A new bill to regulate AI is working its way through committees in the California legislature.

Here are a few points of the proposed law (AB331), which would impact business with 25 or more employees, unless the tool impacts at least 1,000 people per year.

1) Annual impact assessments: (starting 1/1/25)

• Instead of relying on an independent third-party audit, developers and users of the tool would each need to submit annual impact assessments to the California Civil Rights Department by 2025.
• The assessments would have to include how an automated decision tool is being used, what data is being collected, the purpose, what safeguards are in place, what potential adverse impacts may result, how the tool bill be used by people and how the tool was evaluated.
• A new assessment needs to be made each time there is a significant update.

2) Governance: Implement a governance program that contains reasonable administrative and technical safeguards to map, measure, manage and govern the reasonably foreseeable risks of algorithmic discrimination associated with the use or intended use of an automated decision tool

3) Disclosure: Write a publicly available policy that lists the types of automated tools used and how the company manages the risk of illegal discrimination.

4) Opt out: If a “consequential” decision is made solely based on AI, an affected individual would have a right to opt out if the request was “technically feasible.”

5) Prohibited use in a manner that contributes to algorithmic discrimination

Remedies:

• Civil Rights Department can impose a $10,000 fine each day an impact assessment is not submitted
• Privacy right of action (starting 1/1/26)
• Potential injunction unless violation is corrected within 45 days