Annual discrimination impact assessments for consequential decisions

Right to opt out of solely automated decisions and appeal

AG enforcement and private right of action

AI systems with 1M+ monthly users must disclose AI-generated content

Use of AI/ADS that discriminates in employment decisions violates FEHA

Bias audit quality and recency evaluated as evidence in discrimination claims

Retain ADS-related records for at least 4 years

Vendor liability extends to agents acting on behalf of employers

Complete impact assessment before deploying high-risk AI systems

Use reasonable care to protect consumers from algorithmic discrimination

Notify consumers when high-risk AI makes or substantially contributes to consequential decisions

Provide consumers with an opportunity to appeal adverse AI decisions

Publish a public statement summarizing AI systems in use and risk management

Developers must provide deployers with documentation and disclosures

Notify Attorney General within 90 days of discovering algorithmic discrimination

Insurers must demonstrate algorithms do not unfairly discriminate

Maintain governance framework for algorithmic fairness in insurance

Disclose use of personal data to train AI/LLM systems

Notify candidates and obtain consent before AI-analyzed video interviews

Delete video recordings within 14 days of candidate request

Employers may not use AI that has the effect of discriminating against protected classes

Employers may not use ZIP codes as a proxy for protected characteristics in AI systems

Notify employees and applicants when AI is used for employment decisions

Civil rights violation — actual damages, civil penalties, attorneys' fees

Written consent required for facial recognition in employment screening

Discriminatory outcomes from AI tools violate the LAD regardless of intent

Employers liable for vendor AI tools that produce discriminatory results

Annual independent bias audit before AEDT deployment

Publish bias audit results on employer website for 2+ years

Notify candidates at least 10 business days before AEDT use

Up to $1,500 per violation per day

Large developers must publish safety protocols and implement risk-mitigation frameworks

Report safety incidents to the State within 72 hours

Civil penalties up to $1M (first) / $3M (subsequent violations)

Prohibited AI uses: self-harm, discrimination, constitutional rights, CSAM

Government entities must disclose AI interaction to consumers before use

Safe harbor for NIST AI RMF compliance and internal red-team testing

Tiered penalties: $10K–$200K per violation, $2K–$40K per day continuing

Disclose AI use to consumers when asked or prompted

Regulated professionals must prominently disclose AI use in advance

Cannot avoid liability by blaming AI; fines up to $2,500–$5,000 per violation