Page 1


Date of Hearing: July 2, 2024

ASSEMBLY COMMITTEE ON JUDICIARY

Ash Kalra, Chair

SB 1047 (Wiener) – As Amended June 20, 2024


As Proposed to be Amended

**SENATE VOTE: 32-1**

**SUBJECT: SAFE AND SECURE INNOVATION FOR FRONTIER ARTIFICIAL**
INTELLIGENCE MODELS ACT

**KEY ISSUES:**


1) SHOULD A DEVELOPER OF AN ARTIFICIAL INTELLIGENCE (AI) “COVERED

MODEL” BE REQUIRED TO TAKE SPECIFIC ACTIONS IN ORDER TO MITIGATE
THE RISK OF CATASTROPHIC HARMS FROM THEIR MODELS; AND SHOULD
CIVIL PENALTIES BE IMPOSED FOR VIOLATIONS OF THESE REQUIREMENTS?

2) SHOULD EMPLOYEES OF DEVELOPERS OF COVERED MODELS AND

EMPLOYEES OF THE NEWLY CREATED FRONTIER MODEL DIVISION, LIKE ALL
PRIVATE AND PUBLIC EMPLOYEES, BE PROTECTED FROM RETALIATION
WHEN REPORTING ILLEGAL AND DANGEROUS ACTS AT THEIR WORKPLACES;
AND SHOULD THESE WHISTLEBLOWER PROTECTIONS BE SPECIFIC TO AI?

**SYNOPSIS**

_The rapid advancement of AI technologies brings both unprecedented opportunities and_
_significant challenges. The enormous computational power required to develop advanced AI_
_models unfortunately also poses significant risks. As developers push the boundaries of AI_
_capabilities, the potential for unintended consequences grows. Models trained with vast amounts_
_of data and computational resources can develop behaviors that are difficult to predict and_
_control. This unpredictability, coupled with the high stakes involved, underscores the necessity_
_for stringent oversight and safety protocols. The State of California, being a global hub for_
_technology and innovation, has a unique opportunity and responsibility to lead in the regulation_
_and safe development of AI._

_Seeking to protect California and humanity from the very serious but not fully understood future_
_harms of Artificial Intelligence, this well-intentioned and ambitious measure, co-sponsored by_
_the Center for AI Safety Action Fund, Economic Security California Action, and Encode Justice,_
_establishes a scheme of regulatory guardrails and oversight of AI developers and their “covered_
_models.” By creating the Frontier Model Division (Division) within the California Department_
_of Technology, the bill seeks to ensure continuous oversight and enforcement of these protocols._
_The Division would also oversee third-party audits and annual compliance certifications,_
_enhancing accountability. Additionally, the bill authorizes the Attorney General to take civil_
_action against non-compliant entities, imposing penalties and ordering the deletion of hazardous_
_AI models if necessary. These provisions collectively work to mitigate the risks of AI misuse by_
_non-state actors, such as terrorists and cybercriminals, thereby safeguarding public safety and_
_national security_


-----

Page 2

_The vast majority of these provisions are outside the jurisdiction of this Committee. Relating to_
_this Committee’s jurisdiction, the bill imposes civil penalties for violations of its provisions;_
_provides whistleblower rights under the California Whistleblower Protection Act to employees of_
_the Division and employees of developers of covered models; and requires the Division to_
_provide guidance to the Judicial Council for the future development of jury instructions to be_
_used in civil actions to enforce the bill’s provisions. The author proposes numerous amendments_
_to clarify these aspects of the bill, as well as clarifying amendments regarding the bill’s_
_definition of “critical harm” and auditing requirements. The amendments are included in the_
_SUMMARY, below, and explained in the analysis._

_The bill is supported and opposed by dozens of organizations, companies, and academics_
_working in AI and technology. It recently was approved by the Assembly Committee on Privacy_
_and Consumer Protection by a vote of eight to zero._

**SUMMARY: Requires a developer of an Artificial Intelligence (AI) “covered model” to take**
specific actions in order to mitigate the risk of catastrophic harms from such models; imposes
civil penalties for violations; and provides whistleblower rights to employees of the Frontier
Model Division and employees of developers of covered models. Specifically, this bill:

1) Defines the following:

a) “Advanced persistent threat” means an adversary with sophisticated levels of expertise

and significant resources that allow it, through the use of multiple different attack
vectors, including, but not limited to, cyber, physical, and deception, to generate
opportunities to achieve its objectives that are typically to establish and extend its
presence within the information technology infrastructure of organizations for purposes
of exfiltrating information or to undermine or impede critical aspects of a mission,
program, or organization or place itself in a position to do so in the future.

b) “Artificial intelligence” means an engineered or machine based system that varies in its

level of autonomy and that can, for explicit or implicit objectives, infer from the input it
receives how to generate outputs that can influence physical or virtual environments.


c) “Artificial intelligence safety incident” means an incident that demonstrably increases the

risk of a critical harm occurring by means of any of the following:

i) A covered model autonomously engaging in behavior other than at the request of a

user.

ii) Theft, misappropriation, malicious use, inadvertent release, unauthorized access, or

escape of the model weights of a covered model.


iii) The critical failure of technical or administrative controls, including controls limiting

the ability to modify a covered model.

iv) Unauthorized use of a covered model to cause or enable a critical harm.

d) “Fine-tuning” to mean adjusting the model weights of a trained model by exposing it to

additional data.


-----

Page 3


2) Before Jan. 1, 2027, defines “covered model” to mean either of the following:

a) An artificial intelligence model trained using a quantity of computing power greater than

10^26 integer or floating-point operations, the cost of which exceeds $100 million dollars
when calculated using the average market price of cloud compute at the start of training
as reasonably assessed by the developer.


b) An artificial intelligence model created by fine-tuning a covered model using a quantity

of computing power equal to or greater than 3 times 10^25 integer or floating-point
operations.

3) On and after Jan. 1, 2027, defines “covered model” to mean either of the following:

a) An artificial intelligence model trained using a quantity of computing determined by the

Frontier Model Division, the cost of which exceeds $100 million dollars when calculated
using the average market price of cloud compute at the start of training as reasonably
assessed by the developer.


b) An artificial intelligence model created by fine-tuning a covered model using a quantity

of computing power that exceeds a threshold determined by the Frontier Model Division.

4) Defines the following:

a) “Post-training modification” to mean modifying the capabilities of a covered model by

any means, including, but not limited to, fine-tuning, providing the model with access to
tools or data, removing safeguards against hazardous misuse or misbehavior of the
model, or combining the model with, or integrating it into, other software.

b) “Covered model derivative” to mean any of the following:

i) An unmodified copy of a covered model.


ii) A copy of a covered model that has been subjected to post-training modifications

unrelated to fine-tuning.

iii) Before January 1, 2027, a copy of a covered model that has been fine-tuned using a

quantity of computing power not exceeding 3 times 10^25 integer or floating-point
operations.


iv) On and after January 1, 2027, a copy of a covered model that has been fine-tuned

using a quantity of computing power not exceeding a threshold determined by the
Frontier Model Division.


c) “Developer” means a person that performs the initial training of a covered model either

by training a model using a sufficient quantity of computing power, or by fine-tuning an
existing model using a sufficient quantity of computing power.

d) “Critical harm” means any of the following:

i) The creation or use of a chemical, biological, radiological, or nuclear weapon in a

h l i l i


-----

Page 4

ii) Mass casualties or at least five hundred million dollars ($500,000,000) of damage

resulting from cyberattacks on critical infrastructure by a model providing precise
instructions for conducting a cyberattack or series of cyberattacks on critical
infrastructure.

iii) Mass casualties or at least five hundred million dollars ($500,000,000) of damage

resulting from an artificial intelligence model engaging in conduct that both:

A. Acts with limited human oversight, intervention, or supervision.


B. Results in death, great bodily injury, property damage, or property loss, and

would, if committed by a human, constitute a crime specified in the Penal Code
that requires intent, recklessness, or gross negligence, or the solicitation or aiding
and abetting of such a crime.

iv) Other grave harms to public safety and security that are of comparable severity to the

harms described in i) – iii).

5) Clarifies that “critical harm” does not include either of the following:


a) Harms caused or enabled by information that a covered model outputs if the information

is otherwise publicly accessible from sources other than a covered model.

b) Harms caused or materially enabled by a covered model combined with other software

(including other models) if the covered model did not materially contribute to the other
software’s ability to cause or materially enable the harm.


6) Provides that on and after January 1, 2026, the dollar amounts specified in 4) shall be

adjusted annually for inflation to the nearest one hundred dollars ($100) based on the change
in the annual California Consumer Price Index for All Urban Consumers published by the
Department of Industrial Relations for the most recent annual period ending on December 31
preceding the adjustment.

7) Defines the following terms:

a) “Critical infrastructure” means assets, systems, and networks, whether physical or virtual,

the incapacitation or destruction of which would have a debilitating effect on physical
security, economic security, public health, or safety in the state.


b) “Frontier Model Division” means the Frontier Model Division created pursuant to

Section 11547.6 of the Government Code.

c) “Full shutdown” means the cessation of operation of any of the following:

i) The training of a covered model.

ii) A covered model.

iii) All covered model derivatives controlled by a developer.


-----

Page 5

f) “Model weight” means a numerical parameter in an artificial intelligence model that is

adjusted through training and that helps determine how inputs are transformed into
outputs.


g) “Open-source artificial intelligence model” means an artificial intelligence model that is

made freely available and that may be freely modified and redistributed.

h) “Person” means an individual, proprietorship, firm, partnership, joint venture, syndicate,

business trust, company, corporation, limited liability company, association, committee,
or any other nongovernmental organization or group of persons acting in concert.

i) “Reasonable assurance” does not mean full certainty or practical certainty.

j) “Safety and security protocol” means documented technical and organizational protocols

that meet both of the following criteria:


i) The protocols are used to manage the risks of developing and operating covered

models across their life cycle, including risks posed by causing or enabling or
potentially causing or enabling the creation of covered model derivatives.

ii) The protocols specify that compliance with the protocols is required in order to train,

operate, possess, and provide external access to the developer’s covered model.

8) Requires that before a developer initially trains a covered model, they do all of the following:


a) Implement administrative, technical, and physical cybersecurity protections to prevent

unauthorized access to, misuse of, or unsafe post-training modifications of, the covered
model and all covered model derivatives controlled by the developer that are appropriate
in light of the risks associated with the covered model, including from advanced
persistent threats or other sophisticated actors.

b) Implement the capability to enact a full shutdown.

c) Implement a written safety and security protocol that does all of the following:

i) If a developer complies with the safety and security protocol, provides reasonable

assurance that the developer will not produce a covered model or covered model
derivative that poses an unreasonable risk of causing or enabling a critical harm.


ii) States compliance requirements in an objective manner and with sufficient detail and

specificity to allow the developer or a third party to readily ascertain whether the
requirements of the safety and security protocol have been followed.

iii) Identifies specific tests and test results that would be sufficient to provide reasonable

assurance of both of the following:

A) That a covered model does not pose an unreasonable risk of causing or enabling a

critical harm.


B) That covered model derivatives do not pose an unreasonable risk of causing or

bli i i l h


-----

Page 6


iv) Describes in detail how the testing procedure assesses the risks associated with post
training modifications.

v) Describes in detail how the testing procedure addresses the possibility that a covered

model can be used to make post-training modifications or create another covered
model in a manner that may generate hazardous capabilities.

vi) Provides sufficient detail for third parties to replicate the testing procedure.

vii) Describes in detail how the developer will fulfill their obligations under this chapter.


viii) Describes in detail how the developer intends to implement the safeguards and

requirements referenced in this section.

ix) Describes in detail the conditions under which a developer would enact a full

shutdown.


x) Describes in detail the procedure by which the safety and security protocol may be

modified.


xi) Ensure that the safety and security protocol is implemented as written, including by

designating senior personnel to be responsible for ensuring compliance by employees
and contractors working on a covered model, monitoring and reporting on
implementation.

xii) Provide a copy of the safety and security protocol to the Frontier Model Division.

xiii) Conduct an annual review of the safety and security protocol to account for any

changes to the capabilities of the covered model and industry best practices and, if
necessary, make modifications to the policy.


xiv) If the safety and security protocol is modified, provide an updated copy to the Frontier

Model Division within 10 business days.


xv) Implement other reasonable measures to prevent covered models and covered model

derivatives from posing unreasonable risks of causing or enabling critical harms.

9) Requires that before using a covered model or covered model derivative, or making a

covered model or covered model derivative available for commercial or public use, the
developer do all of the following:

a) Assess whether the covered model is reasonably capable of causing a critical harm.


b) Implement reasonable safeguards to prevent a covered model or associated covered

model derivatives from causing a critical harm.


c) Ensure, to the extent reasonably possible, that the actions of covered models and covered

model derivatives can be attributed to them.

10) Prohibits a developer from using a covered model or covered model derivative commercially

bli l ki d d l d d l d i ti il bl f


-----

Page 7

commercial or public use, if there is an unreasonable risk that the covered model or covered
model derivative can cause or enable a critical harm.

11) Requires a developer of a covered model to annually reevaluate the procedures, policies,

protections, capabilities, and safeguards implemented pursuant to this section.


12) Requires, beginning January 1, 2028, a developer of a covered model to annually retain a

third-party auditor that conducts audits consistent with best practices for auditing to perform
an independent audit of compliance with the requirements of the bill.

13) Requires the auditor to produce an audit report including all of the following:

a) A detailed assessment of the developer’s steps to comply with the requirements of this

section.

b) If applicable, any identified instances of noncompliance with the requirements of this

section, and any recommendations for how the developer can improve its policies and
processes for ensuring compliance with the requirements of this section.


c) A detailed assessment of the developer’s internal controls, including its designation and

empowerment of senior personnel responsible for ensuring compliance by the developer,
its employees, and its contractors.

d) The signature of the lead auditor certifying the results of the auditor.

14) Requires a developer of a covered model to annually submit to the Frontier Model Division a

certification under penalty of perjury of compliance with the requirements of the bill signed
by the chief technology officer, or a more senior corporate officer, in a format and on a date
as prescribed by the Frontier Model Division. This paragraph applies as long as the covered
model or any covered model derivatives controlled by the developer remain in commercial or
public use, or remain available for commercial or public use.


15) Requires, in a certification submitted pursuant to 14), a developer to specify or provide, at a

minimum, all of the following:

a) The nature and magnitude of critical harms that the covered model or covered model

derivatives may reasonably cause or enable, and the outcome of the assessment required
by 9a), above.


b) An assessment of the risk that compliance with the safety and security protocol may be

insufficient to prevent the covered model or covered model derivatives from causing or
enabling critical harms.

c) A description of the process used by the signing officer to verify compliance with the

requirements of this section, including a description of the materials reviewed by the
signing officer, a description of testing or other evaluation performed to support the
certification, and the contact information of any third parties relied upon to validate
compliance.

d) Beginning January 1, 2028, the most recent audit report.


-----

Page 8

16) Requires a developer of a covered model to report each artificial intelligence safety incident

affecting the covered model, or any covered model derivatives controlled by the developer,
to the Frontier Model Division within 72 hours of the developer learning of the artificial
intelligence safety incident, or within 72 hours of the developer learning facts sufficient to
establish a reasonable belief that an artificial intelligence safety incident has occurred.

17) Requires a developer to submit to the Frontier Model Division, under penalty of perjury, a

certification of compliance with the requirements of this section no more than 30 days after
making a covered model or covered model derivative available for commercial or public use
for the first time. A developer need not submit a certification for a covered model derivative
if the developer has already submitted a certification for the applicable covered model.


18) Provides that in fulfilling their obligations under this chapter, a developer shall consider

applicable guidance from the Frontier Model Division, National Institute of Standards and
Technology, and other reputable standard-setting organizations.

19) Requires a person that operates a computing cluster to implement written policies and

procedures to do all of the following when a customer utilizes computer resources sufficient
to train a covered model:


a) Obtain a prospective customer’s basic identifying information and business purpose for

utilizing the computing cluster, including all of the following:

i) The identity of that prospective customer.

ii) The means and source of payment, including any associated financial institution,

credit card number, account number, customer identifier, transaction identifiers, or
virtual currency wallet or wallet address identifier.


iii) The email address and telephonic contact information used to verify a prospective

customer’s identity.

b) Assess whether a prospective customer intends to utilize the computing cluster to train a

covered model.

c) If a customer repeatedly utilizes computer resources that would be sufficient to train a

covered model, validate the information initially collected pursuant to paragraph a) and
conduct the assessment required pursuant to paragraph b) prior to each utilization.


d) Retain the customer’s internet protocol addresses used to access the cluster, along with

the time and date of access or administrative action.

e) Maintain for seven years and provide to the Frontier Model Division or the Attorney

General, upon request, appropriate records of actions taken under this section, including
policies and procedures put into effect.

f) Implement the capability to enact a full shutdown of any resources being used to train a

covered model.


-----

Page 9

20) Requires a person that operates a computing cluster shall consider applicable guidance from

the Frontier Model Division, National Institute of Standards and Technology, and other
reputable standard-setting organizations.


21) Requires a developer of a covered model that provides commercial access to that covered

model to provide a transparent, uniform, publicly available price schedule for the purchase of
access to that covered model at a given level of quality and quantity subject to the
developer’s terms of service and shall not engage in unlawful discrimination or
noncompetitive activity in determining price or access.

22) Requires a person that operates a computing cluster to provide a transparent, uniform,

publicly available price schedule for the purchase of access to the computing cluster at a
given level of quality and quantity subject to the developer’s terms of service and shall not
engage in unlawful discrimination or noncompetitive activity in determining price or access.


23) Provides that a person that operates a computing cluster may provide free, discounted, or

preferential access to public entities, academic institutions, or for noncommercial research
purposes.

24) States that the following are unlawful acts:

a) For a developer to fail to comply with any of the requirements of 8) or 21), above.

b) For a person who operates a computing cluster to fail to comply with the requirements of

20), 22), or 23), above.


c) For a developer to fail to comply with any of the requirements of the whistleblower

provisions in 30), below.

25) Provides that the following parties may bring a civil action pursuant to 24), above:

a) The Attorney General to enforce any provision of the bill.

b) The Labor Commissioner to enforce any provision 30), below, that would constitute a

violation of the Labor Code.


26) Provides that the Attorney General and Labor Commissioner are entitled to recover all of the

following in addition to any civil penalties specified in this chapter:

a) A civil penalty for a violation that occurs on or after January 1, 2026 in an amount not

exceeding 10 percent of the cost of the quantity of computing power used to train the
covered model to be calculated using average market prices of cloud compute at the time
of training for a first violation and in an amount not exceeding 30 percent of that value
for any subsequent violation.

b) Injunctive or declaratory relief, including but not limited to orders to modify, implement

a full shutdown, or delete the covered model and any covered model derivatives
controlled by the developer; but provides that the court may only order such relief for a
covered model that has caused death or bodily harm to another human, harm to property,
theft or misappropriation of property, or constitutes an imminent risk or threat to public


-----

Page 10

c) Monetary damages.

d) Punitive damages pursuant to standards in existing law. (Civil Code Section 3294 (a).)

e) Attorney’s fees and costs.

f) Any other relief that the court deems appropriate.


27) Declares a provision within a contract or agreement that seeks to waive, preclude, or burden

the enforcement of a liability arising from a violation of the bill, or to shift such a liability to
any person or entity in exchange for their use or access of, or right to use or access a
developer’s products or services, including by means of a contract of adhesion, is void as a
matter of public policy.

28) Provides that a court shall disregard corporate formalities and impose joint and several

liability on affiliated entities for purposes of effectuating the intent of to the maximum extent
allowed by law if the court concludes that both of the following are true:

a) The affiliated entities, in the development of the corporate structure among the affiliated

entities, took steps to purposely and unreasonably limit or avoid liability.


b) As the result of the steps described in a), the corporate structure of the developer or

affiliated entities would frustrate recovery of penalties or injunctive relief under this
section.

29) Allows a court to award punitive damages to the prevailing plaintiff in an action pursuant to

subdivision where any of the provisions of Civil Code Section 3294 apply.


30) Provides that a developer of a covered model or a contractor or subcontractor of the

developer shall not do any of the following:

a) Prevent, including through terms and conditions of employment, or seek to enforce such

terms and conditions of employment, an employee from disclosing information to the
Attorney General or the Labor Commissioner, if the employee has reasonable cause to
believe either of the following:

i) The developer is out of compliance with the requirements of 8), above.


ii) An artificial intelligence model, including a model that is not a covered model, poses

an unreasonable risk of causing or materially enabling critical harm, even if the
employer is not out of compliance with any law.

b) Retaliate against an employee for disclosing information to the Attorney General or

Labor Commissioner, if the employee has reasonable cause to believe either of the above.


c) Make false or materially misleading statements related to its safety and security protocol

in a manner that violates Part 2 of Division 7 of the Business and Professions Code or
any other provision of California law.


-----

Page 11

31) Specifies that an employee harmed by a violation of this subdivision may petition a court for

appropriate temporary or preliminary injunctive relief as provided in Sections 1102.61 and
1102.62 of the Labor Code.

32) Specifies that an employee of the Frontier Model Division may report any violation of this

chapter by the Frontier Model Division to the State Auditor pursuant to the provisions of the
California Whistleblower Protection Act which shall govern any such report.

33) Specifies that the Attorney General or Labor Commissioner may publicly release or provide,

to the Frontier Model Division or the Governor, any complaint, or a summary of that
complaint, pursuant to this section if they conclude that doing so will serve the public
interest.

34) Requires a developer and any contractor or subcontractor of the developer to provide a clear

notice to all employees working on covered models of their rights and responsibilities under
this section.

35) Provides that a developer is presumed to be in compliance with the requirements of 34) if the

developer does one of the following:


a) At all times post and display within all workplaces maintained by the developer a notice

to all employees of their rights and responsibilities under this section, ensure that all new
employees receive equivalent notice, and ensure that employees who work remotely
periodically receive an equivalent notice.


b) Provides, no less frequently than once every six months, written notice to all employees

of their rights and responsibilities under this chapter and take reasonable steps to ensure
that such notice is received and acknowledged by all such employees.

36) Requires a developer and any contractor or subcontractor of the developer to provide a

reasonable internal process through which an employee may anonymously disclose
information to the developer if the employee believes in good faith that the information
indicates that the developer has violated any provision of the bill or any other law, or has
made false or materially misleading statements related to its safety and security protocol or
failed to disclose known risks to employees, including, at a minimum, a monthly update to
the disclosing employee regarding the status of the employee’s disclosure and the actions
taken by the developer, contractor, or subcontractor in response to the disclosure.


37) Requires the disclosures and responses of the process required by 36) to be maintained for a

minimum of seven years after the date of the disclosure and response and requires the
disclosure and responses to be shared with officers and directors of the developer whose acts
or omissions are not implicated by the disclosure and any contractor or subcontractor of the
developer whose acts or omissions are not implicated by the disclosure at least once per
quarter.

38) Clarifies that the bill shall not be construed to limit protections provided to employees by

specified sections of the Labor Code, the Government Code, or other provisions of California
law.

39) Defines the following for purposes of 31) – 38) above:


-----

Page 12

a) “Employee” has the same meaning as defined in Section 1102.5 of the Labor Code and

includes both of the following:


i) Contractors or subcontractors, and unpaid advisors involved with assessing,

managing, or addressing hazardous capabilities of covered models.

ii) Corporate officers.

b) “Contractor or subcontractor” has the same meaning as in Section 1777.1 of the Labor

Code.


c) “Information about non-compliance with the requirements of Section 22603” shall be

considered information about unlawful acts in the workplace within the meaning of
Section 12964.5 of the Government Code.

d) Clarifies that the duties and obligations imposed by this chapter are cumulative with any

other duties or obligations imposed under other law and shall not be construed to relieve
any party from any duties or obligations imposed under other law and do not limit any
rights or remedies under existing law.


40) Establishes the Board of Frontier Models in the Government Operations Agency. Allows the

Governor to appoint an executive director of the Board, subject to Senate confirmation, to
exercise all duties and functions necessary to ensure that the responsibilities of the board are
successfully discharged. Specifies that the board shall be composed of five members, as
follows:

a) A member of the open-source community, appointed by the Governor, subject to Senate

confirmation.


b) A member of the artificial intelligence industry, appointed by the Governor, subject to

Senate confirmation.

c) A member of academia, appointed by the Governor, subject to Senate confirmation.

d) A member appointed by the Speaker of the Assembly.

e) A member appointed by the Senate Rules Committee.


41) Establishes the Frontier Model Division in the Government Operations Agency, under the

direct supervision of the Board. Requires the Division to do the following:

a) Annually review certifications received from developers.

b) Advise the Attorney General on potential violations of the bill’s provisions.

c) Establish an accreditation process for third party auditors.

d) Publish anonymized safety reports.

e) Issue guidance, standards, and best practices necessary to prevent unreasonable risks of

covered models and covered model derivatives causing or enabling critical harms


-----

Page 13

including, but not limited to, more specific components of or requirements under the
duties required under Section 22603 of the Business and Professions Code.


f) Appoint and consult with an advisory committee for open-source AI that shall do all of

the following:

i) Issue guidelines for model evaluation for use by developers of open-source artificial

intelligence models that lack the ability to cause or enable critical harms.


ii) Advise the Legislature on the creation and feasibility of incentives, including tax

credits, that could be provided to developers of open-source artificial intelligence
models that are not covered models.

iii) Advise the Frontier Model Division on future policies and legislation impacting open
source artificial intelligence development.


iv) Levy fees, including an assessed fee for the submission of a certification, in an

amount sufficient to cover the reasonable costs of administering this section that do
not exceed the reasonable costs of administering this section.

v) Develop and submit to the Judicial Council proposed model jury instructions for

actions involving violations of Section 22603 of the Business and Professions Code
that the Judicial Council may, at its discretion, adopt consistent with its policies and
procedures for the promulgation of jury instructions.

42) Requires, in developing the proposed model jury instructions required by 41), the Frontier

Model Division shall consider and incorporate all of the following into the proposal that it
submits to the Judicial Council:


a) All of the actions that a developer of a covered model must take pursuant to Section

22603 of the Business and Professions Code.

b) How any regulations of the Frontier Model Division should be incorporated into the

proposed model jury instructions.

c) The rigor and quality of the safety and security protocol (SSP) that a developer is

required to implement while training and releasing its AI model, and how to determine
whether this SSP was inferior, comparable, or superior to the SSPs of similarly situated
developers.


d) The rigor and quality of the developer’s investigation, documentation, evaluation, and

management of its model’s potential hazardous capabilities, and associated risks.

43) Requires the Frontier Model Division, on or before January 1, 2027, and annually thereafter,

to issue regulations to update the definition of a “covered model” to ensure that it accurately
reflects technological developments, scientific literature, and widely accepted national and
international standards and applies to artificial intelligence models that pose the greatest risk
of causing or enabling critical harms. The updated definition shall contain both of the
following:


-----

Page 14

a) The initial compute threshold that an artificial intelligence model must exceed to be

considered a covered model, as defined in Section 22602 of the Business and Professions
Code.


b) The fine-tuning compute threshold that an artificial intelligence model must meet to be

considered a covered model.


44) Requires, in developing regulations, the Frontier Model Division to take into account both of

the following:

a) The quantity of computing power used to train covered models that have been identified

as being reasonably likely to cause or enable a critical harm.


b) Similar thresholds used in federal law, guidance, or regulations for the management of

models with reasonable risks of causing or enabling critical harms.


c) Input from stakeholders, including academics, industry, and government entities,

including from the open-source community.

45) Requires, every 24 months after initial publication of guidance, the Frontier Model Division,

to review existing guidance in consideration of technological advancements, changes to
industry best practices, and information received to update its guidance to the extent
appropriate.


46) Requires, on and after January 1, 2026, the Frontier Model Division to annually publish the

inflation-adjusted dollar amounts applicable as provided above.

47) Tasks the Department of Technology with creating a public cloud computing cluster known

as CalCompute through the commissioning of consultants with specified objectives, first of
which is to study the safe and secure deployment of large-scale AI models. The consultants
shall include representatives of national laboratories, public universities, and any relevant
professional associations or private sector stakeholders. They shall evaluate and incorporate
the following considerations into their plan:

a) An analysis of the public, private, and nonprofit cloud platform infrastructure ecosystem,

including, but not limited to, dominant cloud providers, the relative compute power of
each provider, the estimated cost of supporting platforms as well as pricing models, and
recommendations on the scope of CalCompute.


b) The process to establish affiliate and other partnership relationships to establish and

maintain an advanced computing infrastructure.

c) A framework to determine the parameters for use of CalCompute, including, but not

limited to, a process for deciding which projects will be supported by CalCompute and
what resources and services will be provided to projects.


d) A process for evaluating appropriate uses of the public cloud resources and their potential

downstream impact, including mitigating downstream harms in deployment.


-----

Page 15

e) An evaluation of the landscape of existing computing capability, resources, data, and

human expertise in California for the purposes of responding quickly to a security, health,
or natural disaster emergency.


f) An analysis of the state’s investment in the training and development of the technology

workforce, including through degree programs at the University of California, the
California State University, and the California Community Colleges.


g) A process for evaluating the potential impact of CalCompute on retaining technology

professionals in the public workforce.

48) Authorizes the Department of Technology to receive private donations, grants, and local

funds, in addition to allocated funding in the annual budget, to effectuate the establishment of
CalCompute.

**EXISTING LAW:**


1) Establishes the Government Operations Agency. (Government Code Section 12800. All

further statutory references are to the Government Code, unless otherwise indicated.)

2) Establishes the Department of Technology within the Government Operations Agency.

(Section 12803.2.)


3) Charges the Department of Technology with approving and overseeing information

technology projects in the state. (Section 11546.)

4) Pursuant to the California Whistleblower Protection Act (CWPA), prohibits “improper

governmental activities” by state agencies and employees. (Section 8547.2.)

5) Declares that state employees should be free to report waste, fraud, abuse of authority,

violation of law, or threat to public health without fear of retribution. (Section 8547.1.)

6) Includes the following relevant definitions in the CWPA:


a) “Employee” means an individual appointed by the governor, or employed or holding

office in a state agency. (Section 8547.2 (a).)

b) “State agency” includes every state office, officer, department, division, bureau, board,

and commission other than the California State University, unless specifically provided
otherwise. (Section 11000 (a).)


c) “Protected disclosure” means a good faith communication that discloses or demonstrates

an intention to disclose information that may show either (1) an improper governmental
activity, or (2) a condition that may threaten the health or safety of employees or the
public, if the purpose of disclosing is to remedy that condition. (Section 8547.2 (e).)

d) “Improper governmental activity” means an activity by a state agency or by an employee

that is undertaken in performance duties, undertaken inside a state office, or, if
undertaken outside a state office by the employee, directly relates to state government,
whether or not that activity is within the scope of his or her employment, and also meets


-----

Page 16

i) It is in violation of any state or federal law or regulation, including, but not limited to,

corruption, malfeasance, bribery, theft of government property, fraudulent claims,
fraud, coercion, conversion, malicious prosecution, misuse of government property,
or willful omission to perform a duty.

ii) It is in violation of an Executive order of the Governor, a California Rule of Court, or

any policy or procedure mandated by the State Administrative Manual or State
Contracting Manual.


iii) It is economically wasteful, involves gross misconduct, incompetency, or

inefficiency. (Section 8547.2 (c).)

7) Requires the State Auditor's Office (SAO), in order to “be free of organizational impairments

to independence, to be independent of the executive branch and legislative control” and “to
remain free from the influence of existing control agencies that could be the subject of audits
conducted by the office.” (Sections 8543, 8546.)

8) Ensures the confidentiality of all protected disclosures, including a good faith communication

to the SAO alleging an improper governmental activity and any evidence delivered to the
SAO in support of the allegation. (Section 8547.2 (e).)


9) Requires the SAO to accept complaints by mail and via Internet, and to conduct

investigations of alleged improper governmental activities, and authorizes the SAO to issue
reports of its findings including recommended corrective actions if it finds reasonable cause
to believe an improper governmental activity has occurred. (Sections 8547.4, 8547.5,
8547.7.)

10) Allows the SAO to permit complaints to be filed anonymously, in which case the SAO is

required to keep the identity of all complainants and witnesses confidential, unless given the
express permission of the person, or the disclosure is made to a law enforcement agency that
is conducting a criminal investigation. (Section 8547.5 (a).)

11) Provides that if the SAO determines that there is reasonable cause to believe that a state

agency or employee may have engaged in an improper governmental activity, the SAO may
refer the allegation to the involved state agency, or to another state agency having direct
oversight of the involved state agency, to conduct an investigation of the allegation under the
SAO’s supervision. (Section 8547.6 (b).)


12) Allows a state employee or applicant for state employment (including an employee of the

SAO or applicant for employment at the SAO) who files a written complaint with his or her
supervisor, manager, or the appointing power alleging actual or attempted acts of reprisal,
retaliation, threats, coercion, or similar improper acts prohibited by Section 8547.3 to also
file a copy of the written complaint with the State Personnel Board (SPB), together with a
sworn statement that the contents of the written complaint are true. (Section 8547.8 (a),
8547.13 (b).)

13) Provides that if the SPB determines there is a reasonable basis for an alleged violation, it

shall transmit a copy of the investigation report to the SAO. (Section 8547.9.)


-----

Page 17

14) Requires the employing state agency to take adverse employment action against any

employee found by the SAO to have engaged or participated in improper governmental
activity or to set forth in writing its reasons for not taking adverse action, and likewise
requires the employing agency to report on actions it has taken to implement the SAO’s
recommendations to the SPB and the SAO. (Sections 8547.4.)


15) Makes it unlawful for any employer to discharge, expel, or otherwise discriminate against

any person because the person has opposed any practices forbidden under the section or
because the person has filed a complaint, testified, or assisted in any proceeding; and
authorizes the Civil Rights Department to receive, investigate, conciliate, mediate, and
prosecute complaints alleging practices made unlawful pursuant to Chapter 6 (commencing
with Section 12940). (Sections 12940 (h), 12930 (f)(1).)

16) Prohibits employers from preventing an employee from, or retaliate against them for,

disclosing information to a government or law enforcement agency, if the employee has
reasonable cause to believe that the information discloses a violation of state or federal
statute, or a violation of or noncompliance with a local, state, or federal rule or regulation,
regardless of whether disclosing the information is part of the employee’s job duties. (Labor
Code Section 1102.5.)


17) Authorizes, in an action for the breach of an obligation not arising from contract, where it is

proven by clear and convincing evidence that the defendant has been guilty of oppression,
fraud, or malice, the plaintiff, in addition to the actual damages, may recover damages for the
sake of example and by way of punishing the defendant. (Civil Code Section 3294 (a).)

18) Defines, for purposes of 17), the following:

a) “Malice” means conduct which is intended by the defendant to cause injury to the

plaintiff or despicable conduct which is carried on by the defendant with a willful and
conscious disregard of the rights or safety of others.


b) “Oppression” means despicable conduct that subjects a person to cruel and unjust

hardship in conscious disregard of that person’s rights.

c) “Fraud” means an intentional misrepresentation, deceit, or concealment of a material fact

known to the defendant with the intention on the part of the defendant of thereby
depriving a person of property or legal rights or otherwise causing injury. (Civil Code
Section 3294 (c).)

**FISCAL EFFECT: As currently in print this bill is keyed fiscal.**

**COMMENTS: Seeking to protect California and humanity from the very serious but not fully**
understood future harms of Artificial Intelligence, this well-intentioned and ambitious measure
establishes a scheme of regulatory guardrails and oversight of AI developers and their “covered
models.” According to the author:

Large-scale artificial intelligence has the potential to produce an incredible range of benefits
for Californians and our economy—from advances in medicine and climate science to
improved wildfire forecasting and clean power development. It also gives us an opportunity
to apply hard lessons learned over the last decade as we’ve seen the consequences of


-----

Page 18

allowing the unchecked growth of new technology without evaluating, understanding, or
mitigating the risks. SB 1047 does just that, by developing responsible, appropriate
guardrails around development of the largest, most powerful AI systems, to ensure they are
used to improve Californians’ lives, without compromising safety or security.

**_Background: The promise and peril of AI. The rapid advancement of AI technologies brings_**
both unprecedented opportunities and significant challenges. The enormous computational power
required to develop advanced AI models unfortunately also poses significant risks. As
developers push the boundaries of AI capabilities, the potential for unintended consequences
grows. Models trained with vast amounts of data and computational resources can develop
behaviors that are difficult to predict and control. This unpredictability, coupled with the high
stakes involved, underscores the necessity for stringent oversight and safety protocols. The State
of California, being a global hub for technology and innovation, has a unique opportunity and
responsibility to lead in the regulation and safe development of AI.

There have been numerous concerns about AI being used to develop autonomous weapons,
which can select and engage targets without human intervention. AI-enabled technologies, such
as drones and cyber capabilities, are increasingly accessible to non-state actors due to the
proliferation of inexpensive, commercial off-the-shelf AI. These technologies can be used for a
variety of harmful purposes, including large-scale misinformation campaigns, cyber espionage,
and cyberattacks. For example, non-state actors have used AI to enhance the efficiency of their
operations, predict the movements of law enforcement and military personnel, and carry out
more sophisticated attacks. (Brookings, "The implications of the AI boom for nonstate armed
_actors" (April 5, 2023), https://www.brookings.edu/blog/order-from-chaos/2023/04/05/the-_
implications-of-the-ai-boom-for-nonstate-armed-actors/.)

Specific incidents illustrating these threats include the use of drones by the Islamic State group,
which in 2017 deployed a drone to drop an explosive in a residential complex in Iraq. This
incident demonstrates the potential for AI-enhanced drones to be used in terrorist attacks.
Additionally, drug cartels have employed drones to transport narcotics and deliver bombs,
highlighting the dual-use nature of commercial drone technology and the ease with which it can
be repurposed for malicious activities. (Brookings, "Cascading chaos: Nonstate actors and AI on
_the battlefield" (June 2023), https://www.brookings.edu/research/cascading-chaos-nonstate-_
actors-and-ai-on-the-battlefield/.)

AI-driven algorithms have been used to automate phishing attacks, enhance malware, and find
vulnerabilities in critical infrastructure. In 2017, the WannaCry ransomware attack, which
utilized AI techniques, affected hundreds of thousands of computers worldwide, causing billions
of dollars in damage. WannaCry exploited a vulnerability in Microsoft Windows, encrypting
users' data and demanding ransom payments in Bitcoin. This attack disrupted services in various
sectors, including healthcare, where the UK’s National Health Service experienced severe
operational impacts, and industries such as telecommunications and logistics faced significant
disruptions. (BBC, "WannaCry cyber attack: What can we learn?" (May 22, 2017),
https://www.bbc.com/news/business-40008343; Brookings, "The implications of the AI boom
for nonstate armed actors" (April 5, 2023), https://www.brookings.edu/blog/order-fromchaos/2023/04/05/the-implications-of-the-ai-boom-for-nonstate-armed-actors/; Microsoft,
_"Staying ahead of threat actors in the age of AI" (May 25, 2023),_
https://www.microsoft.com/security/blog/2023/05/25/staying-ahead-of-threat-actors-in-the-ageof-ai/.)


-----

Page 19

The hacktivist group Anonymous has utilized AI-enhanced denial-of-service (DoS) attacks
against corporations and right-wing conspiracy theorists, showing the disruptive potential of AI
in cyber warfare. These attacks involve overwhelming a target's servers with massive amounts of
traffic generated by AI algorithms, causing the servers to crash and the targeted services to
become unavailable. By automating the attack process, AI allows for a more efficient and largescale execution, making it difficult for traditional defense mechanisms to cope. Furthermore, the
DarkSide hacker group conducted a significant cyberattack on the Colonial Pipeline in 2021.
They used AI-driven malware to breach the pipeline's network security, encrypt data, and
demand a ransom for its release. This attack caused widespread disruption to fuel supplies across
the Eastern United States, highlighting the vulnerabilities of critical infrastructure to
sophisticated AI-powered cyber threats. (Microsoft, "Staying ahead of threat actors in the age of
_AI" (May 25, 2023), https://www.microsoft.com/security/blog/2023/05/25/staying-ahead-of-_
threat-actors-in-the-age-of-ai/.)

Automated trading algorithms, if not properly regulated, can lead to market manipulation and
financial instability. The 2010 Flash Crash, where AI-driven high-frequency trading algorithms
caused a sudden and severe drop in the US stock market, serves as a stark reminder of the
economic risks posed by unregulated AI systems. During the Flash Crash, the Dow Jones
Industrial Average plunged about 1,000 points within minutes, erasing nearly $1 trillion in
market value before recovering shortly after. This incident highlighted the vulnerability of
financial markets to AI-driven trading systems and underscored the need for regulatory oversight
to prevent such occurrences in the future. (Reuters, "What Caused the 'Flash Crash' Rebound?"
(May 11, 2010), https://www.reuters.com/article/us-usa-stocks-flashcrashidUSTRE64A5R220100511; SEC, "Findings Regarding the Market Events of May 6, 2010"
(September 30, 2010), https://www.sec.gov/news/studies/2010/marketevents-report.pdf.)

These examples underscore the real and growing threat posed by non-state actors who may
leverage AI technology for nefarious purposes. The accessibility of powerful AI tools to
malicious entities can amplify their capabilities, making it easier for them to carry out
sophisticated attacks with potentially devastating consequences. This highlights the urgent need
for comprehensive oversight and regulatory measures, such as those proposed in this bill, to
mitigate these risks and ensure that AI technologies are developed and deployed responsibly. By
establishing robust safeguards and monitoring mechanisms, California can lead the way in
preventing the misuse of AI and protecting public safety and security. (Brookings,
_"Democratizing harm: Artificial intelligence in the hands of nonstate actors" (November 2021),_
https://www.brookings.edu/research/democratizing-harm-artificial-intelligence-in-the-hands-ofnonstate-actors/.)

**_The bill and proposed amendments. In order to guard against the possible, but grave future_**
harms of AI—whether used to create biological weapons or shut down the electrical grid, for
example—the bill, co-sponsored by the Center for AI Safety Action Fund, Economic Security
California Action, and Encode Justice, requires AI developers to implement measures such as
cybersecurity protections, safety assessments, and a full shutdown capability to prevent
unauthorized access and misuse of AI models. By creating the Frontier Model Division
(Division) within the California Department of Technology, the bill seeks to ensure continuous
oversight and enforcement of these protocols. The Division would also oversee third-party audits
and annual compliance certifications, enhancing accountability. Additionally, the bill authorizes
the Attorney General to take civil action against non-compliant entities, imposing penalties and
ordering the deletion of hazardous AI models if necessary These provisions collectively work to


-----

Page 20

mitigate the risks of AI misuse by non-state actors, such as terrorists and cybercriminals, thereby
safeguarding public safety and national security.

The vast majority of these provisions are outside the jurisdiction of this Committee. Relating to
this Committee’s jurisdiction, the bill imposes civil penalties for violations of its provisions;
provides whistleblower rights under the California Whistleblower Protection Act to employees
of the Division and employees of developers of covered models; and requires the Division to
provide guidance to the Judicial Council for the future development of jury instructions to be
used in civil actions to enforce the bill’s provisions.

**_Civil penalties. The bill in print gives only the Attorney General (AG) the ability to bring a civil_**
action in the event that the AG “finds that a person is violating this chapter.” Therefore, for
example, the AG could file a complaint against a developer of a covered model or covered model
derivative for failure to comply with the bill’s safety and security protocol, or failure to provide
reasonable assurance that the developer will not produce covered models or covered model
derivatives that pose an unreasonable risk of causing or enabling a critical harm. For a violation
that occurs on or after January 1, 2026, the bill authorizes a civil penalty “in an amount not
exceeding 10 percent of the cost of the quantity of computing power used to train the covered
model to be calculated using average market prices of cloud compute at the time of training for a
first violation and in an amount not exceeding 30 percent of that value for any subsequent
violation.” While it may be unclear to a lay person what that means in terms of the amount of
damages that could be recovered, presumably it would be a substantial amount. According to
information provided by the author:

The average performance of AI models is predictably related to how much computational
power, measured in FLOP, was used to train them. Performance on any individual task will
tend to go up with FLOP used to train a model, but with less predictability. The FLOP used
to train the largest models has rapidly increased over the last few years (doubling every 10
months). This will only continue, because of increasing investment, algorithmic
improvements, and hardware improvements. (Footnotes omitted.) Today, AI models (which
are all believed to be below the 10^26 FLOP threshold) are not capable of causing the
catastrophic harms that this bill is intended to prevent.

The bill in print authorizes the AG to obtain injunctive or declaratory relief, including –in
exceptional circumstances—an order “to modify, implement a full shutdown, or delete the
covered model and any covered model derivatives controlled by the developer.” The bill
provides that the court may only order such relief in a case where the covered model “has caused
death or bodily harm to another human, harm to property, theft or misappropriation of property,
or constitutes an imminent risk or threat to public safety.” The bill authorizes the AG to collect
attorney’s fees and costs and any other relief that the court deems appropriate.

The bill requires a court to “disregard corporate formalities and impose joint and several liability
on affiliated entities” but does not provide legal standards for how to do so. For example,
“[E]vidence of ratification of [agent’s] actions by [defendant] and any other findings made under
Civil Code section 3294, subdivision (b), must be made by clear and convincing evidence.”
(Barton v. Alexander Hamilton Life Ins. Co. of America (2003) 110 Cal.App.4th 1640, 1644.)
The bill in print authorizes punitive damages, but in a somewhat confusing manner.

The proposed author’s amendments (below) significantly revise the enforcement provisions of


-----

Page 21

Commissioner to enforce violations of the bill that also constitute a violation of the Labor Code;
and clarify the remedies available to these public civil law enforcement officials.

_Although the bill in print (and as proposed to be amended) does not create a private right of_
_action for persons who are personally injured by AI and only provides for AG enforcement, the_
_bill in print speaks to “monetary damages to persons” aggrieved by a violation of the bill’s_
_requirements. However, existing laws and legal theories regarding personal injury and property_
_damage nevertheless would seem flexible enough to allow plaintiffs who are personally harmed_
_by AI to recover damages for their injuries. Therefore, at least in theory, current law should_
_authorize a claim to be filed against a developer who negligently, intentionally, or recklessly_
_causes an injury as a result of the use of their “covered model”._

**_Author’s amendments—Section 22606 (Enforcement). The author proposes to strike out the_**
text of Section 22606 in its entirety and replace it with the following:

22606. (a) The following are unlawful acts:
**_(1)_** **_For a developer to fail to comply with any of the requirements of Section 22603 or_**
**_subdivision (a) of Section 22605._**
**_(2)_** **_For a person who operates a computing cluster to fail to comply with the requirements_**
**_of Section 22604 or subdivision (b) of Section 22605._**
**_(3)_** **_For a developer to fail to comply with any of the requirements of Section 22607._**
**_(b)_** **_The following parties may bring a civil action pursuant to subdivision (a):_**
**_(1)_** **_The Attorney General to enforce any provision of this chapter._**
**_(2)_** **_The Labor Commissioner to enforce any provision of Section 22607 that would_**
**_constitute a violation of the Labor Code._**
**_(c) The parties listed in subdivision (b) are entitled to recover all of the following in_**
**_addition to any civil penalties specified in this chapter:_**
**_(1) A civil penalty for a violation that occurs on or after January 1, 2026 in an amount not_**
**_exceeding 10 percent of the cost of the quantity of computing power used to train the_**
**_covered model to be calculated using average market prices of cloud compute at the time of_**
**_training for a first violation and in an amount not exceeding 30 percent of that value for_**
**_any subsequent violation._**
**_(2) (A) Injunctive or declaratory relief, including but not limited to orders to modify,_**
**_implement a full shutdown, or delete the covered model and any covered model derivatives_**
**_controlled by the developer._**
**_(B) The court may only order such relief for a covered model that has caused death or_**
**_bodily harm to another human, harm to property, theft or misappropriation of property, or_**
**_constitutes an imminent risk or threat to public safety._**
**_(3) (A) Monetary damages._**
**_(B) Punitive damages pursuant to subdivision (a) of Civil Code Section 3294._**
**_(4) Attorney’s fees and costs._**
**_(5) Any other relief that the court deems appropriate._**
**_(d) A provision within a contract or agreement that seeks to waive, preclude, or burden the_**
**_enforcement of a liability arising from a violation of this chapter, or to shift such a liability_**
**_to any person or entity in exchange for their use or access of, or right to use or access, a_**
**_developer’s products or services, including by means of a contract of adhesion, is void as a_**
**_matter of public policy._**


-----

Page 22

**_(e) A court shall disregard corporate formalities and impose joint and several liability on_**
**_affiliated entities for purposes of effectuating the intent of this section to the maximum_**
**_extent allowed by law if the court concludes that both of the following are true:_**
**_(A) The affiliated entities, in the development of the corporate structure among the_**
**_affiliated entities, took steps to purposely and unreasonably limit or avoid liability._**
**_(B) As the result of the steps described in subparagraph (A), the corporate structure of the_**
**_developer or affiliated entities would frustrate recovery of penalties or injunctive relief_**
**_under this section._**
**_(f) This section does not limit the application of other laws._**

**_Whistleblower rights. Employees do not surrender their free speech rights because of their_**
employment. The 1[st] Amendment protects the ability of employees, whether public or private, to
speak about employer misconduct in certain circumstances. Public employees, for example, have
the right to disclose information about government misconduct that are matters of public
concern. (See Garcetti v. Ceballos (2006) 547 U.S. 410, 419, citing Pickering v. Board of Educ.
(1968) 391 U.S. 563.) They are also protected from wrongful termination for doing so. (Ostrofe
_v. H.S. Crocker Co., Inc. (9th Cir. 1982) 670 F.2d 1378, 1383-84 [upholding claim of wrongful_
discharge of an employee who reported his employer's violation of Clayton Act, despite absence
of anti-retaliation clause in the law governing his employment, in order to promote “interests of
antitrust enforcement”], aff'd, 740 F.2d 739 (9th Cir. 1984), cert. denied, 469 U.S. 1200 (1985).)

In light of the fact that not all disclosures of government misconduct are necessarily protected by
the 1[st] Amendment (i.e. misconduct that is not a “matter of public concern”), the Legislature has
codified the rights of employees to report improper or illegal workplace conduct without fear of
retaliation and has enacted a comprehensive legislative scheme for reporting and investigating
such complaints. Among others, three comprehensive laws are designed to protect employees
and encourage them, in good faith, to report improper or illegal governmental activity so that it
can be remediated: (1) The California Whistleblower Protection Act (CWPA); (2) The Fair
Employment and Housing Act (FEHA); and (3) Labor Code Section 1102.5.

_The CWPA, codified at Sections 8547 et seq., applies to employees of all state agencies,_
individuals appointed by the governor, or employed by CSU or the courts. (Section 8547.2 (a).)
The CWPA states that it is the public policy of the Legislature that “employees should be free to
report waste, fraud, abuse of authority, violation of law, or threat to public health without fear of
retribution.” (Section 8457.1.) The CWPA also established an extensive process for the State
Auditor to investigate reports that a public employee or agency has engaged in improper
governmental activity, allowing allegations of improper governmental activity to be submitted in
a confidential manner, and authorizing the Auditor to recommend disciplinary action for
misconduct, if appropriate. Retaliation against a state employee for making a protected
disclosure is prohibited by law. (Section 8547.8 (b).) A state employee or applicant for state
employment who believes that he or she has been the victim of retaliation may file a written
complaint with either his or her supervisor, manager, or appointing power. (Section 8547.8 (a).)
Alternatively, whistleblower complaints can be made to, and investigated by, the State Personnel
Board. (Ibid.)

_FEHA, codified as Sections 12900 – 12996 prohibits unlawful discrimination in employment and_
housing. Wrongful termination in violation of FEHA occurs when an employer fires or otherwise
retaliates against an employee who, among other things, has “opposed any practices forbidden


-----

Page 23

under this part or because the person has filed a complaint, testified, or assisted in any
proceeding under this part.” (Section 12940 (h).)

_Labor Code Section 1102.5 prohibits employers, both public and private, from doing either of_
the following: 1) preventing an employee from disclosing information about an activity
reasonably believed to be unlawful to “a government or law enforcement agency, a person with
authority over the employee, or any public body conducting an investigation, hearing, or
inquiry,” if the employee has reasonable cause to believe that the information discloses a
violation of state or federal statute, or a violation of or noncompliance with a local, state, or
federal rule or regulation; or 2) retaliating against an employee for reporting such information.
(Labor Code Sections 1102.5 (a) and (b).) “Employee” means any person employed by an
employer, private or public, including, but not limited to, individuals employed by the state or
any subdivision thereof, any county, city, city and county, including any charter city or county,
and any school district, community college district, municipal or public corporation, political
subdivision, or the University of California. (Labor Code Section 1106.) Under California Labor
Code Section 1102.5, if an employer retaliates against a whistleblower, the employer may be
required to reinstate the employee’s employment and work benefits, pay lost wages, and take
other steps necessary to comply with the law.

_Whistleblowers about the dangers of AI. On June 4, 2024, a number of current and former_
employees at frontier AI companies, such as Open AI and Google DeepMind, wrote an Open
Letter, stating that “[W]e believe in the potential of AI technology to deliver unprecedented
benefits to humanity. We also understand the serious risks posed by these technologies. These
risks range from the further entrenchment of existing inequalities, to manipulation and
misinformation, to the loss of control of autonomous AI systems potentially resulting in human
extinction.” (See https://righttowarn.ai/.) The former employees point out in the Open Letter that,
“there is no effective government oversight of these corporations, current and former employees
are among the few people who can hold them accountable to the public. Yet broad
confidentiality agreements block us from voicing our concerns, except to the very companies that
may be failing to address these issues. Ordinary whistleblower protections are insufficient
because they focus on illegal activity, whereas many of the risks we are concerned about are not
yet regulated.”

_Whistleblower protections under the bill in print. The bill in print reiterates provisions of_
existing law in terms of clarifying that employees – whether public employees of the Division, or
employees of private developers—have the right to report conduct by their employers that
violates the requirements of the bill and are protected from retaliation by their employers in
response to such reports. The bill in print does not protect the right of employees to report risky
behavior that does not yet amount to a violation of the law, however. Given that workers in the
AI industry are “publicly calling for more whistleblower protections, specifically citing
confidentiality and/or non-disparagement agreements as problematic barriers to ensuring public
safety is protected, arguably the scope of the protections for whistleblower complaints in terms
of the type of reports that are protected should be more broad than the scope under the bill in
print.

**_Author/Committee amendments – Whistleblower Protections. As proposed to be amended,_**
employees would enjoy more broad protection against retaliation for protected disclosures,
including about misconduct that does not yet constitute a violation of the law, but poses a risk of
future harm to the public.


-----

Page 24

**22607. (a) Pursuant to subdivision (a) of Section 1102.5 of the Labor Code, a A developer of**
**_a covered model or a contractor or subcontractor of the developer shall not prevent do_**
**_either of the following:_**
**_(1)_** **_Prevent, including through terms and conditions of employment, or seek to enforce_**
**_such terms and conditions of employment, an employee from disclosing information to the_**
Attorney General **_or the Labor Commissioner, if the employee has reasonable cause to_**
believe that the information indicates that the either of the following:
**_(A)_** **_The developer is out of compliance with the requirements of Section 22603._**
**_(B)_** **_An artificial intelligence model, including a model that is not a covered model, poses_**
**_an unreasonable risk of causing or materially enabling critical harm, even if the employer_**
**_is not out of compliance with any law._**
(b) Pursuant to subdivision (b) of Section 1102.5 of the Labor Code, a developer shall not
retaliate
**_(2) Retaliate_** against an employee for disclosing information to the Attorney General or
**_Labor Commissioner, if the employee has reasonable cause to believe that the information_**
indicates that the developer is out of compliance with the requirements of Section 22603
**_either subparagraph (A) or (B) of paragraph (1)._**

**_(3) Make false or materially misleading statements related to its safety and security_**
**_protocol in a manner that violates Part 2 of Division 7 of the Business and Professions_**
**_Code or any other provision of California law._**
**_(b) (1) An employee harmed a violation of this subdivision may petition a court for_**
**_appropriate temporary or preliminary injunctive relief as provided in Sections 1102.61 and_**
**_1102.62 of the Labor Code._**
**_(2) An employee of the Frontier Model Division may report any violation of this chapter by_**
**_the Frontier Model Division to the State Auditor pursuant to the provisions of the_**
**_California Whistleblower Protection Act (commencing with Section 8547 of the_**
**_Government Code) which shall govern any such report._**
(c) The Attorney General **_or Labor Commissioner may publicly release_** **_or provide, to the_**
**_Frontier Model Division or the Governor, any complaint, or a summary of that complaint,_**
pursuant to this section if the Attorney General concludes they conclude that doing so will
serve the public interest.
(d) Employees shall seek relief for violations of subdivisions (a) and (b) pursuant to Sections
1102.61 and 1102.62 of the Labor Code.
(e) (d) Pursuant to subdivision (a) of Section 1102.8 of the Labor Code, a A developer and
**_any contractor or subcontractor of the developer shall provide_** **_a clear notice to all_**
employees working on covered models of their rights and responsibilities under this section.
**_A developer is presumed to be in compliance with the requirements of this subdivision if_**
**_the developer does one of the following:_**
**_(1) At all times post and display within all workplaces maintained by the developer a notice_**
**_to all employees of their rights and responsibilities under this section, ensure that all new_**
**_employees receive equivalent notice and ensure that employees who work remotely_**
**_periodically receive an equivalent notice._**
**_(2) No less frequently than once every six months, provide written notice to all employees_**
**_of their rights and responsibilities under this chapter and ensure that such notice is_**
**_received and acknowledged by all such employees._**

**_Jury instructions. Anticipating that when civil claims based upon the bill reach the courts, the_**
courts will need technical assistance in the development of jury instructions the bill tasks the


-----

Page 25

Division with developing proposed model jury instructions and providing them to the Judicial
Council. The bill in print is highly specific and technical, requiring the proposed model jury
instructions to incorporate all of the following “factors”:

(i) The level of rigor and detail of the safety and security protocol that the developer
faithfully implemented while it trained, stored, and released a covered model.

(ii) Whether and to what extent the developer’s safety and security protocol was inferior,
comparable, or superior, in its level of rigor and detail, to the safety and security protocols of
comparable developers.

(iii) The extent and quality of the developer’s safety and security protocol’s prescribed
safeguards, capability testing, and other precautionary measures with respect to the relevant
risk of causing or enabling a critical harm.

(iv) Whether and to what extent the developer and its agents complied with the developer’s
safety and security protocol, and to the full degree, that doing so might plausibly have
avoided causing or enabling a particular harm.

(v) Whether and to what extent the developer carefully and rigorously investigated,
documented, and accurately measured, insofar as reasonably possible given the state-of-theart, relevant risks that its model might pose.

These “factors” may be more specific and technical than necessary. By making the language
more flexible, the Division arguably could be more responsive to power, trends, risks and usage
of AI when the time comes to provide Judicial Council with the proposed model instructions.

**_Author’s amendments – Jury Instructions. As proposed to be amended as detailed below, the_**
bill’s modified language (below) would do just that. The author’s amendments would read as
follows:

(9) (A) Develop and submit to the Judicial Council proposed model jury instructions for
actions involving violations of Section 22603 of the Business and Professions Code that the
Judicial Council may, at its discretion, adopt consistent with its policies and procedures for
**_the promulgation of jury instructions._**
(B) In developing the **_proposed_** model jury instructions required by subparagraph (A), the
Frontier Model Division shall consider and incorporate all of the following factors into the
**_proposal that it submits to the Judicial Council:_**
(i) The level of rigor and detail of the safety and security protocol that the developer
faithfully implemented while trained, stored, and released a covered model. All of the actions
**_that a developer of a covered model must take pursuant to Section 22603 of the Business_**
**_and Professions Code._**
(ii) Whether and to what extent the developer’s safety and security protocol was inferior,
comparable, or superior, in its level of rigor and detail, to the safety and security protocols of
comparable developers. **_How any regulations of the Frontier Model Division should be_**
**_incorporated into the proposed model jury instructions._**
(iii) The extent and quality of the developer’s safety and security protocol’s prescribed
safeguards, capability testing, and other precautionary measures with respect to the relevant
hazardous capability and related hazardous capabilities. The rigor and quality of the safety

**_d_** **_it_** **_t_** **_l (SSP) th t_** **_d_** **_l_** **_i_** **_i_** **_d t_** **_i_** **_l_** **_t_** **_hil t_** **_i i_** **_d_**


-----

Page 26

**_releasing its AI model, and how to determine whether this SSP was inferior, comparable,_**
**_or superior to the SSPs of similarly situated developers._**
(iv) Whether and to what extent the developer and its agents complied with the developer’s
safety and security protocol, and to the full degree, that doing so might plausibly have
avoided causing a particular harm. **_The rigor and quality of the developer’s investigation,_**
**_documentation, evaluation, and management of its model’s potential hazardous_**
**_capabilities, and associated risks._**
(v) Whether and to what extent the developer carefully and rigorously investigated,
documented, and accurately measured, insofar as reasonably possible given the state-of-theart, relevant risks that its model might pose.

**_Additional author’s amendments—“critical harm” and auditing. The author also proposes a_**
number of clarifying amendments to other provisions of the bill. Among other things, these
proposed amendments clarify the following aspects of the bill:

_Revised definition of “critical harm.” The bill in print includes confusing language, especially_
about AI engaging in conduct that a machine cannot commit without a brain or body, such as an
act that “would constitute a serious or violent felony under the Penal Code if undertaken by a
human with the requisite mental state.” The amendments read as follows:

(B) Mass casualties or at least five hundred million dollars ($500,000,000) of damage
resulting from cyberattacks on critical infrastructure, occurring either in a single incident or
over multiple related incidents infrastructure by a model providing precise instructions for
**_conducting a cyberattack or series of cyberattacks on critical infrastructure._**
(C) Mass casualties or at least five hundred million dollars ($500,000,000) of damage
resulting from an artificial intelligence model autonomously engaging in conduct that would
constitute a serious or violent felony under the Penal Code if undertaken by a human with the
requisite mental state both:
**_(i) Acts with limited human oversight, intervention, or supervision._**
**_(ii) Results in death, great bodily injury, property damage, or property loss, and would, if_**
**_committed by a human, constitute a crime specified in the Penal Code that requires intent,_**
**_recklessness, or gross negligence, or the solicitation or aiding and abetting of such a_**
**_crime._**
(D) Other grave harms to public safety and security that are of comparable severity to the
harms described in subparagraphs (A) to (C), inclusive.
(2) “Critical harm” does not include harms either of the following:
**_(1) Harms caused or enabled by information that a covered model outputs if the information_**
is otherwise publicly accessible from sources other than a covered model.
**_(2) Harms caused or materially enabled by a covered model combined with other software_**
**_(including other models) if the covered model did not materially contribute to the other_**
**_software’s ability to cause or materially enable the harm._**

_More robust auditing provisions. The bill in print merely requires that, “Beginning January 1,_
2028, obtain a certificate of compliance from a third-party auditor who has been accredited
pursuant to 11547.6 of the Government Code” but does not specify what information is subject
to audit and what powers an auditor has in conducting an audit. The amendments do the
following:


-----

Page 27

-  Specify what an audit report should contain in statute and clarifies the role of auditors in the

compliance process detailed in Sections 22603:

(a)(4) Ensure that the safety and security protocol is implemented as written, including by
designating senior personnel to be responsible for ensuring compliance by employees and
contractors working on a covered model, monitoring and reporting on implementation, and
conducting audits, including through third-party auditors.
. . .

(b)(4) Beginning January 1, 2028, obtain a certificate of compliance from a third-party
auditor who has been accredited pursuant to 11547.6 of the Government Code.
. . .
**_(e) (1) Beginning January 1, 2028, a developer of a covered model shall annually retain a_**
**_third-party auditor that conducts audits consistent with best practices governing auditors to_**
**_perform an independent audit of compliance with the requirements of this section._**
**_(2) The auditor shall produce an audit report including all of the following:_**
**_(A) A detailed assessment of the developer’s steps to comply with the requirements of this_**
**_section._**
**_(B) If applicable, any identified instances of noncompliance with the requirements of this_**
**_section, and any recommendations for how the developer can improve its policies and_**
**_processes for ensuring compliance with the requirements of this section._**
**_(C) A detailed assessment of the developer’s internal controls, including its designation_**
**_and empowerment of senior personnel responsible for ensuring compliance by the_**
**_developer, its employees, and its contractors._**
**_(D) The signature of the lead auditor certifying the results of the auditor._**
. . .
(f)(2)(D) Beginning January 1, 2028, a certificate of compliance from an accredited thirdparty auditor the most recent audit report pursuant to subdivision (e).

-  Clarify the Division’s role in auditing, specifying that it is to issue guidance on auditing best

practices rather than manage an accreditation process. (Section 11547.6 (e)(2)(B).)

(B) Establish an accreditation process and relevant accreditation standards under which thirdparty auditors may be accredited for a three-year period, which may be extended through an
appropriate process, to certify adherence by developers to their requirements under Section
22603 of the Business and Professions Code **_Issue guidance regarding best practices for_**
**_conducting an audit pursuant to subdivision (e) of Section 22603 of the Business and_**
**_Professions Code._**

**_Additional amendments to the bill sought by the groups that would support the bill, if_**
**_amended. Q8 Empowering Change, a 501(c)3 nonprofit organization dedicated to promoting_**
responsible and inclusive AI development supports the bill, if amended. They raises concerns
about the abstract and confusing nature of the regulations for AI developers and the bill's focus
on long-term catastrophic outcomes rather than immediate AI-enabled harms. They suggest that
the bill should concentrate solely on the creation of CalCompute as a public cloud computing
cluster. Additionally, the group recommends ensuring that CalCompute is publicly owned and
operated for public benefit, including serving California’s public universities. To prevent the
diversion of taxpayer dollars to private entities, they propose explicit language to this effect. The


-----

Page 28

group emphasizes the need for strong whistleblower protections and a private right of action to
enhance enforcement.

Additionally, the group focuses on ensuring that CalCompute remains a truly public option, free
from the influence of private donations or stakeholders. They express concerns about the limited
enforcement capabilities due to scarce budgets and potential conflicts of interest and collusion
within the Frontier Model Division. To foster public trust and enhance enforcement, they suggest
clarifying CalCompute's public ownership and operation, adding a private right of action and
whistleblower protections, and prohibiting conflicts of interest and interlocking directorates
among regulated entities. Furthermore, they recommend strengthening "know your customer"
(KYC) requirements for computing clusters and implementing ex ante structural separations
between cloud services and model services to prevent market abuse.

Oakland Privacy, which also supports the bill, if it is amended, has expressed concerns regarding
the definitions of AI safety incidents, which currently exclude those requested by users,
potentially leaving unsafe incidents unaddressed. They also highlight the lack of independent
third-party review for positive safety determinations (PSDs) and the limitation of enforcement to
the State Attorney General, without provision for a private right of action. To address these
issues, Oakland Privacy suggests removing the disclaimer in the definition of AI safety incidents,
requiring independent third-party review of PSDs, and adding a limited private right of action for
individuals harmed by critical safety incidents. Additionally, they recommend that the Frontier
Model Division (FMD) provide or coordinate third-party expert witness testimony for civil suits.

**_Exemptions sought by various industries. The healthcare/life science industry suggests an_**
exemption from the requirement to implement an emergency shutdown switch in AI systems.
They argue that AI technologies in healthcare are deeply integrated into essential medical
operations, such as diagnostics, treatment planning, and patient monitoring, and an emergency
shutdown could result in severe disruptions to patient care. They propose tailored regulations that
balance innovation with patient safety to avoid redundancy, increased compliance costs, and
deterred innovation in developing new AI applications. (California Life Science.)

The research industry, particularly academic and non-profit research institutions, recommends
an exemption from the stringent regulatory requirements of the bill. They argue that broad and
prescriptive regulations, including the requirement for emergency shutdown capabilities, could
stifle the open exchange of ideas, collaborative experimentation, and rapid development of
innovative technologies. They suggest tailored regulations that recognize the unique context of
academic research, taking into account existing ethical guidelines and review processes such as
Institutional Review Boards (IRBs) and peer review, to support the advancement of AI while
maintaining ethical standards. (Q8 Empowering Change, California Life Science.)

**_Amendments sought by opponents. Focusing on high-risk uses of AI, rather than broadly_**
_regulating all AI technologies, is a suggestion made by multiple stakeholders to improve this_
_measure. One primary recommendation is to concentrate regulatory efforts on specific_
applications of AI that have the potential to cause significant harm if misused, such as
autonomous weapons, large-scale surveillance systems, and critical infrastructure controls. (BSA
| the Software Alliance.)

Additionally, it has been suggested that the bill should encourage voluntary compliance with
safety and security measures for lower-risk AI applications. The proponents of voluntary


-----

Page 29

imposing mandatory requirements that might be unnecessary for certain applications.
Incentivizing voluntary adherence to best practices, according to industry leaders, can foster a
culture of safety and ethics within the AI community. In summary, refining this bill to focus on
high-risk AI uses involves targeting specific applications, developing a risk-based framework,
aligning with industry best practices, and encouraging voluntary compliance for lower-risk
applications. According to Abundance Institute, these suggestions aim to balance innovation
with safety, ensuring that regulatory efforts are directed where they are most needed while
supporting the broader development of AI technologies.

**_ARGUMENTS IN SUPPORT: Numerous advocacy groups and scholarly groups jointly write_**
the following in support of this bill:

California has become a vibrant hub for artificial intelligence. Universities, startups, and
technology companies are using Al to accelerate drug discovery, coordinate wildfire
responses, optimize energy consumption, uncover rare minerals that produce clean energy,
and enhance creativity. Artificial intelligence has enormous potential to benefit our state and
the world. California must act now to ensure that it remains at the forefront of dynamic
innovation in AI development.

At the same time, scientists, engineers, and business leaders at the cutting edge of this
technology — including the three most cited AI researchers of all time — have repeatedly
warned policymakers that failure to take appropriate precautions to prevent irresponsible AI
development could have severe consequences for public safety and national security.
California must ensure that the small handful of companies developing extremely powerful
AI models —including companies explicitly aiming to develop “artificial general
intelligence” — take reasonable care to prevent their models from causing very serious
harms as they continue to produce models of greater and greater power.

Taken as a whole, SB 1047 strikes a good balance in addressing a variety of crucial areas in
AI policy.

The Latino Community Foundation also writes in support:

SB 1047 introduces CalCompute, a publicly owned and operated cloud computing cluster
aimed at fostering research and development for the betterment of society. Additionally, it
mandates fair and transparent pricing and access to encourage market competition, all while
establishing sensible guidelines for developers to ensure the safe and responsible creation of
large-scale AI systems.

The technology industry is increasingly dominated by a handful of powerful corporations,
resulting in significant financial gains and substantial influence. The rise of AI is
exacerbating this trend, further consolidating power within the sector. Without equitable
access to AI tools and resources, Latino-led nonprofit organizations, along with Latino small
businesses and entrepreneurs, face the threat of being left behind in accessing vital public and
private resources to expand their operations and effectively serve communities and engage
consumers.

AI has the potential to greatly benefit California and its residents, from improving service
delivery to communities to managing wildfires and saving energy However this potential


-----

Page 30

remains unrealized if the current market dynamics continue to favor a select few
corporations. California has the opportunity and responsibility to ensure that the economic
prosperity stemming from the tech boom benefits everyone in the state.

**_ARGUMENTS IN OPPOSITION: Y Combinator, a technology startup accelerator and venture_**
capital firm, writes the following—on behalf of dozens of AI startups--in opposition to the bill:

We have carefully followed the progression of SB 1047, the Safe and Secure Innovation for
Frontier Artificial Intelligence Models Act. We acknowledge and appreciate the wellmeaning efforts to ensure AI's safe and ethical development, in particular potential for the
establishment of CalCompute and language within the bill designed to curb noncompetitive
activity. Nevertheless, the bill could inadvertently threaten the vibrancy of California's
technology economy and undermine competition. Specifically, we remain most concerned
about these aspects of the bill:

1. Liability and regulation that is unusual in its burdens: The responsibility for the misuse of
LLMs should rest with those who abuse these tools, not with the developers who create them.

2. Arbitrary Threshold for Regulation: Establishing 10[26] FLOPs as a regulatory threshold is
problematic. The technology is still evolving, and such specific metrics may not adequately
capture the capabilities or risks associated with future models.

3. The requirement of a Kill Switch is possibly a backdoor open source AI ban: While
intended to ensure safety, the mandated kill switch could function as a de facto ban on opensource AI development.

4. Vague language could be expanded or reinterpreted later to kill Californian tech: The
language is extremely vague. Most importantly, as written, a "frontier model" could plausibly
apply to existing software, like Google's search algorithm or any social media

Numerous business groups, including the California Chamber of Commerce, California
Manufacturers and Technology Association (CMTA), Civil Justice Association of California
(CJAC), Computer and Communications Industry Association (CCIA), Silicon Valley
Leadership Group, and TechNet, jointly write the following in opposition to the bill:

SB 1047 creates significant regulatory uncertainty by mandating compliance with novel
requirements that rely on standards that are overbroad, vague, and impractical, if not
infeasible. While SB 1047 is often interpreted to simply require a risk assessment of models
to avoid critical harms, doing so would dramatically misunderstand what the bill does in
practice and miscalculate the impact it will have on Californians and the economy—even in
the streamlined version. At its core, SB 1047 regulates the development of AI, seeking to
keep frontier AI developers from innovating AI models that will result in any kind of
foreseeable harm—even harms that would not manifest from the model itself. In doing so,
the bill requires developers to comply with incredibly vague, broad, impractical, if not
impossible, standards when developing “covered models” and determining whether they can
provide reasonable assurance that a covered model does not have a hazardous capability or
come close to one, creating significant regulatory uncertainty.

**REGISTERED SUPPORT / OPPOSITION:**


-----

Page 31


**Support**

Ae Studio
Ai Safety Student Team (HARVARD)
Apart Research
California State Council of Service Employees International Union (seiu California)
Cambridge Boston Alignment Initiative
Causative Labs
Center for Ai Safety Action Fund
Chapman University
Civic Ai Security Program
Consumer Watchdog
Denizen
Depict.ai
District Council of Iron Workers of The State of California and Vicinity
Economic Security Project Action
Elicit
Encode Justice
Encultured Ai
Enh Alpha LLC
Far Ai, INC.
Fathom Radiant
Foresight Institute
Forhumanity
Future of Life Institute
General Agents
General Proximity
Gladstone Ai
Higher Ground Labs
Imbue
Indivisible CA Statestrong
Kira Center for Ai Risks & Impacts
Latino Community Foundation
Lionheart Ventures
Loveable Labs Incorporated
Mit Ai Alignment
Ml Alignment & Theory Scholars
Momentum
Mythos Ventures
New Media Studio
Nonlinear
Normative
Panolia Laboratories
Panoplia Laboratories
Paper Farms
Redwood Research
Safe Ai Future
Techequity Collaborative


-----

Page 32


The Future Society
White Space Marketing Group
One individual

**Support if Amended**

American Economic Liberties Project
Electronic Frontier Foundation
Oakland Privacy

**Opposition**

8vdx
Abundance Institute
Acclamation Insurance Management Services
Adacta Labs
Aidy
Alec Action
Algolia
Allied Managed Care
Alloy Automation
American Consumer Institute
Andi
Andreessen Horowitz
Andy Ai
Anneal
Antifragile Research Dba Creatorml
Apriora
Argovox
Association of National Advertisers
Baseline Ai
Bilanc Finance INC.
Brighterway
California Chamber of Commerce
California Fuels and Convenience Alliance
California Land Title Association
California Manufacturers & Technology Association
California Manufacturers and Technology Association
Candoriq
Canonical Ai INC
Center for Data Innovation
Chamber of Progress
Chima
Circle Medical
Citron Labs
Civil Justice Association of California
Clarum
Clerky
C liti f C lif i Ch b O C t


-----

Page 33


Coalition of Small and Disabled Veteran Businesses
Cointracker
Competitive Enterprise Institute
Computer & Communications Industry Association
Computer and Communications Industry Association
Constructable
Consumer Technology Association
Context Fund
Curtsy
Cyble
Deconvolute Ai
Deferred
Dianahr
Digital First Project
Distill
Docsum
Double
Double Finance
Ecomback
Eden - Workplace Management Software
Edge
Ello
Elythea
Entori, INC
Envelope
Extensional, INC
Fetchflow
Figments Corp
Firebender Corp
Flasher Barricade Association
Flexdesk
Focal INC
Fondo
Gigaml
Gleam
Greptile
Happyrobot INC.
Hazel
Hedgy Labs
Insights Association
International Business Machines Corporation (IBM)
International Center for Law & Economics
Invert INC
Invoke Labs
Jo
K-scale Labs
Keywords Ai INC.
Kontractify, INC
Li h ki


-----

Page 34


Linc Ai
Linum
Listening.com
Local Reg
Los Angeles Area Chamber of Commerce
Los Angeles Business Federation
Los Angeles County Business Federation (BIZ-FED)
Lovecast INC Dba Stably Ai
Lumona
Markprompt
Marr Labs Technologies, INC
Martian Mobility INC. Dba Telematica
Metriport
Miru
Movley
National Federation of Independent Business
National Federation of Independent Business (NFIB)
Octolane Ai
Oneshop
Onward
Openmart
Openpod
Orange Collective
Orange County Business Council
Pabio INC.
Patched Codes, INC
Patika Technology, INC
Patterns
Persist Ai
Phonely
Picnichealth
Playground
Poll Everywhere
Preloop INC.
Query Vary
R Street Institute
Rainforest Qa, INC.
Regology INC
Rejuvenation Technologies INC
Retell Ai
Revamp Ai
Reworkd Ai
Rinsed
Rippling
Risotto
Rocketlit INC.
Rootly
San Diego Regional Chamber of Commerce
S J C i Ch b f C


-----

Page 35


Sela
Sepal Ai
Sideguide Technologies INC (known As Firecrawl)
Silicon Valley Leadership Group
Simplify
Software & Information Industry Association
Software and Information Industry Association
Sorting Robotics
Southwest California Legislative Council
Spoken
Sprx
Squire Ai
Stack Ai
Sterling Road
Storyquest, INC.
Storyworth
Sway Finance
Sync Labs
Synova Life Sciences
Tailor
Taxgpt INC
Technet
Tensor
Tesorio INC
Tracecat
Trainy
Truewind Technologies, INC.
Turbolayer INC. Dba Automatica
Turboprop
Turing Labs
Tusk
Twine
Two Dots
Up Dog
Upkeep
Viva Labs
Walrus Tech INC
Willow
Wordware
Y Combinator
Zapier
Zaymo
Zep Ai

**Oppose Unless Amended**

Answerdotai, INC
California Life Sciences


-----

Page 36


Google
Q8 Empowering Change

**Concerns**

Meta

**Analysis Prepared by:** Alison Merrilees and Nicole Larson / JUD. / (916) 319-2334


-----

