California has no comprehensive AI statute for banks like Colorado's ADMT Act — the Automated Decisions Safety Act (AB 1018) was not among the bills sent to the Governor when the Legislature adjourned on August 31, 2026 — but it now has two targeted AI statutes plus three other binding instruments that reach them. Governor Newsom signed AB 1609 (customer-service chatbot disclosure and human hand-off, businesses over $500 million in revenue) on September 28, 2026 and SB 947 (the 'No Robo Bosses Act,' barring sole reliance on automated decision systems for employee discipline or termination) on September 30, 2026; both take effect in 2027. The California Privacy Protection Agency's regulations on automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits were approved September 22, 2025 and took effect January 1, 2026: businesses using ADMT to make 'significant decisions', a category that lists financial or lending services first, must give pre-use notice, an opt-out or human-appeal route, and an explanation on request from January 1, 2027, with risk-assessment attestations due to the Agency by April 1, 2028 and the first cybersecurity-audit certifications due the same day for businesses over $100 million in revenue. What narrows this for banks is the CCPA's data-level exemption (Civil Code §1798.145(e)): personal information subject to the Gramm-Leach-Bliley Act sits outside the statute, so the rules bite hardest on employment, marketing and non-GLBA data rather than on the credit decision itself. The Civil Rights Council's regulations on automated decision systems in employment (in force since October 1, 2025) and the Attorney General's January 2025 advisory that existing consumer-protection, civil-rights and credit-reporting law already applies to AI complete the picture.
| Full name | State of California — California Privacy Protection Agency (CCPA/CPRA automated decisionmaking, risk-assessment and cybersecurity-audit regulations), Attorney General and other public prosecutors (CCPA, SB 53, AB 1609 chatbot law), Civil Rights Council (FEHA automated-decision-system regulations), and Labor Commissioner (SB 947 'No Robo Bosses Act') |
| Role | State jurisdiction whose AI rules are split across several enforcers: privacy-agency automated decisionmaking rules that reach lending, deposit and employment decisions, plus targeted statutes on chatbots, frontier models and workplace automated decisions — the most-cited state AI rules after Colorado's |
| Force on banks | Binding law |
| Applies to | Businesses over the CCPA thresholds (about $25 million in annual revenue, inflation-adjusted, or personal information of 100,000+ consumers or households) — including banks, credit unions and lenders for personal information that is not subject to GLBA or the California Financial Information Privacy Act; and, separately, any employer with five or more California employees using automated decision systems in hiring, promotion or pay |
| Key document | CPPA regulations on cybersecurity audits, risk assessments and automated decisionmaking technology (11 CCR §§ 7001, 7120–7124, 7150–7157, 7200–7222; approved Sep 22, 2025, effective Jan 1, 2026; ADMT obligations from Jan 1, 2027) |
| Latest move | Governor Newsom signed AB 1609 (customer-service chatbot disclosure and human hand-off, businesses over $500M revenue) on September 28, 2026 (Chapter 733) and SB 947 (the 'No Robo Bosses Act' — bars sole reliance on automated decision systems for employee discipline or termination) on September 30, 2026 (Chapter 859); AB 1018 did not pass the Legislature. ADMT obligations for significant decisions apply from Jan 1, 2027 |
| Documents tracked | 7 · all documents → |
The CPPA's 2025 package is the operative text. 'ADMT' is technology that processes personal information and uses computation to replace or substantially replace human decisionmaking — a business that keeps a human reviewer who understands the output, actually reviews it and can change the outcome is not using ADMT in the regulatory sense. A 'significant decision' is one that results in the provision or denial of financial or lending services, housing, education, employment or independent-contracting opportunities, or health-care services; 'financial or lending services' is defined to cover the extension of credit or a loan, transmitting or exchanging funds, deposit or checking accounts, check cashing and installment plans. Where ADMT is used for such a decision the business must give a pre-use notice, honor an opt-out (or instead offer an appeal to a qualified human reviewer), and on request explain the logic, the output and how it was used. Using ADMT for a significant decision also triggers a documented risk assessment before the processing starts.
For a bank the scoping question is the exemption, not the definition. The CCPA exempts personal information that is collected, processed, sold or disclosed subject to the Gramm-Leach-Bliley Act, the California Financial Information Privacy Act or the Farm Credit Act — at the level of the data, not the institution. In its Final Statement of Reasons the Agency declined to add an entity-level financial-institution exemption precisely because the statute already provides a data-level one. At a GLBA-covered lender the application, bureau, account and adverse-action data behind a credit decision is that data, so the ADMT article largely does not reach the credit decision. It does reach employee and applicant data (inside the CCPA since January 1, 2023), prospect and advertising data, non-GLBA product lines, and model-training data; mixed-input models remain the unresolved edge.
Two further instruments matter. The Civil Rights Council's regulations under the Fair Employment and Housing Act, in force since October 1, 2025, make it unlawful for an employer with five or more employees to use an automated decision system that discriminates on a protected basis, treat anti-bias testing as relevant evidence, extend liability to vendors acting as the employer's agent, and require four-year retention of ADS records — directly relevant to bank HR screening tools. The Attorney General's January 13, 2025 legal advisory states that the Unfair Competition Law, False Advertising Law, CCPA, Unruh Civil Rights Act, FEHA and the Consumer Credit Reporting Agencies Act already govern AI, and singles out AI used 'to evaluate consumers' credit risk and guide loan decisions' as a use that must still produce specific adverse-action reasons. California's Department of Financial Protection and Innovation has issued no AI-specific guidance for the institutions it licenses.
What has the State of California actually published on AI?
| Date | Document | Status |
|---|---|---|
| Sep 30, 2026 | SB 947 — Employment: Automated Decision Systems (No Robo Bosses Act) | Final · applies from Jul 1, 2027 |
| Sep 28, 2026 | AB 1609 — Customer Service Chatbots (Right to Human Customer Service Act) | Final · applies from Jan 1, 2027 |
| Sep 29, 2025 | California SB 53 (Transparency in Frontier AI Act) — Senate Bill 53: Artificial intelligence models: large developers (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025 | In force |
| Sep 22, 2025 | CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6) | In force |
| Jun 27, 2025 | Civil Rights Council ADS employment regulations — Modifications to Employment Regulations Regarding Automated-Decision Systems (Fair Employment and Housing Act regulations, 2 CCR) | In force |
| Jan 13, 2025 | California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence | Final |
| Jun 28, 2018 | Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) — California Consumer Privacy Act — exemptions, including the data-level exemption for information subject to the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act (Civil Code §1798.145) | In force |
| Date | Type | Document / event |
|---|---|---|
| Jan 1, 2027 | Milestone | CPPA ADMT obligations for significant decisions apply. The CPPA package approved on September 22, 2025 took effect January 1, 2026 (see the regulations document); its ADMT requirements for significant decisions (pre-use notice, opt-out or human appeal, access to an explanation) apply from January 1, 2027. Risk-assessment attestations and the first cybersecurity-audit certifications are due April 1, 2028. source ↗ |
| Sep 30, 2026 | Statute | SB 947 — Employment: Automated Decision Systems (No Robo Bosses Act). SB 947, signed by Governor Newsom on September 30, 2026 (Chapter 859, Statutes of 2026) and operative July 1, 2027, adds Part 5.5.5 (Sections 1520–1526.7) to the Labor Code. source ↗ |
| Sep 28, 2026 | Statute | AB 1609 — Customer Service Chatbots (Right to Human Customer Service Act). AB 1609, signed by Governor Newsom on September 28, 2026 (Chapter 733, Statutes of 2026) and operative January 1, 2027, adds Chapter 22.6.1 (Sections 22625–22629) to the Business and Professions Code. source ↗ |
| Aug 31, 2026 | Milestone | Legislature adjourns: AB 1018 not passed; chatbot and workplace-ADS bills go to the Governor. The Automated Decisions Safety Act (AB 1018), which would have required pre-deployment bias evaluations of automated decision systems used for consequential decisions including lending, was not among the AI bills sent to the Governor. AB 1609 (customer-service chatbot disclosure and 15-minute human hand-off at businesses over $500 million in revenue) and SB 947 (worker protections for automated decision systems) were; the Governor had until September 30, 2026 to act — see the AB 1609 and SB 947 documents above for the outcome. |
| Sep 29, 2025 | Statute | California SB 53 (Transparency in Frontier AI Act) — Senate Bill 53: Artificial intelligence models: large developers (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025. California SB 53, the Transparency in Frontier Artificial Intelligence Act, was approved by the Governor on September 29, 2025 (Chapter 138) and takes effect January 1, 2026. source ↗ |
| Sep 22, 2025 | Regulation | CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6). Adopted by the California Privacy Protection Agency board on July 24, 2025, approved by the Office of Administrative Law on September 22, 2025 and operative January 1, 2026, this package adds three articles to the CCPA regulations: annual cybersecurity audits (Article 9), risk assessments (Article 10) and automated decisionmaking technology (Article 11). source ↗ |
| Jun 27, 2025 | Regulation | Civil Rights Council ADS employment regulations — Modifications to Employment Regulations Regarding Automated-Decision Systems (Fair Employment and Housing Act regulations, 2 CCR). Approved by the Office of Administrative Law and filed June 27, 2025, and in force since October 1, 2025, the Civil Rights Council's regulations state that using an automated-decision system that discriminates against applicants or employees on a basis protected by the Fair Employment and Housing Act is unlawful. source ↗ |
| Jan 13, 2025 | Guidance | California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence. On January 13, 2025 Attorney General Rob Bonta issued a legal advisory stating that California's existing laws already govern the development and use of AI. source ↗ |
| Jun 28, 2018 | Statute | Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) — California Consumer Privacy Act — exemptions, including the data-level exemption for information subject to the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act (Civil Code §1798.145). Section 1798.145 of the Civil Code lists what the California Consumer Privacy Act (enacted June 28, 2018, operative January 1, 2020, and amended by the California Privacy Rights Act from January 1, 2023) does not reach. source ↗ |
Which of the 120 largest US banks answer to the State of California on AI?
13 of the 120 bank pages on this site name the State of California among the authorities their AI programme answers to. Each page lists the documents that apply and why.
Which fintechs does the State of California supervise or license?
1 of the 56 fintech and neobank pages on this site name the State of California as a direct supervisor or licensing authority. Each page sets out the AI programme and the rules that apply to it.
- Jan 1, 2027: AB 1609's chatbot disclosure and human hand-off duties and SB 947's employment groundwork take effect alongside ADMT obligations (pre-use notice, opt-out or human appeal, access explanation) for significant decisions; how the CPPA treats mixed GLBA/non-GLBA model inputs, which the Final Statement of Reasons left open
- Jul 1, 2027: SB 947's bar on sole reliance on an ADS for employee discipline or termination becomes operative, requiring human corroboration and postuse notice
- Apr 1, 2028: risk-assessment attestations and summaries for 2026–27 processing, and the first cybersecurity-audit certifications for businesses over $100M in revenue (Apr 1, 2029 for $50–100M; Apr 1, 2030 below $50M)
- Whether AB 1018 or a successor bias-evaluation bill returns in the 2027 session, and any CPPA enforcement action that tests the data-level GLBA exemption
- Whether the Department of Financial Protection and Innovation issues AI guidance under the California Consumer Financial Protection Law
Do California's ADMT regulations apply to banks?
Only partly. The regulations cover automated decisionmaking technology used for significant decisions, which expressly include financial or lending services. But the CCPA exempts personal information subject to the Gramm-Leach-Bliley Act at the data level (Civil Code §1798.145(e)), so at a GLBA-covered lender the credit decision itself is largely outside the rules. Employment decisions, marketing data, non-GLBA products and model-training data remain inside.
When do California's ADMT rules take effect?
The regulations took effect January 1, 2026. Businesses using ADMT for significant decisions must comply with the notice, opt-out and access requirements from January 1, 2027. Risk-assessment attestations are due to the CPPA by April 1, 2028.
Does California have an AI law like Colorado's ADMT Act?
Not a single comprehensive one, but it is closing the gap with targeted statutes. The Automated Decisions Safety Act (AB 1018) did not pass by the August 31, 2026 adjournment, but Governor Newsom signed AB 1609 (customer-service chatbot disclosure, effective Jan 1, 2027) on September 28, 2026 and SB 947 (the 'No Robo Bosses Act,' barring sole reliance on an ADS for discipline or termination, effective Jul 1, 2027) on September 30, 2026. Combined with the CPPA's privacy regulations, the Civil Rights Council's employment ADS rules, and existing consumer-protection and civil-rights law, California now regulates AI in banking through several overlapping statutes rather than one Colorado-style act.
Follow every move these regulators make
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning