AI Frontier Institute

High-risk artificial intelligence systems: duty to protect personal information.

View primary source →

California Senate Bill 468 (SB 468), introduced by Senator Becker on February 19, 2025, adds Title 1.81.28 (commencing with Section 1798.91.2) to the Civil Code, imposing a duty on 'covered deployers'—businesses that deploy high-risk artificial intelligence systems processing personal information—to protect that personal information. Under Section 1798.91.3, covered deployers must develop, implement, and maintain a comprehensive written information security program containing administrative, technical, and physical safeguards scaled to the deployer's size, resources, data volume, and confidentiality needs. The program must meet detailed requirements, including: designating employees to maintain the program; identifying and assessing internal and external risks; ongoing employee and contractor training; disciplinary measures for policy violations; restricting terminated employee access; supervising third-party service providers by contract; physical access restrictions; regular monitoring and at least annual review; post-incident documentation and review; and technical controls such as secure authentication, access controls, encryption of transmitted and stored data, firewall protection, and malware protection. Violations of these provisions constitute a deceptive trade act or practice under the Unfair Competition Law (Chapter 5, commencing with Section 17200 of the Business and Professions Code). Section 1798.91.4 authorizes the California Privacy Protection Agency to adopt regulations under the Administrative Procedure Act to implement the title, with fee-related regulations exempt from that Act. The Legislature declares the bill furthers the California Privacy Rights Act of 2020.

← Back to the tracker