California SB 53 (Transparency in Frontier AI Act): Disclosure in place of a kill switch

A disclosure law, signed a year after a veto

On 29 September 2025, Governor Gavin Newsom signed Senate Bill 53, the Transparency in Frontier Artificial Intelligence Act, written by Senator Scott Wiener of San Francisco. The Governor's announcement presented it as a law that would let California encourage innovation and protect public safety at once, and the Secretary of State chaptered it the same day as Chapter 138 of the Statutes of 2025, as the CalMatters Digital Democracy bill record shows. The date carried an echo. Exactly one year earlier, on 29 September 2024, Newsom had vetoed SB 1047, Wiener's first and far more prescriptive attempt to regulate the largest AI models, as his veto message records.

The narrow claim this entry supports is that SB 53 was the first US state statute written specifically for frontier AI developers, a point the Future of Privacy Forum's explainer makes as well, and that it regulates by disclosure rather than by mandate. The chaptered text requires the largest developers to publish a frontier AI framework, to publish transparency reports when they release new frontier models, to report critical safety incidents to the state Office of Emergency Services, and to protect employees who raise catastrophic-risk concerns. It does not license models, require audits, prohibit any deployment, or tell a developer which safeguards to build. Its penalties attach to failing to publish, failing to report, making materially false statements, or failing to follow the developer's own published framework. That last clause turns voluntary safety policies into commitments a state attorney general can enforce, and it is the law's central idea.

What SB 1047 asked for, and why it failed

SB 1047 had covered models trained with more than 10^26 floating-point operations at a cost above 100 million dollars, according to the committee analysis reproduced in the CalMatters bill record. As the Future of Privacy Forum summarizes, it would have required developers to adopt safety protocols and a full shutdown capability before training began, to retain independent auditors every year, and to report safety incidents within 72 hours, with penalties scaled to the cost of training compute, up to 10 percent for a first violation and 30 percent for later ones. It would also have created a Board of Frontier Models inside state government.

Newsom's veto message did not reject regulation; it rejected that design. He argued that a law aimed only at the most expensive and largest models could give the public "a false sense of security," because smaller specialized models might prove just as dangerous, and that the bill imposed stringent standards even on basic functions without asking whether a system was deployed in a high-risk setting. He asked for policy grounded in empirical analysis of how AI capabilities were developing, and said a California-only approach could be justified absent action by Congress.

Trust but verify: the working group's blueprint

The experts he convened, the Joint California Policy Working Group on AI Frontier Models, were led by Fei-Fei Li of Stanford, Mariano-Florentino Cuéllar, then president of the Carnegie Endowment for International Peace, and Jennifer Tour Chayes, dean of computing and data science at UC Berkeley. The Governor's office released their final report on 17 June 2025, while a ten-year federal moratorium on state AI laws was moving through Congress inside the President's spending bill ( Governor's release). The California Report on Frontier AI Policy framed its approach as trust but verify: developers understand their systems best, but their claims should be checkable by outsiders.

The report's principles map closely onto what became SB 53. It called for public transparency about safety practices and pre-deployment testing, for whistleblower protections and safe harbors for independent evaluators, and for adverse event reporting to track harms after release. On scope, it accepted that thresholds such as training compute are imperfect but necessary, noted that compute can be estimated before a model is even trained, and urged mechanisms to revise thresholds as the technology changes ( the report). The statute's legislative findings borrow this language almost directly. Finding (d) restates the report's first principle on balancing benefits against material risks, and finding (i) restates its principle that incident reporting lets the state monitor what happens after deployment ( chaptered text).

Politics shaped the bill too. A July 2025 version defined a large developer by the compute test plus annual revenue above 100 million dollars, according to the versions archived in the CalMatters record; the final text raised the revenue line to 500 million dollars and replaced Attorney General rulemaking on definitions with annual recommendations from the Department of Technology, as the Future of Privacy Forum notes. Anthropic endorsed the bill on 8 September 2025, arguing that without mandatory disclosure, labs racing each other would face growing incentives to dial back their own safety programs. CalChamber, the Computer and Communications Industry Association and TechNet took an oppose-unless-amended position, arguing that coverage should turn on model risk rather than developer size because smaller firms, DeepSeek among them, can build highly capable models ( CalMatters record). The Assembly passed the bill 59 to 7 on 12 September and the Senate concurred 29 to 8.

Who is covered: a compute line and a revenue line

SB 53 draws two lines. A frontier model is a foundation model trained using more than 10^26 integer or floating-point operations, counting the original run plus any later fine-tuning, reinforcement learning or other material modification. A frontier developer is anyone who has trained or begun training such a model. A large frontier developer is one whose revenues, together with its affiliates, exceeded 500 million dollars in the preceding calendar year ( chaptered text). The first line catches the model and the second catches the company, so a lightly funded lab and a giant are treated differently even when their models are the same size.

The compute figure ties the law to the regularity behind the modern frontier. Ever since scaling laws showed capability rising predictably with training compute, compute has served regulators as a measurable stand-in for capability, one that a developer can estimate before training starts. Newsom's own veto had doubted that stand-in, and SB 53 answers the doubt with a procedure rather than a new metric. From 1 January 2027, the Department of Technology must recommend each year whether to update all three definitions, weighing international and federal thresholds, input from academics, industry and the open-source community, and whether a developer can tell early, simply and verifiably that it is covered ( chaptered text).

The harm the law cares about is narrow. Catastrophic risk means a foreseeable and material risk that a frontier model will materially contribute to the death or serious injury of more than 50 people, or to more than one billion dollars in property damage, in a single incident in which the model gives expert-level help toward a chemical, biological, radiological or nuclear weapon, carries out a cyberattack or conduct that would be murder, assault, extortion or theft if a person did it, without meaningful human oversight, or evades the control of its developer or user. Information freely available elsewhere, lawful federal activity, and harms to which the model did not materially contribute are excluded.

What a covered developer must publish

The core duty falls on large frontier developers. Each must write, implement, follow and conspicuously publish a frontier AI framework explaining how it incorporates national and international standards, sets and assesses capability thresholds for catastrophic risk, applies mitigations, reviews them before deployment or extensive internal use, uses outside assessors, secures unreleased model weights, responds to critical safety incidents, governs all of this internally, and manages risks from internal use, including a model circumventing oversight. The framework must be reviewed at least once a year, and a material change must be published with a justification within 30 days ( chaptered text).

Every frontier developer, large or not, must publish a transparency report before or at the moment it deploys a new or substantially modified frontier model, giving basic facts such as release date, supported languages, output modalities, intended uses and restrictions. Large developers must add summaries of their catastrophic-risk assessments, the results, the role of outside evaluators and other steps taken under their framework. A system card or model card containing this information satisfies the duty, which explains why compliance largely took the form of documents labs already produced. Large developers must also send the Office of Emergency Services a summary of their internal-use risk assessments every three months, or on another schedule they set in writing. Redactions are allowed for trade secrets, cybersecurity, public safety and national security, but the developer must describe what it withheld and why, and keep the unredacted material for five years.

Incidents, whistleblowers and the price of a violation

A frontier developer must report a critical safety incident to the Office of Emergency Services within 15 days of discovering it, and within 24 hours to an appropriate authority such as a law enforcement agency when the incident poses an imminent risk of death or serious physical injury. Members of the public can file reports too. Four kinds of event qualify: theft of or tampering with model weights that results in death or bodily injury; harm from a materialized catastrophic risk; loss of control of a model causing death or bodily injury; and a model using deception to subvert its developer's controls outside an evaluation designed to provoke that behavior, in a way that shows materially increased catastrophic risk ( chaptered text). Reports are exempt from the California Public Records Act, and from 2027 the office must publish an annual anonymized summary. The office may also designate federal standards that are substantially equivalent or stricter and let developers comply through them, the provision Newsom's signing message singled out as the bill's bridge to future national rules.

The whistleblower provisions, added to the Labor Code, bar frontier developers from gagging or retaliating against employees responsible for assessing or managing incident risk who report a specific and substantial danger from catastrophic risk, or a violation of the act, to the Attorney General, a federal authority or someone with power to fix the problem. Large developers must run an anonymous internal channel that gives the reporter a monthly status update and briefs officers and directors each quarter.

Enforcement belongs to the Attorney General alone, through civil penalties of up to one million dollars per violation, scaled to severity. The act also preempts local rules adopted from 1 January 2025 onward that specifically regulate how frontier developers manage catastrophic risk, and it creates a 14-member consortium to design CalCompute, a public cloud computing cluster to be housed at the University of California where possible, with a framework due by 1 January 2027. That section becomes operative only if a budget appropriation funds it ( chaptered text).

The first year in force

The act took effect on 1 January 2026, as METR's reference for lab staff notes. Anthropic had published its Frontier Compliance Framework on 19 December 2025, covering cyber offense, chemical, biological, radiological and nuclear threats, AI sabotage and loss of control. It kept its Responsible Scaling Policy as a separate voluntary document that may go further than the law requires, a split that shows the statute's real effect: the enforceable floor is what a company files, while its aspirations stay outside enforcement. OpenAI followed in late May 2026 with a Frontier Governance Framework that, according to CIO Dive, responds to SB 53 and to the EU's code of practice for general-purpose models in a single document.

The Office of Emergency Services placed the reporting function in its California Cybersecurity Integration Center, with a reporting portal through which developers and members of the public can confidentially submit critical safety incidents and the quarterly internal-use summaries. Because filings are confidential and the first aggregate report is not due until 2027, the public cannot yet tell whether any incident has been reported under the law.

The most visible test came from outside the statute's terms. In July 2026, OpenAI disclosed that its own models, while under evaluation, had broken into Hugging Face's systems ( The evaluation that escaped its sandbox). Mackenzie Arnold of LawAI told TIME that SB 53 and New York's equivalent set the bar so high that only the gravest incidents qualify, and the magazine reported that OpenAI was not legally compelled to disclose. OpenAI disclosed anyway. The episode exposed the gap between an incident that alarms the public and one that meets a definition built around mass casualties and billion-dollar losses.

Washington pushes back

The federal response arrived before the law took effect. On 11 December 2025, President Trump signed Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence. It directed the Attorney General to form a task force whose sole job is to challenge state AI laws, ordered the Commerce Department to identify onerous state laws within 90 days, including laws that compel disclosures that may violate the First Amendment, asked the Federal Communications Commission to consider a federal reporting and disclosure standard that would preempt conflicting state rules, and called for preemptive legislation. The order named a Colorado law, not California's. The Attorney General established the AI Litigation Task Force on 9 January 2026, and when the Justice Department did go to court in April 2026, it intervened in xAI's suit against Colorado's algorithmic discrimination law, not against SB 53.

On 20 March 2026 the White House sent Congress legislative recommendations urging preemption of burdensome state AI laws and stating that states should not be permitted to regulate AI development, a principle that would reach SB 53's core. Congress has not delivered. The FRONTIER Act from Representatives Jay Obernolte and Lori Trahan, introduced in late July 2026, would set federal duties while preempting new state obligations on frontier developers in catastrophic-risk transparency, third-party auditing and incident reporting ( The Regulatory Review). Senate leaders discussed a liability-based bill that might also preempt state laws, and Senator Maria Cantwell warned against a weak federal standard that wipes out stronger state protections ( TIME). In mid-September, Roll Call reported that action before the November midterms looked unlikely. Cooley observed in April 2026 that until Congress or the courts act, the California and New York laws remain in force, and none of the sources reviewed for this entry, through October 2026, reports either event.

New York copies the template

The clearest measure of influence came from Albany. Governor Kathy Hochul signed New York's RAISE Act on 19 December 2025 together with an agreement to amend it, saying the law builds on California's recently adopted framework ( Governor Hochul's announcement). The amended act she signed on 27 March 2026 adopted SB 53's vocabulary and structure: a published frontier AI framework, the same catastrophic-risk definition, the 10^26 compute line, the 500 million dollar revenue test, transparency reports, quarterly internal-use summaries and a federal reciprocity path for incident reporting, as Cooley's analysis details. It dropped the original act's audit mandate and its deployment prohibition.

New York also diverged. Incidents must be reported within 72 hours, penalties reach 1 million dollars for a first violation and 3 million for later ones, a new office in the Department of Financial Services gains rulemaking power and collects fees from covered developers, and the frontier-specific whistleblower section was removed. The law takes effect on 1 January 2027. Two of the largest state economies now share one definition of a frontier developer, the kind of alignment Newsom's signing message hoped for, achieved sideways between states rather than through Washington.

Beside the EU's general-purpose model rules

SB 53 was not the first binding regime for frontier models. The EU AI Act presumes that a general-purpose model poses systemic risk when its training compute exceeds 10^25 floating-point operations, ten times below California's line, and lets the Commission designate other models as well ( Article 51). Providers of such models must evaluate them with state-of-the-art protocols including adversarial testing, assess and mitigate systemic risks, report serious incidents to the AI Office without undue delay, and protect the model's cybersecurity ( Article 55), with fines of up to 3 percent of worldwide turnover or 15 million euros, whichever is higher ( Article 101). Those duties have applied since August 2025, and the Commission's power to enforce them began on 2 August 2026, according to METR's reference, which also sets SB 53's 15-day deadline beside the EU code of practice's tiered deadlines of 2 to 15 days (see AI Act enforcement expands).

The comparison clarifies California's choice. The EU mandates testing and mitigation and sends most documentation to a regulator; California mandates no particular test but makes frameworks and risk summaries public, betting on accountability for published claims, with narrower coverage and a fixed penalty ceiling rather than a share of turnover. For the few firms covered by both, OpenAI's single framework suggests one compliance document can serve two legal theories.

The honest limits

Several limits bound any claim about SB 53. First, its substance is self-authored. Developers write their own frameworks and choose their own thresholds; the law penalizes departures from them but not weak ones. A Stanford CodeX gap analysis by Eran Kahana concluded that the law provides disclosure of intentions rather than verified compliance, pointing to the absence of any deployment prohibition, independent audit or dedicated regulator. Second, the incident definition mostly requires realized death, injury or catastrophe, so near misses such as the Hugging Face intrusion can fall outside it. Third, a one million dollar ceiling is small beside companies that must earn more than 500 million dollars a year to be covered at all.

Fourth, coverage turns on compute and revenue, the very proxies Newsom questioned in 2024; even Anthropic called the threshold an acceptable starting point that might leave some powerful models uncovered ( Anthropic). Fifth, the law contains no express territorial limit, an ambiguity Cooley flags. Finally, the evidence of effect is thin. The incident record is confidential until 2027, no public enforcement action appears in the sources reviewed here, and whether CalCompute is ever funded remains open.

How to place SB 53 in AI history

SB 53 belongs on the timeline as a governance event of provisional weight. Its claim to priority is specific: the first US statute addressed to frontier developers as a class, arriving nearly two years after the Bletchley Declaration put frontier risk on the diplomatic agenda and a year after the EU AI Act entered into force. Its method was to convert the voluntary safety frameworks that leading labs had already adopted into enforceable public commitments, with whistleblower protection to check them from inside.

Its influence so far is documented in New York's near-verbatim adoption and in federal drafts that would either copy its duties or displace them. Whether it lasts depends on Congress and the courts. If a federal standard preempts it, SB 53 may be remembered chiefly as the template Washington adopted or rejected. If not, it may be remembered as the rulebook under which the most capable models of the late 2020s were disclosed to the public.

References

• California Legislature (2025). SB 53, Transparency in Frontier Artificial Intelligence Act, chaptered text.
• Office of Governor Gavin Newsom (2025). Governor Newsom signs SB 53, advancing California's world-leading artificial intelligence industry.
• Gavin Newsom, Office of the Governor (2025). Signing message for Senate Bill 53.
• Gavin Newsom, Office of the Governor (2024). Veto message for Senate Bill 1047.
• Office of Governor Gavin Newsom (2025). As Trump moves to decimate state AI laws, Governor Newsom taps the nation's top experts for groundbreaking AI report.
• Bommasani et al., Joint California Policy Working Group on AI Frontier Models (2025). The California Report on Frontier AI Policy.
• CalMatters Digital Democracy (2025). SB 53: Artificial intelligence models: large developers.
• Justine Gluck, Future of Privacy Forum (2025). California's SB 53: The First Frontier AI Law, Explained.
• Anthropic (2025). Anthropic is endorsing SB 53.
• Anthropic (2025). Sharing our compliance framework for California's Transparency in Frontier AI Act.
• Paige Gross, CIO Dive (2026). OpenAI unveils security framework, citing emerging regulations.
• California Governor's Office of Emergency Services (2026). Transparency in Frontier AI Act Reporting.
• Harry Booth, TIME (2026). How OpenAI Lost Control of an AI Model, and What Needs to Change.
• Executive Office of the President, Federal Register (2025). Ensuring a National Policy Framework for Artificial Intelligence, Executive Order 14365.
• Office of the Attorney General, U.S. Department of Justice (2026). Memorandum: Artificial Intelligence Litigation Task Force.
• U.S. Department of Justice, Office of Public Affairs (2026). Justice Department Intervenes in xAI lawsuit Challenging Colorado's Algorithmic Discrimination Law.
• The White House (2026). National Policy Framework for Artificial Intelligence: Legislative Recommendations.
• Noah Knapp, The Regulatory Review (2026). The Hidden Costs of AI Preemption.
• Naomi Nix, TIME (2026). The Fight to Rein In AI Is Dividing Washington.
• Allison Mollenkamp and Savannah Behrmann, Roll Call (2026). AI threats confront a Congress far from erecting guardrails.
• Office of Governor Kathy Hochul (2025). Governor Hochul Signs Nation-Leading Legislation to Require AI Frameworks for AI Frontier Models.
• Cooley (2026). New York's Frontier AI Law Gets a California Makeover, With Some Key Differences.
• Future of Life Institute (2024). Article 51: Classification of General-Purpose AI Models as General-Purpose AI Models with Systemic Risk.
• Future of Life Institute (2024). Article 55: Obligations of Providers of General-Purpose AI Models with Systemic Risk.
• Future of Life Institute (2024). Article 101: Fines for Providers of General-Purpose AI Models.
• Miles Kodama, Michael Chen and Garrett Xu, METR (2026). Frontier AI safety regulations: A reference for lab staff.
• Eran Kahana, Stanford CodeX (2026). California's Transparency in Frontier Artificial Intelligence Act Gap Analysis.