incidents, and protecting whistleblowers at frontier developers. Authored by Sen. Scott Wiener, it was approved by the Governor and filed with the Secretary of State on September 29, 2025, and enacted as Chapter 138, Statutes of 2025. It also establishes a consortium to design a public computing cluster, "CalCompute."

Status and timeline

The bill was approved by the Governor and filed with the Secretary of State on September 29, 2025, and took effect as Chapter 138, Statutes of 2025. The full text is recorded as SB 53, Chapter 138, California Statutes of 2025. The act adds Chapter 25.1 (commencing with Section 22757.10) to Division 8 of the Business and Professions Code, Section 11546.8 to the Government Code, and Chapter 5.1 (commencing with Section 1107) to Part 3 of Division 2 of the Labor Code.

The statute sets several later dates: the Office of Emergency Services' first annual anonymized incident report and the Attorney General's first annual anonymized whistleblower report are due beginning January 1, 2027; the Department of Technology's first review of the coverage definitions is due on or before January 1, 2027; and the CalCompute consortium's framework report is due to the Legislature on or before January 1, 2027. The CalCompute provisions operate only upon an appropriation in a budget act or other measure.

Legislative findings

Section 1 of the act sets out the Legislature's findings. They state that California leads in AI innovation and research; that foundation models could produce benefits including advances in medicine, wildfire forecasting and prevention, and climate science; and that the Joint California Policy Working Group on AI Frontier Models "has recommended sound principles for policy in artificial intelligence" (see The California Report on Frontier AI Policy). The findings state that greater transparency can advance accountability, competition, and public trust; that whistleblower protections and public information sharing are "key instruments" for transparency; and that incident reporting enables monitoring of post-deployment impacts.

The findings express concern that advanced AI systems developed without "careful diligence and reasonable precaution" could have capabilities posing catastrophic risks "from both malicious uses and malfunctions, including artificial intelligence-enabled hacking, biological attacks, and loss of control." They state that major developers have already voluntarily adopted frontier AI frameworks as an industry best practice but that "not all developers are providing reporting that is consistent and sufficient," so that "mandatory, standardized, and objective reporting" is required. They state that the law aims to track the frontier "while avoiding burdening smaller companies behind the frontier," while noting that foundation models from smaller companies or behind the frontier may in future pose significant catastrophic risk and require additional legislation. The findings cite the Governor's California Report on Frontier AI Policy and legislative testimony, and state the Legislature's intent "to create more transparency," adding that collective safety will depend in part on frontier developers taking due care "proportional to the scale of the foreseeable risks."

Scope and definitions

The law applies to "frontier developers" and, for most obligations, to "large frontier developers," and exempts smaller companies. Key definitions in § 22757.11:

• Frontier model: a foundation model trained using more than 10^26 integer or floating-point operations, counting the original training run and any subsequent fine-tuning, reinforcement learning, or other material modifications.
• Frontier developer: a person who has trained, or initiated the training of, a frontier model.
• Large frontier developer: a frontier developer that, together with its affiliates, had annual gross revenues above $500,000,000 in the preceding calendar year.
• Foundation model: an AI model trained on a broad data set, designed for generality of output, and adaptable to a wide range of distinctive tasks.
• Catastrophic risk: a foreseeable and material risk that a frontier developer's development, storage, use, or deployment of a frontier model will materially contribute to the death of, or serious injury to, more than 50 people, or more than $1,000,000,000 in damage to or loss of property, arising from a single incident in which a frontier model (A) provides expert-level assistance in creating or releasing a chemical, biological, radiological, or nuclear weapon; (B) engages, with no meaningful human oversight, in a cyberattack or in conduct that would constitute murder, assault, extortion, or theft if committed by a human; or (C) evades the control of its frontier developer or user. Excluded are risks from outputs of information otherwise publicly accessible in substantially similar form, lawful activity of the federal government, and harm caused by a model combined with other software where the model did not materially contribute. Loss of equity value does not count as property damage (§ 22757.16).
• Critical safety incident: (1) unauthorized access to, modification of, or exfiltration of a frontier model's weights that results in death or bodily injury; (2) harm from the materialization of a catastrophic risk; (3) "loss of control of a frontier model causing death or bodily injury"; or (4) a frontier model's use of "deceptive techniques against the frontier developer" to subvert its controls or monitoring, outside an evaluation designed to elicit the behavior and in a manner demonstrating materially increased catastrophic risk.
• Deploy: to make a frontier model available to a third party for use, modification, copying, or combination with other software, excluding availability primarily for developing or evaluating the model.
• Frontier AI framework: "documented technical and organizational protocols to manage, assess, and mitigate catastrophic risks."

Brookings estimates that approximately 5–8 entities are currently covered at the 10^26 FLOP plus $500M revenue thresholds (Brookings, via FPF and Brookings — California SB 53 Compliance Analyses (Oct–Dec 2025)). Brookings also notes a regulatory-cliff dynamic in which the thresholds create a structural incentive for developers to stay just below them.

Under § 22757.14, the Department of Technology must, on or before January 1, 2027 and annually thereafter, assess developments and recommend whether and how to update the definitions of "frontier model," "frontier developer," and "large frontier developer." It must consider similar thresholds in international standards and federal law, aligning with a federal definition where consistent with the chapter's purposes; stakeholder input from academics, industry, the open-source community, and government; and whether coverage can be determined early, simply, and verifiably by parties other than the developer. Its recommendations go to the Legislature in a report.

Key provisions

Frontier AI framework (§ 22757.12(a)–(b))

A large frontier developer must write, implement, comply with, and clearly and conspicuously publish on its website a frontier AI framework applying to its frontier models. The framework must describe how the developer approaches:

1. Incorporating national standards, international standards, and industry-consensus best practices.
2. Defining and assessing thresholds, which may be multiple-tiered, for identifying whether a frontier model has capabilities that could pose a catastrophic risk.
3. "Applying mitigations to address the potential for catastrophic risks" based on those assessments.
4. Reviewing assessments and the adequacy of mitigations as part of the decision to deploy a frontier model or use it extensively internally.
5. Using third parties to assess catastrophic risk and the effectiveness of mitigations.
6. Revisiting and updating the framework, including update triggers and how it determines that a model is substantially modified enough to require new disclosures.
7. "Cybersecurity practices to secure unreleased model weights from unauthorized modification or transfer" by internal or external parties.
8. "Identifying and responding to critical safety incidents."
9. Internal governance practices to ensure implementation.
10. "Assessing and managing catastrophic risk resulting from the internal use of its frontier models, including risks resulting from a frontier model circumventing oversight mechanisms."

The framework must be reviewed, and updated as appropriate, at least once a year. A material modification must be published, with a justification, within 30 days.

Transparency reports (§ 22757.12(c))

Before or concurrently with deploying a new frontier model or a substantially modified version of an existing one, every frontier developer must publish a transparency report stating its website, a mechanism for a natural person to contact it, the model's release date, supported languages, output modalities, intended uses, and any generally applicable restrictions or conditions on use. A large frontier developer must also include summaries of its catastrophic-risk assessments under its framework, their results, the extent of third-party evaluator involvement, and other steps taken to fulfil the framework. Publishing this information within a larger document, "including a system card or model card," counts as compliance. Developers are encouraged, but not required, to make disclosures consistent with or superior to industry best practices.

Internal-use risk assessments (§ 22757.12(d))

A large frontier developer must transmit to the Office of Emergency Services a summary of any assessment of catastrophic risk resulting from internal use of its frontier models every three months, or on another reasonable schedule it specifies in writing to the Office. These catastrophic-risk summaries are submitted quarterly, which the FPF and Brookings analyses describe as creating continuous oversight (FPF and Brookings — California SB 53 Compliance Analyses (Oct–Dec 2025)).

Truthfulness and redactions (§ 22757.12(e)–(f))

A frontier developer may not make a materially false or misleading statement about catastrophic risk from its frontier models or its management of that risk, and a large frontier developer may not make one about its implementation of, or compliance with, its framework; statements made in good faith and reasonable under the circumstances are exempt. Published documents may be redacted to protect trade secrets, cybersecurity, public safety, U.S. national security, or to comply with law, but the developer must describe the character and justification of each redaction and retain the unredacted information for five years.

Safety incident reporting (§ 22757.13)

The Office of Emergency Services must establish mechanisms for frontier developers and members of the public to report critical safety incidents (stating the date, why the incident qualifies, a short and plain description, and whether it involved internal use), and for large frontier developers to confidentially submit internal-use catastrophic-risk assessments, with access limited to personnel with a specific need to know. A frontier developer must report a critical safety incident within 15 days of discovering it; if the incident poses an imminent risk of death or serious physical injury, it must disclose it within 24 hours to an appropriate authority, including any law enforcement or public safety agency with jurisdiction. Amended reports are permitted, and reporting incidents involving non-frontier foundation models is encouraged but not required. Critical safety incident disclosure thus follows a 15-day standard, shortened to 24 hours where the risk is imminent (per FPF and Brookings — California SB 53 Compliance Analyses (Oct–Dec 2025)).

The Office must review developer reports and may review public reports. It and the Attorney General may transmit incident reports and whistleblower reports to the Legislature, the Governor, the federal government, or state agencies, after strongly considering trade-secret, public-safety, cybersecurity, and national-security risks. Incident reports, internal-use assessment reports, and covered-employee reports are exempt from the California Public Records Act; Section 6 of the act records the Legislature's finding that such information "could threaten public safety or compromise the response to an incident if disclosed to the public." Beginning January 1, 2027, the Office must publish an annual anonymized, aggregated report on reviewed incidents.

The Office may adopt regulations designating federal laws, regulations, or guidance documents whose incident-reporting standards are substantially equivalent to or stricter than the state's and that are intended to assess, detect, or mitigate catastrophic risk. A frontier developer that declares its intent to comply through such a federal standard is deemed in compliance while it meets that standard, and a failure to meet the federal standard then constitutes a violation of the chapter. The Office must revoke a designation that no longer meets the conditions.

Mitigations and oversight

The text contains no requirement to maintain a shutdown capability; SB 1047's "capability to promptly enact a full shutdown" (California SB 1047 — Safe and Secure Innovation for Frontier AI Models Act (enrolled + veto)) has no counterpart, consistent with the Future of Privacy Forum's listing of the kill switch as removed (FPF and Brookings — California SB 53 Compliance Analyses (Oct–Dec 2025)). The frontier AI framework must instead describe how the developer approaches "applying mitigations to address the potential for catastrophic risks," "cybersecurity practices to secure unreleased model weights from unauthorized modification or transfer," "identifying and responding to critical safety incidents," and "assessing and managing catastrophic risk resulting from the internal use of its frontier models, including risks resulting from a frontier model circumventing oversight mechanisms" (§ 22757.12(a)(3), (7), (8), (10)). A critical safety incident includes "loss of control of a frontier model causing death or bodily injury" and a frontier model's use of "deceptive techniques against the frontier developer" to subvert its controls or monitoring.

Whistleblower protections (Labor Code §§ 1107–1107.2)

The law extends existing labor whistleblower protections to employees of AI companies reporting safety concerns, and mandates anonymous reporting channels (per FPF and Brookings — California SB 53 Compliance Analyses (Oct–Dec 2025)). The protections apply to "covered employees," defined as employees responsible for assessing, managing, or addressing risk of critical safety incidents. Chapter 5.1 uses its own definitions of catastrophic risk and critical safety incident framed around foundation models; its weights-exfiltration category also covers incidents resulting in damage to or loss of property.

• A frontier developer may not make, adopt, enforce, or enter into a rule, policy, or contract that prevents a covered employee from disclosing, or retaliates against them for disclosing, information to the Attorney General, a federal authority, a person with authority over the employee, or another covered employee with authority to investigate or correct the issue, where the employee has reasonable cause to believe the developer's activities pose "a specific and substantial danger to the public health or safety resulting from a catastrophic risk" or that it has violated the TFAIA. Contracts may not prevent disclosures protected under Labor Code § 1102.5, and covered employees may use the § 1102.7 hotline.
• Frontier developers must give covered employees clear notice of their rights, either by continuous workplace posting (with equivalent notice for new and remote employees) or by annual written notice acknowledged by each covered employee.
• A large frontier developer must provide a reasonable internal process for anonymous disclosure, including a monthly update to the discloser on the status of the investigation and actions taken. Disclosures and responses must be shared with officers and directors at least quarterly, except with an officer or director accused of wrongdoing in the disclosure.
• Courts may award reasonable attorney's fees to a successful plaintiff. Once a plaintiff shows by a preponderance of the evidence that protected activity was a contributing factor in the adverse action, the developer must prove by clear and convincing evidence that it would have taken the action for legitimate, independent reasons. Covered employees may petition the superior court for temporary or preliminary injunctive relief, which issues on a showing of reasonable cause; the court must consider the chilling effect on other covered employees, and such relief is not stayed pending appeal.
• The remedies are cumulative with other state law and do not limit § 1102.5 rights of employees who are not covered employees.

Beginning January 1, 2027, the Attorney General must publish an annual anonymized, aggregated report on reviewed covered-employee reports (§ 22757.14(d)). See AI Whistleblowing.

CalCompute (Gov. Code § 11546.8)

The law establishes within the Government Operations Agency a consortium to develop a framework for a public cloud computing cluster, "CalCompute," that advances AI development and deployment that is "safe, ethical, equitable, and sustainable" by fostering research and innovation that benefits the public and by expanding access to computational resources. The consortium must make reasonable efforts to establish CalCompute within the University of California, which may receive private donations for it. CalCompute is to include a fully owned and hosted cloud platform and the human expertise to operate it and to support its users.

The consortium has 14 members, serving without compensation: four representatives of the University of California and other academic research institutions and national laboratories and four technology and AI experts, all appointed by the Secretary of Government Operations; three representatives of impacted workforce labor organizations appointed by the Speaker of the Assembly; and three representatives of stakeholder groups such as ethicists and consumer and public-interest advocates appointed by the Senate Rules Committee. Its report, due on or before January 1, 2027, must include a landscape analysis of California's cloud computing infrastructure, a cost analysis and funding recommendations, governance and usage recommendations, a workforce analysis, a description of proposed partnerships with nongovernmental entities, and recommendations on prioritizing the public-sector workforce. The consortium dissolves upon submitting the report, and the section operates only upon an appropriation.

Obligations by actor

Practitioner analysis combining Future of Privacy Forum (Gluck, Oct 2025) and Brookings (Alikhani & Kane, Dec 2025) identifies four discrete obligations not all visible from the statutory text alone (FPF and Brookings — California SB 53 Compliance Analyses (Oct–Dec 2025)): the Frontier AI Framework (large developers); pre-deployment Transparency Reports (all frontier developers); Critical Safety Incident Disclosure (15-day standard, 24-hour for imminent risk); and Whistleblower Protections with mandated anonymous reporting channels.

Enforcement and penalties

Civil penalties are enforced by the Attorney General, capped at $1M per violation. Under § 22757.15, a large frontier developer that fails to publish or transmit a compliant document, makes a prohibited false or misleading statement, fails to report an incident as required, or fails to comply with its own frontier AI framework is subject to a civil penalty "dependent upon the severity of the violation" of up to $1,000,000 per violation, recoverable only in a civil action brought by the Attorney General. Brookings characterizes this cap as substantially lighter than the EU AI Act and the NY RAISE Act, which reach $10M–$30M (FPF and Brookings — California SB 53 Compliance Analyses (Oct–Dec 2025)). The Attorney General has no rulemaking power under the law; it provides only for Department of Technology recommendations, subject to Legislative approval.

Preemption and interaction with other law

Section 5 of the act provides that its provisions are severable and to be liberally construed; that its duties are cumulative with other law; that it does not apply to the extent it strictly conflicts with a contract between a federal government entity and a frontier developer, or to the extent it is preempted by federal law; and that it preempts any local rule, regulation, code, or ordinance adopted on or after January 1, 2025 "specifically related to the regulation of frontier developers with respect to their management of catastrophic risk." The Legislative Counsel's digest notes that existing California law already requires developers of generative AI systems or services released on or after January 1, 2022 and made publicly available to Californians to post documentation of their training data, on or before January 1, 2026 and before each later release or substantial modification.

Reactions

Dario Amodei describes the law in The Adolescence of Technology. Amodei advocates a transparency-first regulatory approach — measure and disclose before restricting, with minimal collateral damage — which the law's framework-and-disclosure structure reflects.

Brookings argues that "much of the law codifies practices that major companies already claim to follow," which it reads as implying low marginal compliance cost but also limited marginal safety gain (FPF and Brookings — California SB 53 Compliance Analyses (Oct–Dec 2025)). The statute's own findings state a related premise: that major developers already publish frontier AI frameworks voluntarily, but that reporting is not consistent or sufficient across developers.

The law is an instance of state-led AI regulation of the kind the techno-federalism framework describes, with California leading in software governance while the federal government takes a less active role.

For practitioner-oriented compliance analysis — concrete obligations, enforcement mechanics, timeline, and comparison with the NY RAISE Act — see FPF and Brookings — California SB 53 Compliance Analyses (Oct–Dec 2025), combining Future of Privacy Forum (Gluck, Oct 2025) and Brookings (Alikhani & Kane, Dec 2025).

Relationships

• related: California SB 53 — legislation-tracker page for the same law.
• related: California SB 1047 — Safe and Secure Innovation for Frontier AI Models Act (enrolled + veto) — earlier frontier AI bill whose "capability to promptly enact a full shutdown" requirement has no counterpart in SB 53.
• depends-on: The California Report on Frontier AI Policy — the Joint California Policy Working Group report cited in the legislative findings.
• related: FPF and Brookings — California SB 53 Compliance Analyses (Oct–Dec 2025) — practitioner compliance analysis.
• related: Governor Newsom signs SB 53, advancing California's world-leading artificial intelligence industry (CA Gov, September 29 2025) — the Governor's signing announcement.
• related: New York RAISE Act — New York frontier AI law used as the penalty comparison.
• related: The Adolescence of Technology
• related: AI Whistleblowing
• instance-of: techno-federalism

Sources

• Full text: SB 53, Chapter 138, California Statutes of 2025
• FPF and Brookings — California SB 53 Compliance Analyses (Oct–Dec 2025) — practitioner compliance analysis (FPF + Brookings, Oct–Dec 2025)

Provenance

Source file: Raw Sources/California SB 53.md, the chaptered text of SB 53 (Chapter 138, Statutes of 2025) including the Legislative Counsel's digest, as published by the California Legislature. Confidence is medium: the statutory text is a single primary source, supplemented by one practitioner analysis page.