What does California SB 53 (Transparency in Frontier AI Act) say about AI in banking?

What are the key points of California SB 53 (Transparency in Frontier AI Act)?

• Adds Chapter 25.1 (commencing with Section 22757.10) to Division 8 of the Business and Professions Code; the Act also adds Government Code §11546.8 (CalCompute) and Labor Code Chapter 5.1 (commencing with §1107) on whistleblowers. Approved by the Governor and filed September 29, 2025 as Chapter 138.
• §22757.11 definitions: a 'frontier model' is a foundation model trained using more than 10^26 integer or floating-point operations (including fine-tuning and reinforcement learning); a 'large frontier developer' is a frontier developer that, with its affiliates, had annual gross revenues above $500,000,000 in the preceding calendar year; 'catastrophic risk' means a foreseeable and material risk of death or serious injury to more than 50 people or more than $1 billion in damage from a single incident.
• §22757.12(a)–(b): a large frontier developer must write, implement, comply with and publish a frontier AI framework covering ten topics (standards, thresholds, mitigations, third-party assessment, cybersecurity for model weights, incident response, internal governance and others), review it at least annually, and publish material changes with a justification within 30 days.
• §22757.12(c): before or concurrently with deploying a new or substantially modified frontier model, every frontier developer must publish a transparency report (website, contact mechanism, release date, languages, output modalities, intended uses, restrictions); large frontier developers must add summaries of catastrophic-risk assessments, results and third-party involvement. A model or system card can satisfy it.
• §22757.12(d)–(e): large frontier developers must send the Office of Emergency Services a summary of catastrophic-risk assessments from internal use every three months (or another agreed schedule); no materially false or misleading statements about catastrophic risk or, for large developers, about compliance with their framework.
• §22757.13: critical safety incidents must be reported to the Office of Emergency Services within 15 days of discovery, or within 24 hours to an appropriate authority where there is an imminent risk of death or serious physical injury; reports are exempt from the California Public Records Act, and the Office produces anonymized annual reports from January 1, 2027.
• §22757.15: a large frontier developer that fails to publish or transmit required documents, makes a prohibited statement, fails to report an incident or fails to follow its own framework faces a civil penalty of up to $1,000,000 per violation, recoverable only in a civil action by the Attorney General.
• Labor Code §1107.1 protects covered employees who disclose catastrophic-risk dangers or violations and requires large frontier developers to run an anonymous internal reporting process; §5 of the Act preempts local rules on frontier developers' management of catastrophic risk adopted on or after January 1, 2025, and says it does not apply to the extent preempted by federal law.

What did California SB 53 (Transparency in Frontier AI Act) change for banks?

SB 53 is a California statute aimed squarely at frontier AI developers, built on transparency and incident reporting rather than prescriptive safety standards. It does not change any obligation for banks. Its practical significance for them is on the supply side: the frontier labs that supply foundation models to banks must now publish a safety framework and a transparency report for each new model, which gives vendor-risk and model-risk teams a standardized document to request and compare. It is not a substitute for a bank's own model validation, and it creates no contractual or notice right against the developer.

What does California SB 53 require, and does it apply to banks?

California SB 53, the Transparency in Frontier Artificial Intelligence Act (Business and Professions Code §§22757.10–22757.16), requires frontier developers, meaning those training foundation models with more than 10^26 operations, to publish transparency reports for new models and report critical safety incidents to the Office of Emergency Services within 15 days. Large frontier developers, with more than $500 million in annual revenue, must also publish and follow a frontier AI framework, review it annually, send quarterly summaries of internal-use risk assessments to the Office, and avoid materially false statements about catastrophic risk. Violations carry civil penalties up to $1 million each, enforced by the Attorney General. SB 53 does not apply to banks as users of AI; a bank is covered only if it trains a frontier model, so its effect on banks is indirect, through the disclosures its AI vendors must now make.

SB 53 is a disclosure and incident-reporting statute, not a safety standard: it does not prescribe what a developer's framework must conclude, only that the developer publish one, follow it and not misstate it. The compute threshold of 10^26 operations and the $500 million revenue test mean it reaches only a handful of the largest model developers; the Department of Technology must recommend by January 1, 2027 whether to update the definitions. The Act states its duties are cumulative with other law and does not apply to the extent preempted by federal law or in conflict with a federal contract.

Banks sit downstream. They are 'users' of frontier models, not developers, so SB 53 gives them no direct obligations and no right to receive incident reports, which go to the Office of Emergency Services and are exempt from public-records disclosure. The statute also does not override a bank's own supervisory expectations for third-party risk and model risk management; it adds a published framework and a transparency report per model that a bank can request and read.

SB 53 should be read next to New York's RAISE Act, which follows the California model with a shorter incident window and a new DFS oversight office, and to California's other AI rules, notably the California Privacy Protection Agency's ADMT regulations, which are the instruments that reach bank decisions about customers and employees.

WHAT THIS MEANS IN PRACTICE

• Do not treat SB 53 as a compliance obligation for the bank; record it in the AI vendor-risk file as a source of vendor disclosures instead.
• When onboarding a frontier model, request the vendor's published frontier AI framework and transparency report and map them to your third-party risk and model validation checklist.
• Add contract terms requiring the vendor to notify the bank of incidents that affect it, because SB 53 sends critical safety incident reports to California's Office of Emergency Services, not to customers.
• Check each vendor's thresholds: a developer under 10^26 operations or $500 million in revenue may fall outside the Act, so its absence of an SB 53 framework is not itself a red flag.
• Keep the bank's own validation, explainability and fair-lending testing in place; vendor safety disclosures about catastrophic risk do not address credit bias, accuracy or conduct risks.