California SB 53: requirements, deadlines and compliance actions

Large frontier developers must publish and maintain a framework describing how they incorporate national and international standards, assess catastrophic risk, apply mitigations, secure model weights, and govern internal processes, and must review it at least annually.

Practical action: Publish a safety framework and keep a change log of revisions.

Evidence examples: Published frontier AI framework

Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 1.x; NIST AI 600-1

Open the obligation page →Business and Professions Code, Chapter 25.1 (as added by SB 53) Source-linked (a factual check against the official source, not a legal review)

Frontier developers must report critical safety incidents to the California Office of Emergency Services within the statutory time limit after discovery, and the Office is to establish a reporting mechanism.

Practical action: Define critical-safety-incident criteria and an escalation path with the statutory clock.

Evidence examples: Incident classification and reporting procedure

Framework mapping (original, editorial): NIST AI RMF 1.0 MANAGE 4.3

Open the obligation page →Business and Professions Code, Chapter 25.1 (as added by SB 53) Source-linked (a factual check against the official source, not a legal review)

Before or at the time a frontier developer deploys a new frontier model, or a substantially modified version, it must publish a transparency report on its website describing the model, its intended uses and restrictions, the release date and modalities, and how to contact the developer. A large frontier developer must add a summary of its catastrophic-risk assessment for the model, the results, any third-party evaluators involved and the steps taken under its frontier AI framework, with trade-secret and security redactions explained.

Practical action: Attach a model-release transparency report to the launch checklist, with a redaction log for withheld details.

Evidence examples: Published model transparency report; Redaction justification log

Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 4.2, MAP 5.1, MEASURE 2.6; ISO/IEC 42001:2023 Annex A.8.2, A.8.3

Open the obligation page →Business and Professions Code Section 22757.12 (as added by SB 53) Verified 26 Sep 2026 (a factual check against the official source, not a legal review)

A large frontier developer must transmit to the California Office of Emergency Services, on the periodic schedule the statute sets, a summary of any assessment of catastrophic risk that results from the internal use of its frontier models. This covers risks arising before public deployment, such as during internal evaluation or use of the model to accelerate research, and complements the public transparency report.

Practical action: Schedule a recurring internal-use risk assessment and a state submission with a fixed owner in the safety team.

Evidence examples: Internal-use catastrophic risk assessment summary sent to the Office of Emergency Services

Framework mapping (original, editorial): NIST AI RMF 1.0 MEASURE 2.6, MANAGE 1.2, GOVERN 4.3; ISO/IEC 42001:2023 Clause 9.1; Annex A.8.3

Open the obligation page →Business and Professions Code Section 22757.12 (as added by SB 53) Verified 26 Sep 2026 (a factual check against the official source, not a legal review)

A frontier developer must not adopt rules or take action that prevent or retaliate against a covered employee for disclosing to the Attorney General, a federal authority, a manager or another employee with authority that the developer's activities pose a specific and substantial danger to public health or safety from catastrophic risk, or that it has violated the Act. Covered employees must be given clear notice of these rights, and large frontier developers must run an anonymous internal reporting process with regular updates to the reporter and to officers and directors.

Practical action: Publish a whistleblower policy covering catastrophic-risk concerns, stand up an anonymous channel and brief managers on the anti-retaliation rule.

Evidence examples: Whistleblower policy and employee notice; Anonymous reporting channel records

Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 4.1, GOVERN 4.3; ISO/IEC 42001:2023 Clause 5.1, 7.4; Annex A.3.2

Open the obligation page →Labor Code Section 1107 (as added by SB 53) Verified 26 Sep 2026 (a factual check against the official source, not a legal review)