On January 13, 2025 Attorney General Rob Bonta issued a legal advisory stating that California's existing laws already govern the development and use of AI. It maps the Unfair Competition Law (Bus. & Prof. Code §17200), the False Advertising Law (§17500), the CCPA (Civ. Code §1798.100 et seq.), the Unruh Civil Rights Act (Civ. Code §51), the Fair Employment and Housing Act (Gov. Code §12900 et seq.) and the Consumer Credit Reporting Agencies Act (Civ. Code §1785.1 et seq.) onto AI uses, and names AI used to evaluate credit risk and guide loan decisions among the uses that must still produce specific reasons for adverse actions. A companion advisory the same day addressed AI in health care.
| Document | California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence |
| Issued by | California — Privacy Protection Agency (CCPA/CPRA automated decisionmaking, risk-assessment and cybersecurity-audit regulations), Attorney General, and Civil Rights Council |
| Type | Guidance |
| Status | Final |
| Published | Jan 13, 2025 |
| Applies to | Any entity that develops, sells or uses AI systems affecting Californians — expressly including businesses using AI 'to evaluate consumers' credit risk and guide loan decisions' |
| Official source | oag.ca.gov ↗ |
| Use cases | Fair lending & discrimination · Credit scoring & underwriting · Customer-facing chatbots · Data & privacy · AI governance (general) |
What are the key points of California AG legal advisory on AI (Jan 2025)?
- Names credit and lending directly: 'Businesses are using AI systems to evaluate consumers' credit risk and guide loan decisions, screen tenants for rentals, and target consumers with ads and offers'
- Adverse-action reasons: cites the federal Fair Credit Reporting Act and Equal Credit Opportunity Act and the California Consumer Credit Reporting Agencies Act as requiring specific reasons 'including when AI was used to make the determination'
- Treats undisclosed or deceptive AI use, unsubstantiated performance claims and AI-driven pricing or eligibility discrimination as potential UCL, FAL, Unruh or FEHA violations
- Applies the CCPA's purpose-limitation, transparency and consumer-rights provisions to AI training and profiling, and reminds businesses that AI-generated personal information is personal information
- The CFPB circular it relies on for the adverse-action point (Circular 2023-03) was withdrawn by the Bureau on May 12, 2025 — the statutory duty under ECOA/Reg B and FCRA is unaffected, and the state-law analysis stands
What did California AG legal advisory on AI (Jan 2025) change for banks?
The advisory is the clearest statement by a state enforcer that lenders' AI is already regulated under general law, independent of any AI-specific statute. It gives the Attorney General a stated theory for UCL and Unruh actions against discriminatory or opaque credit models, and it matters more since the CFPB's 2025 withdrawal of its AI circulars and 2026 removal of ECOA disparate-impact liability moved the fair-lending frontier to the states.
Is the California AG advisory binding?
It is an interpretation, not a rule — but it states how the Attorney General will apply binding statutes (UCL, FAL, CCPA, Unruh, FEHA, CCRAA) to AI, and those statutes are enforceable by the AG, district attorneys and, for several, private plaintiffs.
What does the advisory say about credit decisions?
That businesses using AI to evaluate credit risk or guide loan decisions must still provide specific reasons for adverse actions under FCRA, ECOA and the California Consumer Credit Reporting Agencies Act, and that discriminatory outcomes can violate Unruh and the UCL.
| Date | Document | Status |
|---|---|---|
| Sep 22, 2025 | CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6) | In force |
| Jun 27, 2025 | Civil Rights Council ADS employment regulations — Modifications to Employment Regulations Regarding Automated-Decision Systems (Fair Employment and Housing Act regulations, 2 CCR) | In force |
| Jun 28, 2018 | Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) — California Consumer Privacy Act — exemptions, including the data-level exemption for information subject to the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act (Civil Code §1798.145) | In force |
| Aug 11, 2026 | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) | Comment period open |
| May 14, 2026 | SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) | Final |
| Apr 22, 2026 | Regulation B final rule on disparate impact (April 2026) — Equal Credit Opportunity Act (Regulation B) — final rule amending disparate impact, discouragement and special purpose credit program provisions | In force |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →