Bill > SB468

This bill establishes new requirements for businesses that deploy high-risk artificial intelligence (AI) systems processing personal information, creating a comprehensive duty to protect consumer data. Specifically, covered deployers must develop, implement, and maintain a detailed information security program with extensive safeguards tailored to their business size, resources, and data volume. The program must include multiple layers of protection, such as designating employee security managers, conducting risk assessments, providing ongoing employee training, implementing access controls, encrypting sensitive data, using secure authentication protocols, monitoring systems for unauthorized access, and maintaining current cybersecurity protections. The bill requires annual reviews of security measures, documentation of security incidents, and mandates that third-party service providers also maintain appropriate security standards. Violations of these provisions would be considered a deceptive trade practice under California's Unfair Competition Law, potentially subjecting businesses to legal penalties. The California Privacy Protection Agency is authorized to adopt regulations to implement these requirements, with the underlying goal of protecting consumers' privacy rights in the context of increasingly sophisticated AI technologies. The legislation explicitly aims to further the purposes of the California Privacy Rights Act of 2020 by providing additional protections for personal information processed by high-risk AI systems.

Budget and Finance, Justice

https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260SB468