AB1018 - Automated decision systems.

Amended IN Senate August 28, 2026 Amended IN Senate August 21, 2026 Amended IN Senate September 05, 2025 Amended IN Senate July 17, 2025 Amended IN Senate July 03, 2025 Amended IN Assembly May 01, 2025 Amended IN Assembly April 10, 2025 CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Assembly Bill No. 1018 Introduced by Assembly Member Bauer-Kahan (Coauthors: Assembly Members Aguiar-Curry, Bryan, Ortega, and Ward) (Coauthor: Senator Padilla) February 20, 2025 An act to add Chapter 24.6 (commencing with Section 22756) to Division 8 of the Business and Professions Code, to add Section 51.1.1 to the Civil Code, and to add Article 3 (commencing with Section 12959) to Chapter 6 of Part 2.8 of Division 3 of Title 2 of the Government Code, relating to artificial intelligence. LEGISLATIVE COUNSEL'S DIGEST AB 1018, as amended, Bauer-Kahan. Automated decision systems. The California Fair Employment and Housing Act establishes the Civil Rights Department within the Business, Consumer Services, and Housing Agency and requires the department to, among other things, bring civil actions to enforce the act. Existing law requires, on or before September 1, 2024, the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. This bill would generally regulate the development and deployment of an automated decision system (ADS) used to make consequential decisions, as defined. The bill would define “automated decision system” to mean a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is designed or used to assist or replace human discretionary decisionmaking and materially impacts natural persons. This bill would require a developer of a covered ADS, as defined, to take certain actions, including providing a potential deployer instructions explaining how the covered ADS should be used by the deployer to make or facilitate a consequential decision. This bill would require a deployer of a covered ADS to take certain actions, including provide certain disclosures to a subject of a consequential decision made or facilitated by the covered ADS that results in an adverse outcome, as defined, and provide the subject with an opportunity to appeal the outcome of the consequential decision, as prescribed. This bill would authorize certain public entities, including the Attorney General, General to bring a specified civil action for noncompliance. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill Text The people of the State of California do enact as follows: SECTION 1. Chapter 24.6 (commencing with Section 22756) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 24.6. Automated Decisions Safety Act 22756. As used in this chapter: (a) “Adverse outcome” means either of the following: (1) A decision that denies, terminates, revokes, or materially reduces or restricts a natural person’s access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service. (2) A decision that results in materially less favorable differentiated price, cost, compensation, or other material terms that are reasonably likely to materially limit, delay, or effectively deny, or otherwise fundamentally alter, a natural person’s access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service compared to terms offered to similarly situated natural persons. If a decision outcome imposes materially less favorable differentiated pricing or terms, the decision outcome materially impacts price, cost sharing, compensation, or material terms. (b) “Artificial intelligence” means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. (c) (1) “Automated decision system” means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is designed or used to assist or replace human discretionary decisionmaking and materially impacts natural persons. (2) “Automated decision system” does not include a spam email filter, firewall, antivirus software, identity verification or access management tool, calculator, database, dataset, spreadsheet, document validation or authenticity tool, or other compilation of data or information. (d) “Consequential decision” means a decision that materially impacts the cost, terms, quality, or accessibility of any of the following to a natural person: decision, determination, or action made about a natural person that relates to the provision of or a natural person’s access to, eligibility for, selection for, or compensation for any of the following: (1) Employment-related decisions. (2) Education and vocational training as they relate to any of the following: (A) Assessment and placement. (B) Accreditation. (C) Certification. (D) Admissions and enrollment. (E) Discipline. (F) Financial aid and scholarships. (3) Housing and lodging as they relate to any of the following: (A) Rental or short-term housing and lodging. (B) Home appraisals. (C) Rental subsidies. (D) Publicly supported housing. (4) Health care and health insurance, including mental health care, dental, and vision. (5) Financial services, including a financial service provided by a mortgage company, mortgage broker, or creditor. (6) Access to government benefits or services. (7) Insurance. (e) (1) “Covered ADS” means an automated decision system that is designed for, or used by, a deployer to profile a natural person in order for the deployer to make or facilitate a consequential decision. (2) “Covered ADS” does not mean a GenAI system that is not intended or advertised to be used by a deployer to profile a natural person in order to make or facilitate a consequential decision. (f) “Credit score” means a credit score, as defined in Section 1785.15.1 of the Civil Code, from a consumer credit reporting agency, as defined in Section 1785.3 of the Civil Code. (g) “Deployer” means a person, partnership, state or local government agency, corporation, or developer that uses a covered ADS to make or facilitate a consequential decision, either directly or by contracting with a third party for that purpose. (h) “Developer” means a person, partnership, state or local government agency, corporation, or deployer that designs, codes, substantially modifies, or otherwise produces an automated decision system that makes or facilitates a consequential decision. (i) (1) “Developer-approved use” means a deployment context in which a developer intends a covered ADS to make or facilitate a consequential decision. (2) “Developer-approved use” includes any reasonably foreseeable fine-tuning of the covered ADS. (j) “Disparate impact” means a differential effect on a group of individuals who share a protected characteristic. (k) “Disparate treatment” means differential treatment of an individual or group of individuals on the basis of a protected characteristic. (l) “Employment-related decision” means a decision made by an employer, either directly or through a third party, that affects wages, benefits, other compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks and responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, or other terms or conditions of employment. (m) (1) “Express consent” means an affirmative written authorization that is granted in response to a notice that is both of the following: (A) Clear, meaningful, and prominent. (B) Conveyed in a manner that a natural person would notice and understand it. (2) “Express consent” does not include an authorization that is any of the following: (A) Inferred from inaction. (B) Obtained through the use of a dark pattern, as defined in Section 56.18 of the Civil Code. (C) Contained within a more general notice, agreement, or set of terms and conditions. (n) “FERPA” means the federal Family Educational Rights and Privacy Act of 1974 (20 U.S.C. Sec. 1232g et seq.). (o) “Fine-tune” means to adjust the model parameters of an automated decision system through exposure to additional data. (p) “GenAI system” means an artificial intelligence system that can generate derived synthetic content, including text, images, video, and audio, that emulates the structure and characteristics of the system’s training data. (q) “Labor Commissioner” means Chief of the Division of Labor Standards Enforcement. (r) (q) “Personal information” has the same meaning as defined in Section 1798.140 of the Civil Code. (s) (r) “Profile” means to use a covered ADS that does both of the following: (1) Receives, as input data, the personal information of a subject of the consequential decision. (2) Issues a simplified output, including a score, classification, or recommendation, in order to evaluate the subject or predict outcomes specific to the subject. (t) (s) “Protected characteristic” means a characteristic listed in subdivision (b) of Section 51 of the Civil Code. (u) (t) (1) “Substantial modification” means a new version, release, update, or other modification to a covered ADS that materially changes its uses or outputs. (2) “Substantial modification” does not include a modification that results from fine-tuning. (v) (u) “Trade secret” has the same meaning as in Section 3426.1 of the Civil Code. (w) (v) The definitions of “disparate impact” and “disparate treatment” provided in subdivisions (i) and (j) are intended solely for purposes of internal compliance, risk assessment, and documentation required by this chapter. These definitions shall not be construed to modify or supersede any standard, burden of proof, or element of a claim under the Unruh Civil Rights Act (Section 51 of the Civil Code), the California Fair Employment and Housing Act (Part 2.8 (commencing with Section 12900) of Division 3 of Title 2 of the Government Code), Title VII of the Civil Rights Act of 1964 (42 U.S.C. Sec. 2000e et seq.), or any other applicable civil rights law. 22756.1. (a) A developer that sells, licenses, or otherwise transfers a covered ADS to a potential deployer shall provide the deployer with all of the following: (1) For each developer-approved use of the covered ADS, instructions explaining how the covered ADS should be used by the deployer to make or facilitate a consequential decision. (2) For each developer-approved use of the covered ADS, a description of whether and under what circumstances the covered ADS can be fine-tuned. (3) Any technical information necessary for the deployer to comply with this chapter. chapter, including any changes to the information provided under paragraphs (1) and (2) if a substantial modification is made to the covered ADS. (b) A developer that provides documentation to a deployer pursuant to this section shall ensure the documentation is all of the following: (1) Transmitted directly to the deployer or otherwise made available in a manner reasonably calculated to ensure the deployer receives the documentation. (2) Provided in English and in any other language the developer regularly uses to communicate with deployers. (3) Presented in a manner that ensures the communication clearly and effectively conveys the required information to the deployer. (c) A developer that deploys a covered ADS or makes a covered ADS available to potential deployers shall maintain both of the following documentation in an unredacted format for as long as the developer deploys the covered ADS or makes the covered ADS available to potential deployers plus five years: (1) Any documentation provided to deployers pursuant to this chapter. (2) Records of any redactions made pursuant to this chapter. (d) This section does not apply to a developer subject to the federal Gramm-Leach-Bliley Act (15 U.S.C. Sec. 6801 et seq.) with respect to a covered ADS that is intended to make or facilitate a consequential decision related to financial services, as described in paragraph (7) of subdivision (c) of Section 22756. 22756.2. (a) (1) Except as provided in paragraph (2), before a deployer finalizes a consequential decision made or facilitated by a covered ADS used by the deployer, the deployer shall provide any subject of that decision with a plain language written disclosure containing all of the following information: clear and conspicuous notice to a subject that the deployer used, or will use, a covered ADS in a consequential decision affecting the subject and instructions regarding how the subject may obtain the following information: (A) A statement informing the subject that a covered ADS will be used to make or facilitate the consequential decision. (B) Whether the deployer’s use of the covered ADS is within the scope of a developer-approved use and a description of that use. (C) (A) The types, categories, and sources of personal characteristics or attributes of the subject that the covered ADS measures or assesses to make or facilitate the consequential decision. (D) The subject’s rights under subdivision (c) and the means and timeframe for exercising those rights. (E) (B) (i) Contact information for the deployer. (ii) Contact information for the entity that manages the covered ADS, if that entity is not the deployer. (iii) Contact information for the entity that will interpret the results of the covered ADS, if that entity is not the deployer. (2) Paragraph (1) does not apply if the subject of the consequential decision is having a medical emergency. (3) The disclosure made pursuant to this subdivision may be made through a generalized notice on the deployer’s internet website or by using an automatic reply mechanism. (b) (1) If a deployer finalizes a consequential decision made or facilitated by a covered ADS that results in an adverse outcome, the deployer shall provide any subject of that decision with a plain language written disclosure containing all of the following information within thirty 30 days: (A) A plain language description of the consequential decision and the role the covered ADS played in the consequential decision. (B) Instructions and a simple-to-follow process to request the following information: (A) (i) The personal characteristics or attributes of the subject that the covered ADS measured or assessed to make or facilitate the consequential decision. (B) (ii) The [Text truncated for display. Full text available on Congress.gov.]