Operator-honest translation of SB 53 · AB 853 · SB 243 · AB 2013 · AB 621 · SB 524 — who's affected, when each takes effect, and what your business actually has to do. Built for the NCSD founder shipping AI features who needs the legal text translated into a punch-list, not another 60-page memo.
Fastest-hitting at top. Run the matcher quizzes below to map your specific stack against the regulations.
| Bill | What it regulates | Who's affected | Effective |
|---|---|---|---|
| SB 243 | Companion chatbot disclosure + minor protections | Any consumer-facing chatbot operator | Oct 2024 |
| AB 621 | Non-consensual deepfake pornography damages | Image-gen platforms · content hosts | Oct 2025 |
| SB 53 | Frontier AI safety reporting + risk disclosure | Large frontier AI developers | Jan 2026 |
| AB 2013 | Generative AI training data transparency | Companies training/distributing genAI models | Jan 2026 |
| AB 853 | AI-generated content detection + disclosure | AI providers · platforms · device makers (phased) | Aug 2026+ |
| SB 524 | AI disclosure in police reports | LE agencies · LE-adjacent SaaS vendors | Per agency |
4-sentence summary · who's actually in scope · what to do this quarter.
Any chatbot — customer support, mental health, companion AI, retail concierge — must give clear and conspicuous notification that the user is talking to AI, not a human. For chatbots accessible to minors, the notification must repeat every three hours, and suicide-prevention protocols must be in place. Reporting requirements layer in by 2027.
If you ship a chatbot of any kind to California consumers, you're in scope. B2B-internal chatbots have softer requirements but disclosure is still best practice. "Talk to a human" escalation paths are no longer optional for any consumer surface.
Non-consensual sexualized deepfake content triggers statutory damages of $1,500 to $50,000 per violation, with up to $250,000 for malicious conduct. Liability attaches to creators AND distributors of the content, which includes platforms that knowingly host or facilitate generation.
If your platform has any technical capacity to generate intimate imagery — image-gen API, stable-diffusion wrapper, content-hosting with user uploads — you need detection workflows + takedown processes + user-reporting mechanisms documented and operational. "We didn't know" is not a defense once you have notice.
Large frontier-AI developers must publish redacted risk evaluations and safety protocols, and report safety incidents within 15 days. Penalties scale up to $1 million per unreported incident. The "frontier" trigger is compute-based — only the largest training runs are in scope, not every AI-using business.
Direct scope: OpenAI, Anthropic, Google DeepMind, Meta, xAI, and any startup training models above the compute threshold. Indirect scope: if you build on top of these vendors' models, your enterprise customers will start asking for evidence your vendor is compliant. The procurement question shifts upstream — buyers will ask you to prove your AI stack's compliance.
Companies that train, fine-tune, or distribute generative AI models must publicly disclose data sources, copyright usage, personal information involvement, and dataset origins. This is a transparency-not-prohibition law — you don't have to use only licensed data, but you must document and disclose what you used.
Direct scope: model trainers, fine-tuners, distributors. Indirect scope: enterprise procurement teams will start requiring AB-2013-style disclosures from vendors as part of vendor onboarding. If you only USE genAI APIs (call OpenAI/Anthropic/Google), you're not directly subject — but your vendor due-diligence questionnaire just got longer.
Phased rollout of AI-content detection + disclosure obligations. AI providers must offer detection tools by August 2026; platforms (social media, content hosts) must surface disclosure mechanisms by January 2027; device manufacturers (cameras, phones) must support detection metadata by January 2028. The goal: a chain-of-custody on AI-generated media that operators downstream can rely on.
Direct scope: anyone shipping AI-generated images, video, audio, text to California users. Indirect scope: anyone hosting user-generated AI content. If your SaaS uses AI to generate customer-facing content — marketing copy, summaries, image gen, voice synthesis — the August 2026 deadline applies to you.
Each page of an official police report must disclose if AI was used in its creation, and document the tools used + changes the AI made to the original content. Direct subject: California law enforcement agencies. Indirect subject: SaaS vendors selling AI-assisted report writing, transcription, summarization, or evidence analysis to police departments.
If you sell into LE/public safety with any AI feature, your product needs to surface and log the AI-assist for the disclosure requirement — visible in the exported report, auditable in your system, traceable back to the model + prompt version. This is product-level scope, not just a policy doc.
Patterns SideGuy has seen in conversations with NCSD founders shipping AI features. Honest read of where the law-vs-business gap usually breaks.
Most AI-law coverage is written for the SF-based foundation model company with a 30-person legal team. That's not the Encinitas / Cardiff / Solana Beach founder shipping AI features into a SaaS.
The actual NCSD operator shipping AI is more like: 1-5 person team, half-remote, founder is the CTO + the security questionnaire respondent + the AI-feature owner all at once, working out of Better Buzz on Encinitas Blvd or the SCA WeWork-style spaces, with one or two enterprise prospects in the pipeline that just started asking about CA AI law compliance for the first time.
For that operator, the AI-law question is rarely "should we comply" — it's "which 3 laws actually hit me, what's the punch-list, and can I scope it in a weekend instead of hiring a $50K compliance consultant." The 6 law breakdowns + the 5 misreads above + the matcher quizzes below are the answer.
And the geography matters: PJ is Encinitas-based — coffee at Better Buzz, Lofty, Java Hut, or Dark Horse is a 60-minute thing. Founder to founder, not vendor to prospect.
Tell me your stage, AI surfaces (chatbot · image gen · summarization · genAI training · LE sales), and which enterprise prospects are asking. I'll give you the tight 3-laws-that-actually-apply read for your specific stack + the punch-list. Founder-to-founder, no Calendly.
📲 Text PJ · 858-461-8054
Text PJ
858-461-8054