California Assembly Moves SB 1047 Closer to Governor

On August 28, 2024, the California Assembly passed SB 1047 and returned it to the Senate before it could reach the governor. The official legislative record preserves text, versions, votes and history: it is the source for distinguishing which duty existed at each stage and what was not yet law.

The bill has not yet completed its legislative journey. The California Senate, which approved an earlier version in May, must now accept the changes introduced by the Assembly. If it does so before the legislative session ends, on August 31, the bill will go to Governor Gavin Newsom, who can sign or veto it.

Which models would be affected

SB 1047 does not target every company that incorporates AI into a product. It focuses on systems trained using more than 10^26 operations or whose training compute costs exceed $100 million in constant 2023 dollars. These are thresholds associated with frontier models. Source

In practice, the measure targets the large labs capable of creating general-purpose models comparable to those powering leading chatbots and generative assistants. It also covers certain models derived from those systems when they meet the conditions and thresholds set out in the bill.

The law seeks to address a specific problem: a highly advanced model can be useful for writing code, researching drugs, or automating complex tasks, but its capabilities could also facilitate serious cyberattacks or the creation of chemical, biological, radiological, or nuclear weapons. The bill calls these scenarios catastrophic harm: the death or serious injury of more than 50 people, or property damage exceeding $500 million. Source

Testing, protocols, and the ability to shut down a model

Developers covered by the law would have to publish a safety framework before deploying their models. The document must explain what tests they conduct to detect dangerous capabilities, what safeguards they apply, and how they will assess risks before releasing a new version.

They would also have to retain the ability to deactivate a model if they identify a significant danger. Informally known as a kill switch, this requirement does not mean a company could erase every copy of a system from the internet once it has been distributed. It applies to systems the developer directly controls, such as models offered through its own servers.

The bill would also require developers to report security incidents to California’s attorney general and provides penalties for companies that fail to meet their obligations. The latest amendments removed one of the most controversial parts of the initial proposal: allowing private individuals to sue companies directly.

A split in the tech industry

The debate has divided companies and experts who often share concerns about excessive regulation. Anthropic has backed the amended version of the bill, saying the changes address several of its initial objections. Elon Musk has also expressed support for California regulating advanced AI safety.

On the opposing side are OpenAI, Meta, Google, and numerous startups and venture capital funds. Their main criticism is that California would be imposing costly requirements before a common federal standard exists. They fear that legal liability and the obligation to anticipate extreme uses could hamper smaller companies or lead developers to avoid launching their models in the state.

That objection has an important limitation: because of the compute and cost thresholds, the law would not currently affect most companies that use third-party models or modest open projects. The real conflict concerns who should bear responsibility when a lab creates systems with capabilities that can spread rapidly across the economy.

California regulates where Washington does not

California cannot turn SB 1047 into a national law, but its influence in technology means the decision will carry weight beyond its borders. The state is home to a large share of the major AI labs, investors, and platforms on which the industry is built.

The debate also foreshadows a question Washington has yet to resolve: whether it is enough to require transparency after an incident occurs, or whether developers of the most capable models should have to demonstrate, before releasing them, that they have assessed the most serious risks. The Senate’s response and, afterward, Newsom’s decision will determine whether California opens that regulatory path in the United States.

A bill is read by version, verb and addressee

A bill number identifies a file, not immutable text. Every amendment may change thresholds, definitions, liability or authority. Before summarising a duty, preserve the date and version, locate the verb—shall, may, report—and name the obligated entity. A vote on an earlier version does not automatically approve a later one.

The useful table has columns for trigger, duty, deadline, supervisor, penalty and evidence of compliance. It distinguishes a protocol a company must retain from a report it must publish or a power granted to an agency. “Regulates AI” is too broad to tell a reader what changes.

A threshold selects subjects; it does not measure all risk

Cost and compute can be administrable data for identifying frontier developers, but they are not equivalent to dangerousness. A small model in critical infrastructure may create a different harm; a large one used in closed research has another exposure. Scope and use assessment address complementary problems.

Model capability and an adapter’s actions must also be separated. If a duty follows a model after modification, the text must define how much change counts and who retains information. Without traceability, a chain of versions diffuses responsibility.

The transferable skill is to turn any technology bill into a matrix of version, subject, trigger, duty and control. It lets you compare arguments about the real text rather than a caricature and update the article when the file changes.

The file shows what happened and when

The legislative page collects versions, votes and actions, allowing the state on a particular date to be reconstructed. Today’s displayed text must not replace the historical one: a later amendment may change the claim. Saving document and date protects truth of era.

Public arguments can be classified by the mechanism they challenge. Some dispute the threshold, others liability, compliance costs or technical evaluation capacity. Saying only “the industry opposed it” discards the testable reason and combines incompatible positions.

From duty to audit method

For every obligation, ask which evidence would demonstrate compliance: a signed report, test log, incident protocol or supervisor decision. If the text defines no minimum quality, keeping a document may comply formally without reducing risk. Describe that gap rather than filling it with attributed intent.

Definitions are part of the mechanism. “Covered model”, “incident” or “critical risk” determine when a rule activates. A serious summary connects definition to duty and presents interpretive uncertainty as uncertainty, without turning it into legal judgment.

Keep the same matrix across jurisdictions. Different names may hide equivalent duties, while a shared word may cover opposite scopes. The method avoids calling a rule stricter merely because its language sounds more severe.

The checklist does not replace legal advice. It locates the exact sentence, frames a verifiable question and shows when a conclusion requires a specialist or a later decision by the courts.