CA SB468: High-risk artificial intelligence systems: duty to protect personal information.

In one paragraph

California's SB 468 (Becker) would add Civil Code Title 1.81.28 requiring a business that deploys a high-risk AI system (a high-risk automated decision system) that processes personal information to develop, implement and maintain a written comprehensive information security program. A violation would be a deceptive trade act under the Unfair Competition Law. Held in Senate Appropriations May 23, 2025; returned to the Secretary of the Senate under Joint Rule 56 on February 2, 2026; it did not pass the Senate.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None: the bill did not pass. It would have required businesses deploying high-risk automated decision systems that process personal information to maintain a written information security program.

Key provisions

1. 1Covered deployer: a business that deploys a high-risk AI system that processes personal information; high-risk AI system has the meaning of 'high-risk automated decision system' in Gov. Code 11546.45.5 (Civ. Code 1798.91.2)
2. 2Would impose a duty to protect personal information and require a written information security program with administrative, technical and physical safeguards suited to the deployer's size, scope, resources, data held and need for security (1798.91.3(a)-(b))
3. 3Program must designate responsible employees, assess foreseeable risks, train employees and contractors, supervise third-party service providers by contract, restrict physical access, and monitor the program (1798.91.3(c))
4. 4Program must be reviewed at least annually and on material business changes, and document post-incident review of any security breach
5. 5To the extent feasible, program must include secure authentication and access controls, encryption of data sent over public networks or wirelessly and stored on laptops or portable devices, firewalls, security patches and malware protection
6. 6A violation would be a deceptive trade act or practice under the Unfair Competition Law (1798.91.3(d)); the California Privacy Protection Agency could adopt implementing regulations (1798.91.4)
7. 7Introduced February 19, 2025; passed Senate Judiciary 11-0 on April 22, 2025; held on the Appropriations suspense file May 23, 2025; returned under Joint Rule 56 February 2, 2026

Latest legislative action

Feb 2, 2026. Returned to Secretary of Senate pursuant to Joint Rule 56.

Sponsors

Roll call votes