Regulon — CA-SB-420 · CA SB 420 (Automated Decision Systems)

WHAT THIS BILL REGULATES · 6 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney General or Civil Rights Department enforcement. The AG or CRD may bring a civil action against a deployer or developer for a violation. Before commencing an action, the AG or CRD must provide 45 days' written notice of the alleged violation. The developer or deployer may cure the noticed violation within 45 days and provide an express written statement under penalty of perjury that the violation has been cured; if cured, the action shall not be maintained. No private right of action.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

Tiered civil penalties for failure to conduct impact assessment: $2,500 (fewer than 100 employees), $5,000 (fewer than 500 employees), $10,000 (500+ employees). For intentional violations, an additional $500 per day of noncompliance. For algorithmic discrimination violations, $25,000 per violation. Injunctive relief and reasonable attorney's fees and costs are also available.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Bus. & Prof. Code § 22756

Definitions

(a)–(p) As used in this chapter: (a) "Algorithmic discrimination" means the condition in which an automated decision system contributes to unlawful discrimination on the basis of a protected classification. (b) "Artificial intelligence" means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. (c) (1) "Automated decision system" means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons. (2) "Automated decision system" does not mean a spam email filter, firewall, antivirus software, identity and access management tool, calculator, database, dataset, or other compilation of data. (d) "Deployer" means a natural person or entity that uses a high-risk automated decision system in the state. (e) "Detecting decisionmaking patterns without influencing outcomes" means the act of artificial intelligence analyzing patterns for informational purposes without direct influence on decisions. (f) "Developer" means a natural person or entity that designs, codes, produces, or substantially modifies a high-risk automated decision system for use in the state. (g) "Education enrollment or opportunity" means the chance to obtain admission, accreditation, evaluation, certification, vocational training, financial aid, or scholarships with respect to an educational opportunity. (h) "Employment or employment opportunity" means hiring, salary, wage, or other material term, condition, or privilege of an employee's employment. (i) "Health care" means health care services or insurance for health, mental health, dental, or vision. (j) (1) "High-risk automated decision system" means an automated decision system that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, any of the following: (A) Education enrollment or opportunity. (B) Employment or employment opportunity. (C) Essential utilities. (D) Temporary, short-term, or long-term housing. (E) Health care services. (F) Lending services. (G) A legal right or service. (H) An essential government service. (2) "High-risk automated decision system" does not include an automated decision system that only performs narrow procedural tasks, enhances human activities, detects patterns without influencing decisions, or assists in preparatory tasks for assessment. (k) "Improving results of previously completed human activities" means the act of artificial intelligence enhancing existing human-performed tasks without altering decisions. (l) "Narrow procedural task" means a limited, procedural task that has a minimal impact on outcomes. (m) "Preparatory task for assessment" means a task in which an artificial intelligence aids in a preparatory task for assessment or evaluation without direct decisionmaking authority. (n) "Protected classification" means a classification protected under existing law prohibiting discrimination, including, but not limited to, the Fair Employment and Housing Act (Chapter 7 (commencing with Section 12960) of Part 2.8 of Division 3 of Title 2 of the Government Code) or the Unruh Civil Rights Act (Section 51 of the Civil Code). (o) (1) "State agency" means any of the following: (A) A state office, department, division, or bureau. (B) The California State University. (C) The Board of Parole Hearings. (D) A board or other professional licensing and regulatory body under the administration or oversight of the Department of Consumer Affairs. (2) "State agency" does not include the University of California, the Legislature, the judicial branch, or a board that is not described in paragraph (1). (p) "Substantial modification" means a new version, release, or other significant update that materially changes the functionality or performance of a high-risk automated decision system, including the results of retraining.

Section 22756 establishes the definitional framework for the chapter. Key terms include automated decision system (computational processes derived from ML, statistical modeling, data analytics, or AI that issue simplified outputs used to assist or replace human discretionary decisionmaking), high-risk automated decision system (those with legal or similarly significant effects across eight enumerated domains), developer, deployer, and algorithmic discrimination. The high-risk definition carves out narrow procedural tasks, human-activity enhancements, pattern detection without influencing decisions, and preparatory assessment tasks.

The small-entity and federal-preemption exemptions in § 22756.7 mean the effective scope is entities with more than 50 employees deploying systems not already federally certified under substantially equivalent law.

Bus. & Prof. Code § 22756.1

Impact assessment requirements for developers and deployers

DeployerDeveloperGovernment

(a)(1)–(2) 1 For a high-risk automated decision system made publicly available for use on or after January 1, 2026, a developer shall perform an impact assessment on the high-risk automated decision system before making the high-risk automated decision system publicly available for use. (2) For a high-risk automated decision system first made publicly available for use before January 1, 2026, a developer shall perform an impact assessment if the developer makes a substantial modification to the high-risk automated decision system.

(b)(1)–(2) 2 Except as provided in paragraph (2), for a high-risk automated decision system first deployed after January 1, 2026, a deployer shall perform an impact assessment within two years of deploying the high-risk automated decision system. (2) A state agency that is a deployer may opt out of performing an impact assessment if the state agency uses the automated decision system only for its intended use as determined by the developer and all of the following requirements are met: (A) The state agency does not make a substantial modification to the high-risk automated decision system. (B) The developer of the high-risk automated decision system is in compliance with Section 10285.8 of the Public Contract Code and subdivision (d). (C) The state agency does not have a reasonable basis to believe that deployment of the high-risk automated decision system as intended by the developer is likely to result in algorithmic discrimination. (D) The state agency is in compliance with Section 22756.3.

(c)(1)–(2) 3 A developer shall make available to deployers and potential deployers the statements included in the developer's impact assessment pursuant to paragraph (2). (2) An impact assessment prepared pursuant to this section shall include all of the following: (A) A statement of the purpose of the high-risk automated decision system and its intended benefits, intended uses, and intended deployment contexts. (B) A description of the high-risk automated decision system's intended outputs. (C) A summary of the types of data intended to be used as inputs to the high-risk automated decision system and any processing of those data inputs recommended to ensure the intended functioning of the high-risk automated decision system. (D) A summary of reasonably foreseeable potential disproportionate or unjustified impacts on a protected classification from the intended use by deployers of the high-risk automated decision system. (E) A developer's impact assessment shall also include both of the following: (i) A description of safeguards implemented or other measures taken by the developer to mitigate and guard against risks known to the developer of algorithmic discrimination arising from the use of the high-risk automated decision system. (ii) A description of how the high-risk automated decision system can be monitored by a deployer for risks of algorithmic discrimination known to the developer. (F) A statement of the extent to which the deployer's use of the high-risk automated decision system is consistent with, or varies from, the developer's statement of the high-risk automated decision system's purpose and intended benefits, intended uses, and intended deployment contexts. (G) A description of safeguards implemented or other measures taken to mitigate and guard against any known risks to the deployer of discrimination arising from the high-risk automated decision system. (H) A description of how the high-risk automated decision system has been, and will be, monitored and evaluated.

(d)(1)–(2) 4 A state agency shall require a developer of a high-risk automated decision system deployed by the state agency to provide to the state agency a copy of the impact assessment conducted pursuant to this section. (2) Notwithstanding any other law, an impact assessment provided to a state agency pursuant to this subdivision shall be kept confidential.

Section 22756.1 establishes the bill's core impact-assessment obligations. Developers must perform an impact assessment before making a high-risk automated decision system publicly available (for systems available on or after January 1, 2026) or upon substantial modification (for pre-2026 systems). Deployers must perform an impact assessment within two years of deploying a high-risk system first deployed after January 1, 2026.

A state-agency deployer may opt out of conducting its own impact assessment if it uses the system only as intended by the developer, makes no substantial modification, the developer is in compliance with the Public Contract Code procurement provision and the confidential-submission requirement, and the agency has no reasonable basis to believe the system is likely to result in algorithmic discrimination.

The required content of an impact assessment is enumerated in subdivision (c)(2) and covers purpose, intended outputs, data types, foreseeable discriminatory impacts, safeguards, monitoring plans, and the deployer's deviation from intended uses. Developers must also make their impact assessment statements available to deployers and potential deployers. State agencies must require developers to provide a copy of the impact assessment, which must be kept confidential.

Compliance actions 4 items

Developers must perform a formal impact assessment on each high-risk automated decision system before making it publicly available for use (for systems available on or after January 1, 2026). For systems first made publicly available before January 1, 2026, developers must perform an impact assessment upon making a substantial modification to the system.

H-02.3

Deployers must perform an impact assessment on each high-risk automated decision system within two years of deploying the system (for systems first deployed after January 1, 2026). A state-agency deployer may opt out of this requirement if it uses the system only for its intended use as determined by the developer, makes no substantial modification, the developer complies with the Public Contract Code procurement and confidential-submission requirements, the state agency has no reasonable basis to believe deployment is likely to result in algorithmic discrimination, and the state agency maintains a governance program under § 22756.3.

H-02.3

Developers must make the statements from their impact assessment available to deployers and potential deployers. The impact assessment must include: (1) a statement of purpose, intended benefits, intended uses, and intended deployment contexts; (2) a description of intended outputs; (3) a summary of data types used as inputs and recommended processing; (4) a summary of reasonably foreseeable disproportionate or unjustified impacts on protected classifications; (5) a description of safeguards to mitigate known algorithmic discrimination risks; (6) a description of how deployers can monitor for algorithmic discrimination; (7) a statement of the extent to which the deployer's use varies from the developer's intended use; (8) a description of deployer-side safeguards against discrimination; and (9) a description of how the system has been and will be monitored and evaluated.

H-02.2

State agencies must require developers of high-risk automated decision systems deployed by the state agency to provide a copy of the impact assessment to the state agency. The impact assessment provided to the state agency must be kept confidential.

R-02.2

Bus. & Prof. Code § 22756.2

Individual notification, public disclosure, and appeal rights

Deployer

(a)(1)–(5) 5 If a deployer uses a high-risk automated decision system to make a decision regarding a natural person, the deployer shall notify the natural person of that fact and disclose to that natural person all of the following: (1) The purpose of the high-risk automated decision system and the specific decision it was used to make. (2) How the high-risk automated decision system was used to make the decision. (3) The type of data used by the high-risk automated decision system. (4) Contact information for the deployer. (5) A link to the statement required by subdivision (b).

(b)(1)–(3) 6 A deployer shall make available on its internet website a statement summarizing all of the following: (1) The types of high-risk automated decision systems it currently deploys. (2) How the deployer manages known or reasonably foreseeable risks of algorithmic discrimination arising from the deployment of those high-risk automated decision systems. (3) The nature and source of the information collected and used by the high-risk automated decision systems deployed by the deployer.

(c) 7 A deployer shall provide, as technically feasible, a natural person that is the subject of a decision made by a high-risk automated decision system an opportunity to appeal that decision for review by a natural person.

Section 22756.2 establishes three distinct obligations on deployers. Subdivision (a) requires individual notification when a high-risk automated decision system is used to make a decision about a natural person, including disclosure of the system's purpose, how it was used, data types, contact information, and a link to the public website statement. Subdivision (b) requires deployers to publish a summary on their website covering the types of high-risk systems deployed, how algorithmic discrimination risks are managed, and the nature and source of data used. Subdivision (c) requires deployers to provide affected individuals with an opportunity to appeal a decision for human review, as technically feasible.

Compliance actions 3 items

Deployers must notify any natural person when a high-risk automated decision system is used to make a decision about them and disclose: (1) the purpose of the system and the specific decision it was used to make; (2) how the system was used to make the decision; (3) the type of data used; (4) contact information for the deployer; and (5) a link to the deployer's public website statement about its high-risk automated decision systems.

H-01.1

Deployers must publish on their internet website a statement summarizing: (1) the types of high-risk automated decision systems currently deployed; (2) how the deployer manages known or reasonably foreseeable risks of algorithmic discrimination; and (3) the nature and source of information collected and used by those systems.

G-02.4

Deployers must provide, as technically feasible, any natural person subject to a decision made by a high-risk automated decision system with an opportunity to appeal that decision for review by a natural person.

H-01.4

Bus. & Prof. Code § 22756.3

Governance program for algorithmic discrimination risk

DeployerDeveloper

(a)–(b) 8 A developer or a deployer shall establish, document, implement, and maintain a governance program that contains reasonable administrative and technical safeguards to govern the reasonably foreseeable risks of algorithmic discrimination associated with the use, or intended use, of a high-risk automated decision system. (b) The governance program required by this subdivision shall be appropriately designed with respect to all of the following: (1) The use, or intended use, of the high-risk automated decision system. (2) The size, complexity, and resources of the deployer or developer. (3) The nature, context, and scope of the activities of the deployer or developer in connection with the high-risk automated decision system. (4) The technical feasibility and cost of available tools, assessments, and other means used by a deployer or developer to map, measure, manage, and govern the risks associated with a high-risk automated decision system.

Section 22756.3 requires both developers and deployers to establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to manage algorithmic discrimination risk. The program must be appropriately designed considering the system's intended use, organizational size and complexity, the nature of the entity's activities, and the technical feasibility and cost of available risk management tools.

Compliance actions 1 item

Developers and deployers must establish, document, implement, and maintain a governance program containing reasonable administrative and technical safeguards to manage the reasonably foreseeable risks of algorithmic discrimination associated with high-risk automated decision systems. The governance program must be appropriately designed considering: (1) the system's use or intended use; (2) the entity's size, complexity, and resources; (3) the nature, context, and scope of the entity's activities in connection with the system; and (4) the technical feasibility and cost of available risk management tools.

G-01.1

Bus. & Prof. Code § 22756.4

Trade secret and privilege protection

A developer or deployer is not required to disclose information under this chapter if the disclosure of that information would result in the waiver of a legal privilege or the disclosure of a trade secret, as defined in Section 3426.1 of the Civil Code.

Section 22756.4 provides that developers and deployers are not required to disclose information under this chapter if disclosure would result in waiver of a legal privilege or disclosure of a trade secret. This is a savings clause that limits the reach of the chapter's disclosure obligations without creating an independent compliance duty.

Bus. & Prof. Code § 22756.5

Deployment restriction based on algorithmic discrimination findings

DeployerDeveloper

(a)–(b) 9 Except as provided in subdivision (b), a deployer or developer shall not deploy or make available for deployment a high-risk automated decision system if the impact assessment performed pursuant to this chapter determines that the high-risk automated decision system is likely to result in algorithmic discrimination. (b) (1) A deployer or developer may deploy or make available for deployment a high-risk automated decision system if the impact assessment performed pursuant to this chapter determines that the high-risk automated decision system will result in algorithmic discrimination if the deployer or developer implements safeguards to mitigate the known risks of algorithmic discrimination. (2) A deployer or developer acting under the exception provided by paragraph (1) shall perform an updated impact assessment to verify that the algorithmic discrimination has been mitigated and is not reasonably likely to occur.

Section 22756.5 establishes a conditional deployment prohibition: if an impact assessment determines a high-risk automated decision system is likely to result in algorithmic discrimination, the system may not be deployed or made available for deployment. An exception applies where the developer or deployer implements safeguards to mitigate the known risks, but in that case the entity must perform an updated impact assessment verifying that the algorithmic discrimination has been mitigated and is not reasonably likely to occur.

Compliance actions 1 item

Developers and deployers must not deploy or make available for deployment a high-risk automated decision system if its impact assessment determines the system is likely to result in algorithmic discrimination — unless the entity implements safeguards to mitigate the known risks of algorithmic discrimination and performs an updated impact assessment verifying that the discrimination has been mitigated and is not reasonably likely to occur.

H-02.3

Bus. & Prof. Code § 22756.6

Enforcement, penalties, and cure period

Developer

(a)(1)–(2) 10 A developer shall provide to the Attorney General or Civil Rights Department, within 30 days of a request from the Attorney General or the Civil Rights Department, a copy of an impact assessment performed pursuant to this chapter. (2) Notwithstanding any other law, an impact assessment provided to the Attorney General or Civil Rights Department pursuant to this subdivision shall be kept confidential.

(b)(1)–(4) The Attorney General or the Civil Rights Department may bring a civil action against a deployer or developer for a violation of this chapter and obtain any of the following relief: (1) (A) If a developer or deployer fails to conduct an impact assessment as required under this chapter, a civil penalty of two thousand five hundred dollars ($2,500) for a defendant with fewer than 100 employees, five thousand dollars ($5,000) if the defendant has fewer than 500 employees, and ten thousand dollars ($10,000) if the defendant has at least 500 employees. (B) If a violation is intentional, the civil penalty pursuant to this paragraph shall increase by five hundred dollars ($500) for each day that the defendant is noncompliant. (2) Injunctive relief. (3) Reasonable attorney's fees and costs. (4) If the violation concerns algorithmic discrimination, a civil penalty of twenty-five thousand dollars ($25,000) per violation.

(c)(1)–(2) Before commencing an action pursuant to this section, the Attorney General or the Civil Rights Department shall provide 45 days' written notice to a deployer or developer of any alleged violation of this chapter. (2) (A) The developer or deployer may cure, within 45 days of receiving the written notice described in paragraph (1), the noticed violation and provide an express written statement, made under penalty of perjury, that the violation has been cured. (B) If the developer or deployer cures the noticed violation and provides the express written statement pursuant to subparagraph (A), an action shall not be maintained for the noticed violation.

Section 22756.6 establishes the enforcement framework. Developers must provide impact assessments to the Attorney General or Civil Rights Department within 30 days of request; such assessments are kept confidential. The AG or CRD may bring civil actions for violations with tiered penalties: $2,500–$10,000 for failure to conduct an impact assessment (scaled by employee count), plus $500/day for intentional violations; $25,000 per violation for algorithmic discrimination. Injunctive relief and attorney's fees are also available. A 45-day pre-suit notice and cure period applies — if the violation is cured within 45 days and the entity provides a sworn written statement, the action shall not be maintained.

Compliance actions 1 item

Developers must provide to the Attorney General or Civil Rights Department, within 30 days of a request, a copy of any impact assessment performed under this chapter. Impact assessments provided under this subdivision must be kept confidential.

R-02.2

Bus. & Prof. Code § 22756.7

Exemptions

(a)–(b) This chapter does not apply to either of the following: (a) An entity with 50 or fewer employees. (b) A high-risk automated decision system that has been approved, certified, or cleared by a federal agency that complies with another law that is substantially the same or more stringent than this chapter.

Section 22756.7 provides two exemptions from the entire chapter: (a) entities with 50 or fewer employees, and (b) high-risk automated decision systems that have been approved, certified, or cleared by a federal agency that complies with another law substantially the same as or more stringent than this chapter. The federal-exemption clause effectively creates a preemption-style safe harbor for federally regulated systems.

Pub. Contract Code § 10285.8

State agency procurement restriction for high-risk automated decision systems

Government

(a)(1)–(3) 11 A state agency shall not award a contract for a high-risk automated decision system to a person who has violated any of the following: (1) The Unruh Civil Rights Act (Section 51 of the Civil Code). (2) The California Fair Employment and Housing Act (Chapter 7 (commencing with Section 12960) of Part 2.8 of Division 3 of Title 2 of the Government Code). (3) Chapter 24.6 (commencing with Section 22756) of Division 8 of the Business and Professions Code.

(b) As used in this section, "high-risk automated decision system" has the same meaning as defined in Section 22756 of the Business and Professions Code.

Section 10285.8, added to the Public Contract Code, prohibits state agencies from awarding contracts for high-risk automated decision systems to persons who have violated the Unruh Civil Rights Act, the California Fair Employment and Housing Act, or the new Chapter 24.6 of the Business and Professions Code (i.e., this bill). This procurement bar creates an additional enforcement incentive by conditioning government contracting eligibility on compliance with civil rights and automated-decision-system laws.

Compliance actions 1 item

State agencies must not award a contract for a high-risk automated decision system to any person who has violated the Unruh Civil Rights Act, the California Fair Employment and Housing Act, or the Automated Decision Systems chapter (Bus. & Prof. Code § 22756 et seq.).

PS-01.4

Public Sector Procurement restrictions · government use

1 item

PS-01.4

Human Oversight Decision review · appeal pathways

6 items

H-02.3

Beginning Jan 1, 2026 Developers must perform a formal impact assessment on each high-risk automated decision system before making it publicly available for use (for systems available on or after January 1, 2026). For systems first made publicly available before January 1, 2026, developers must perform an impact assessment upon making a substantial modification to the system.

H-02.3

Beginning Jan 1, 2026 Deployers must perform an impact assessment on each high-risk automated decision system within two years of deploying the system (for systems first deployed after January 1, 2026). A state-agency deployer may opt out of this requirement if it uses the system only for its intended use as determined by the developer, makes no substantial modification, the developer complies with the Public Contract Code procurement and confidential-submission requirements, the state agency has no reasonable basis to believe deployment is likely to result in algorithmic discrimination, and the state agency maintains a governance program under § 22756.3.

H-02.2