AI regulation in California: the Privacy Protection Agency, the Civil Rights Council, and state procurement.
Agency decisions shape how policy works in practice. Explore the institutions and policy matters relevant to AI organizations, then discuss the proceedings affecting your business.
Who writes and enforces the rules.
- California Privacy Protection Agency (CPPA)Rulemaking and enforcement on automated decision-making technology, risk assessments, and cybersecurity audits.
- Civil Rights CouncilEmployment regulations on automated-decision systems.
- DMHC and the Department of InsuranceAI in utilization review and claims.
- GO-Biz and the Government Operations AgencyState AI procurement and vendor certification under Executive Order N-5-26.
- Attorney GeneralEnforcement, and age-assurance rulemaking that intersects with AI-driven age signals.
Rulemakings, programs, and enforcement in 2026.
- CPPA ADMT rulesRulemakingAutomated decision-making, risk assessment, and cybersecurity audit regulations. Effective January 1, 2026. Significant-decision obligations phase in from January 1, 2027; assessment and audit reporting deadlines run through April 2029. In effect, phasing in.
- Civil Rights CouncilRulemakingEmployment regulations on automated-decision systems. Employers with five or more employees, four-year recordkeeping on automated-decision data, no AI-based medical inquiries. Effective October 1, 2025.
- EO N-5-26ProgramState AI vendor certification and procurement standards. Executive order directing agencies to build certification and procurement frameworks and expand state use of AI. Signed March 30, 2026; standards in development.
Discuss your California
policy priorities.
Tell us what is changing for your organization.
We’ll discuss the representation and scope you need.