Property tax: welfare exemption: detention facilities.

The entire Chapter 24.6 of the Business and Professions Code (Sections 22756 through 22756.8) was deleted. This chapter established definitions for automated decision systems, required impact assessments before deploying high-risk AI systems, mandated governance programs, prohibited deployment of systems likely to cause algorithmic discrimination, required notice to affected individuals, and provided enforcement mechanisms including civil penalties up to $25,000 per violation.

Article 11 of the Public Contract Code (Section 10285.8) was deleted. This section prohibited state agencies from awarding contracts for high-risk automated decision systems unless the vendor certified compliance with civil rights laws and the AI chapter.

The bill's stated purpose changed from 'relating to artificial intelligence. taxation' to simply 'relating to taxation,' reflecting that it is now exclusively a tax measure.

All legislative findings related to artificial intelligence were removed, including findings about AI's impact on privacy, equity, fairness, public safety, and the need for comprehensive AI rights protections.

Enforcement provisions authorizing the Attorney General or Civil Rights Department to bring civil actions, impose tiered civil penalties ($2,500/$5,000/$10,000 based on employee count), grant injunctive relief, and allow 45-day cure periods were all removed.

Coauthors were expanded: Assembly Member Gipson was added as principal coauthor, and additional Senate and Assembly coauthors were listed, suggesting the bill was reconstituted around the narrower tax provision with new legislative support.

Fiscal committee answer changed from 'yes' to 'no' and state-mandated local program changed from 'yes' to 'no,' consistent with removing the AI provisions that would have imposed compliance costs on local agencies.

New Section 214.12 added to the Revenue and Taxation Code specifying that property operated as a detention facility by a for-profit entity is not eligible for the welfare property tax exemption under Section 214. The bill declares this is declaratory of, not a change in, existing law.

Co-authors Senators McNerney and Umberg added, with Senator Perez listed as a coauthor, broadening legislative sponsorship of the bill.

For high-risk automated decision systems first made publicly available before January 1, 2026, the Senate version required an impact assessment only if the developer made a substantial modification. The Assembly version replaces this with a flat deadline: developers must perform an impact assessment on or before January 1, 2028 regardless of whether modifications were made.

Civil penalties expanded: a new provision adds $500 per day for each day of intentional noncompliance, and a new $25,000 per-violation penalty is added specifically for violations involving algorithmic discrimination.

The cure process was simplified and expanded. The Senate version required the entity to provide an express written statement under penalty of perjury that the violation was cured. The Assembly version removes the perjury requirement and instead lists factors the Attorney General or Civil Rights Department should consider when deciding whether to allow a cure: lack of intent, voluntary pre-notification cure efforts, and the size and economic resources of the noncompliant entity.

Several sections were renumbered and restructured. The impact assessment content requirements previously embedded in Section 22756.1(c) are moved to a new standalone Section 22756.2. The notification/disclosure section becomes 22756.3, the governance program section becomes 22756.4, and the governance program requirements are reorganized into five numbered sub-items.

Fiscal notes changed from 'Fiscal committee: yes' to 'Fiscal committee: no' and 'State-mandated local program: yes' to 'State-mandated local program: no,' likely reflecting the removal of the perjury-based cure provision that had triggered the state-mandated local program finding.

Added a deadline of January 1, 2028 by which developers must perform an impact assessment if they make a substantial modification to a high-risk automated decision system that was first made publicly available before January 1, 2026.

Expanded the governance program requirements in Section 22756.4 to mandate alignment with existing standards including the NIST AI Risk Management Framework, specification of principles and personnel for risk mitigation, regular review and updating, and a structural framework for documenting, investigating, and resolving incidents.

Added a requirement that if a developer or deployer withholds disclosure on trade secret grounds, they must notify the party who would have received the disclosure of the basis for withholding it.

Added a discretionary cure provision allowing the Attorney General or Civil Rights Department to grant additional time to cure a violation after considering factors including lack of intent, voluntary pre-notification cure efforts, size and economic resources of the violator, and scope of impact.

Changed the state agency contracting rule in Section 10285.8 from prohibiting contracts with persons who have violated civil rights laws to allowing contracts unless the awardee has certified that the system does not violate those laws, shifting from a past-violation ban to a forward-looking certification requirement.

Removed Section 2, which expressed the Legislature's intent to enact legislation strengthening, establishing, and promoting rights and values related to artificial intelligence. The remaining sections were renumbered accordingly.

Changed the definition of 'developer' from one who 'substantially modifies' a high-risk automated decision system to one who 'makes a substantial modification to' it, a minor grammatical adjustment that may affect how the threshold for developer status is interpreted.

The bill now applies to developers and deployers of 'high-risk automated decision systems' - computational processes using machine learning, statistical modeling, data analytics, or AI that materially impact natural persons in areas including education, employment, housing, health care, lending, essential utilities, legal rights, and government services. Systems performing only narrow procedural tasks, enhancing human activities, detecting patterns without influencing outcomes, or assisting in preparatory assessment tasks are excluded.

Developers must perform an impact assessment before making a high-risk automated decision system publicly available (for systems made available on or after January 1, 2026). Deployers must perform an impact assessment within two years of deploying such a system. The impact assessment must include statements about purpose, intended outputs, data inputs, foreseeable disproportionate impacts on protected classifications, safeguards against algorithmic discrimination, and monitoring plans.

Deployers must notify natural persons when a high-risk automated decision system is used to make a decision about them, disclosing the purpose, how it was used, data types, contact information, and a link to a website statement. Deployers must also maintain a public website statement summarizing their use of such systems and how they manage discrimination risks.

Deployers must provide, as technically feasible, an opportunity for a natural person subject to a decision made by a high-risk automated decision system to appeal that decision for review by a natural person.

Developers and deployers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to govern reasonably foreseeable risks of algorithmic discrimination, scaled to the size, complexity, and resources of the entity.

A developer or deployer is prohibited from deploying or making available a high-risk automated decision system if the impact assessment determines it is likely to result in algorithmic discrimination. An exception allows deployment if safeguards are implemented to mitigate the known risks, but an updated impact assessment must then verify the discrimination has been mitigated.

Entities with 50 or fewer employees are exempt from the entire chapter. High-risk automated decision systems approved, certified, or cleared by a federal agency under a law that is substantially the same or more stringent are also exempt.

The Attorney General or Civil Rights Department may bring civil actions for violations. Penalties include $2,500 (fewer than 100 employees), $5,000 (fewer than 500 employees), or $10,000 (500+ employees) for failure to conduct an impact assessment, plus $500 per day for intentional noncompliance. A separate $25,000 per violation penalty applies for algorithmic discrimination. Injunctive relief and attorney's fees are also available.

A 45-day cure period is provided: before filing suit, the Attorney General or Civil Rights Department must give written notice of the alleged violation, and if the developer or deployer cures within 45 days and provides a sworn statement, no action may be maintained for that violation.

State agencies are prohibited from awarding a contract for a high-risk automated decision system to any person who has violated the Unruh Civil Rights Act, the California Fair Employment and Housing Act, or the new Chapter 24.6.

The impact assessment requirement applies to high-risk automated decision systems made publicly available on or after January 1, 2026. For systems first made available before that date, an impact assessment is only required if a substantial modification is made. Deployers of systems first deployed after January 1, 2026 have two years to complete their impact assessment.

New definitions added for: algorithmic discrimination, artificial intelligence, automated decision system, deployer, developer, education enrollment or opportunity, employment or employment opportunity, health care, high-risk automated decision system, protected classification, state agency, substantial modification, and several exclusionary terms.

State agencies that are deployers may opt out of performing their own impact assessment if they use the system only as intended by the developer, do not make substantial modifications, the developer is in compliance with the public contract provision, the agency has no reasonable basis to believe deployment will result in algorithmic discrimination, and the agency complies with the governance program requirement.