Critical infrastructure: artificial intelligence systems: human oversight.

New Section 8592.52 adds an AI adverse event reporting requirement applicable to any entity (not just state agencies) that engages in conduct that could materially impact critical infrastructure safety, security, or operations.

The human oversight requirement in Section 8592.51 was narrowed from applying to any operator deploying artificial intelligence to only those deploying AI that could materially impact critical infrastructure safety, security, or operations.

Removed the declaration of legislative intent to enact subsequent legislation prohibiting artificial intelligence from making or executing plans on critical infrastructure without human oversight.

New definition of 'AI adverse event' covering death, serious physical injury, significant disruption lasting more than one hour, unauthorized data access affecting more than 100 individuals, material financial loss over $50,000, system failure requiring manual intervention, or failures that could reasonably lead to mass casualty events.

Tiered reporting deadlines: within 4 hours for ongoing urgent threats to public health or safety, 24 hours for death or serious injury, 72 hours for significant disruption or data compromise, and 14 calendar days for all other AI adverse events.

Civil penalty of up to $500 for each seven-day period an entity fails to submit a required AI adverse event report.

The Office of Emergency Services is authorized to allow voluntary participation by non-operator entities, share individual or aggregated event information with public or private entities, and post information on its website.

Added legislative findings and declarations (new Section 1) referencing Executive Order N-12-23, the Joint California Policy Working Group on AI Frontier Models, and its 2025 report recommending adverse event reporting mechanisms.

Added confidentiality provisions (Section 8592.52(f)) limiting disclosure of enforcement records that are privileged, copyrighted, exempt under the Public Records Act, or where non-disclosure interest outweighs disclosure interest, along with constitutional findings required for public records limitations.

Fiscal committee vote changed from 'no' to 'yes,' indicating the bill now has an identified fiscal impact likely due to the new reporting and enforcement infrastructure.

The document was reformatted from a traditional legislative bill layout (with line numbers, page headers like 'SB 833 -2-', and formal section numbering) into a web page format that includes site navigation (home, accessibility, FAQ, sitemap), search tools, version tracking links, and social sharing options. The actual statutory text is unchanged.

Added new Section 8592.51 to the Government Code, converting the bill from a pure intent statement into operative law that applies to state agencies in charge of critical infrastructure (defined as 'operators').

Added an exception: the human oversight requirement does not apply to existing automated decision systems critical to state infrastructure if the required oversight would cause an immediate pause that would destabilize that system.

Added definitions for 'artificial intelligence' (engineered or machine-based system with varying autonomy), 'automated decision system' (computational process using ML, statistical modeling, data analytics, or AI that materially impacts natural persons, excluding spam filters, firewalls, antivirus, identity management tools, and calculators), 'critical infrastructure' (systems vital to public health, safety, economic security including transportation, energy, food/agriculture, communications, emergency services, financial services), and 'operator' (a state agency in charge of critical infrastructure).

Requires operators deploying AI to establish a human oversight mechanism that monitors system operations in real time AND reviews and approves any plan or action proposed by the AI before execution.

Requires the Department of Technology to administer specialized training in AI safety protocols and risk management techniques for oversight personnel.

Requires operators to conduct annual assessments of their AI systems and automated decision systems covering compliance, system performance and safety, and identification of potential risks and vulnerabilities including those that could lead to mass casualty events.

Requires operators to submit a summary of assessment findings to the Department of Technology, and requires the assessment to coincide with any existing risk analysis obligation under Section 11549.65(b).

The fiscal committee designation changed from 'no' to 'no yes,' indicating a fiscal note is now required due to the new operative obligations imposed on state agencies.