Automated decision systems.

The definition of 'consequential decision' is narrowed. Removed categories include: criminal justice (pretrial release, sentencing, alternatives to incarceration), legal services, private arbitration, mediation, elections (voting, redistricting, voter eligibility, distribution of voting information, election administration), places of public accommodation, and internet/telecommunications access. Remaining categories are: employment, education/vocational training, housing/lodging, health care/insurance, financial services, government benefits/services, and insurance.

Within the education category, 'detecting student cheating and plagiarism' and 'proctoring' are removed as covered uses. Remaining education subcategories are: assessment and placement, accreditation, certification, admissions and enrollment, discipline, and financial aid/scholarships.

All developer impact assessment requirements are eliminated. This includes the requirement to conduct initial and annual impact assessments, document accuracy/reliability, analyze disparate treatment and disparate impacts, contract with independent third-party auditors (originally scheduled to begin January 1, 2030), and make audit feedback publicly available.

The requirement for developers to designate at least one employee to oversee compliance and conduct prompt review of credible compliance issues is removed.

Developer obligations to deployers are simplified. The requirement to provide a high-level summary of impact assessment results and an explanation of deployer responsibilities (including when a deployer assumes developer duties) is removed. Developers now only need to provide: usage instructions, fine-tuning description, and technical information (now including updates after substantial modifications).

The pre-decision disclosure to subjects is simplified. Removed items include: the name/version/developer of the ADS, detailed personal characteristics and sources used, key parameters that disproportionately affect outcomes, output structure/format description, and whether a human will review outputs before finalization. The new disclosure requires: notice that an ADS will be used, whether use is within developer-approved scope, types/categories/sources of personal characteristics measured, subject's rights, and contact information.

The post-decision adverse outcome disclosure is restructured from a direct provision of all details within 5 days to a two-step process: an initial notice within 30 days describing the decision and the ADS role, plus instructions for how to request detailed information (personal characteristics measured and data sources).

The provision allowing the Attorney General to request unredacted impact assessments within 30 days (with those records exempt from the California Public Records Act) is removed, along with the related legislative findings justifying the public records limitation.

The prohibition on advertising that a covered ADS is capable of performing in a manner not substantiated by the most recent impact assessment results is removed.

The GenAI exemption is narrowed. Previously, a GenAI system was excluded if it was not 'intended or advertised to make or facilitate a consequential decision.' Now it must not be 'intended or advertised to be used by a deployer to profile a natural person in order to make or facilitate a consequential decision,' making the profiling element explicit.

The definition of 'consequential decision' is restructured. The old version defined it as a decision materially impacting cost, terms, quality, or accessibility of listed services. The new version adds language about 'a decision, determination, or action made about a natural person that relates to the provision of or a natural person's access to, eligibility for, selection for, or compensation for' the listed categories, making the person-centric framing more explicit.

The definition of 'covered ADS' is narrowed to require that the system be used 'to profile a natural person in order for the deployer to make or facilitate a consequential decision.' Previously, any ADS designed or used to make or facilitate a consequential decision was covered. This new profiling requirement excludes systems that merely assist decisions without evaluating or predicting outcomes specific to an individual.

A new definition of 'GenAI system' is added, and a new exemption states that a covered ADS does not include a GenAI system that is not intended or advertised to make or facilitate a consequential decision. This carves out general-purpose generative AI tools like chatbots and image generators from regulation.

The GLBA exemption is narrowed from covering any developer subject to GLBA who uses a covered ADS for financial services decisions, to covering only developers subject to GLBA 'with respect to a covered ADS that is intended to make or facilitate a consequential decision related to financial services.'

The list of exclusions from the definition of 'automated decision system' is expanded to include spreadsheets and document validation or authenticity tools, and 'identity and access management tool' is broadened to 'identity and verification or access management tool.'

A new definition of 'profile' is added: using a covered ADS that both receives personal information of a subject as input and issues a simplified output (score, classification, or recommendation) to evaluate the subject or predict outcomes specific to the subject.

The term 'performance evaluation' is replaced throughout with 'impact assessment,' changing the terminology used for the required developer assessments of covered ADS systems.

References to 'each disparate treatment' and 'each disparate impact' are changed to 'each category of disparate treatment' and 'each category of disparate impact,' which could affect how developers document and assess discriminatory effects.

The subject opt-out right is entirely removed. The previous version required deployers to give subjects a reasonable opportunity to opt out of the use of a covered ADS before finalizing a consequential decision, with limited exceptions for GLBA-covered financial services and medical emergencies. This provision no longer appears in the amended text.

Developer-to-deployer transparency is reduced: developers must now provide only 'a high-level summary of the results' of the most recent impact assessment rather than the full results of the performance evaluation.

Developer evaluation triggers are simplified. The previous version specified evaluations were required after substantial modifications, after fine-tuning that materially changes outputs, and annually. The new version requires only an initial assessment (before January 1, 2027 for pre-2026 systems; before initial deployment for post-2026 systems) and then annually thereafter, removing the specific modification and fine-tuning triggers.

The method for providing pre-decision disclosures to subjects is expanded to allow a 'generalized notice on the deployer's internet website' in addition to an automatic reply mechanism, potentially reducing the specificity of individual notifications.

Document retention period for developers is reduced from 10 years to 5 years after the developer stops deploying or making available the covered ADS.

Third-party audit timing is specified: audits must be completed within six months of the most recent impact assessment and every two years after the initial audit (which begins January 1, 2030).

The term 'performance evaluation' is replaced throughout with 'impact assessment,' shifting the focus of developer obligations from measuring system accuracy and reliability to assessing broader impacts on affected individuals, including disparate treatment and disparate impact analysis.

A new definition of 'adverse outcome' is added, covering decisions that deny, terminate, revoke, or materially restrict access to opportunities or services, as well as decisions imposing materially less favorable differentiated pricing or terms compared to similarly situated persons.

A new definition of 'FERPA' (the federal Family Educational Rights and Privacy Act of 1974) is added, suggesting potential interaction with or exemption related to federal education privacy law.

The post-decision disclosure requirement for deployers now only applies when a consequential decision 'results in an adverse outcome,' rather than applying to all consequential decisions. This significantly narrows the scope of situations triggering the obligation.

The deadline for deployers to provide post-decision disclosures to subjects is extended from five days to thirty days after finalizing a consequential decision that results in an adverse outcome.

Documentation retention period for developers is reduced from ten years to five years (measured from when the developer stops deploying or making available the covered ADS).

Developers are now required to provide potential deployers with instructions explaining how the covered ADS should be used to make or facilitate a consequential decision, in addition to the existing documentation requirements.

The bill now adds Section 51.1.1 to the Civil Code rather than amending existing Section 51, changing how the legislation interfaces with California's Unruh Civil Rights Act.

'Detecting student cheating and plagiarism' appears to have been removed from the list of education-related consequential decisions, narrowing the scope of covered educational uses.

The requirement for developers to contract with an independent third-party auditor to assess compliance is now delayed until January 1, 2030, rather than being effective immediately upon the bill's operative date.

A new exemption (subdivision (j) of Section 22756.1) removes developers subject to the federal Gramm-Leach-Bliley Act from the developer requirements when they use a covered ADS for financial services consequential decisions.

A new provision allows deployers to provide the pre-decision opt-out disclosure using an automatic reply mechanism, giving deployers flexibility in how they deliver this notice.

The phrase 'annually thereafter' was added as a standalone statement in the performance evaluation timing provision, making the recurring annual evaluation obligation more explicit and prominent.

A new subdivision requires that a deployer which is a business subject to the California Consumer Privacy Act of 2018 must also comply with any privacy-related opt-out and access regulations adopted by the California Privacy Protection Agency under Section 1798.199.40 of the Civil Code.

Amendment markup showing the threshold change from 5,999 to 6,000 people for deployer audit obligations was cleaned up to simply read 'more than 6,000 people' without the strike-through notation.

New subdivision (s) added to Section 22756 stating that the bill's definitions of 'disparate impact' and 'disparate treatment' are intended solely for internal compliance, risk assessment, and documentation purposes, and shall not modify or supersede any standard, burden of proof, or element of a claim under the Unruh Civil Rights Act, the California Fair Employment and Housing Act, Title VII of the Civil Rights Act, or any other applicable civil rights law.

The definition of 'covered automated decision system' (subdivision d) was narrowed from 'an automated decision system that makes or facilitates is designed or used to make or facilitate a consequential decision' to 'an automated decision system that is designed or used to make or facilitate a consequential decision,' removing the actual 'makes or facilitates' language and focusing on design and intended use.

Performance evaluation documentation requirements in Section 22756.1(b) were restructured: disparate treatment and disparate impact assessment items were consolidated into subparts (C) and (E) of a single item, removing redundant restatements of the definitions (e.g., 'Whether the covered ADS is intended to treat individuals or groups differently on the basis of a protected characteristic' was removed as it simply restated the definition).

The pre-decision disclosure in Section 22756.2(a)(1)(G) no longer references subdivision (c) (post-decision disclosure rights), changing from 'the subject's rights under subdivisions (b) and (c) (d)' to 'the subject's rights under subdivisions (b) and (d).'

Section 22756.1(g) documentation retention period was clarified from 'for as long as the covered ADS remains deployed or developer deploys the covered ADS or makes the covered ADS available to potential deployers plus 10 years' to 'for as long as the developer deploys the covered ADS or makes the covered ADS available to potential deployers plus 10 years,' removing redundant language.

Multiple instances of garbled or duplicated text from the prior amendment were cleaned up, including in the definitions of 'deployer' and 'developer,' the post-decision disclosure timing language in Section 22756.2(c)(1), and the appeal review provision in Section 22756.2(d)(2)(B).

The definition of 'automated decision system' was changed from 'that is used to assist or replace human discretionary decisionmaking' to 'that is designed or used to assist or replace human discretionary decisionmaking.' This means a system that is merely designed for this purpose is now covered, even if not yet actively used.

The definition of 'covered ADS' was changed from 'an automated decision system that makes or facilitates a consequential decision' to one that 'is designed or used to make or facilitate a consequential decision,' similarly broadening coverage to systems designed but not yet deployed.

A new definition of 'credit score' was added, referencing Civil Code sections 1785.15.1 and 1785.3, indicating the bill now specifically addresses credit scoring systems.

The definitions of 'deployer' and 'developer' were narrowed from 'either directly or through a third party' to 'either directly or by contracting with a third party for that/those purposes,' requiring a specific contractual relationship rather than any indirect use.

Insurance was added as a new category of consequential decision (item 15), bringing insurance underwriting and related decisions within the bill's regulatory scope.

Internet and telecommunications access was added as a separate consequential decision category (item 16), in addition to its prior listing under essential services. This gives it independent regulatory significance.

A new requirement was added obligating developers to make a high-level summary of auditor feedback publicly available at no cost on their website, increasing transparency about audit findings.

The disparate treatment and disparate impact documentation requirements in performance evaluations were restructured from 'assess whether any disparate treatment is intended to occur and document all of the following' to 'Whether any disparate treatment is intended to occur and document and, if so, all of the following,' conditioning detailed documentation on the existence of disparate treatment or impact.

Coauthors were added (Assembly Members Aguiar-Curry, Bryan, Ortega, Ward), indicating broader legislative support for the bill.

Senator Padilla was added as a coauthor, indicating Senate sponsorship support for the bill.

Enumeration formatting was cleaned up in several sections (22756.1(d), 22756.1(f), and 22756.1(b)(4)): redundant letter designations (A, B, C, D) were removed where numbered items already existed, leaving only the numeric designators.

A stray drafting artifact (a line containing only the letter 'I') was removed from Section 22756.1(b)(4).

Page numbers were renumbered throughout (from 97 to 96) and internal line numbering was adjusted, reflecting standard legislative formatting updates after the Senate amendment.