California just closed its 2026 legislative session with the biggest single-month package of AI and privacy laws any state has enacted. Between September 9 and September 16, Governor Newsom signed the nation's first AI auditing framework, a disclosure law for AI-generated performers in advertising, a ban on companion chatbots in toys, a workplace neural surveillance ban and a replacement for the state's children's design code. Then, on September 18, he issued an executive order pushing the oversight framework even faster. With the legislature adjourned, Newsom has until September 30 to decide the fate of more than 30 AI-related measures. If your firm or practice advertises online, runs a website chatbot, uses AI tools on client or patient data, or monitors staff with software, at least one of these laws may be relevant to your operations. What follows is general information about what was signed, not legal advice for any specific situation.
California AI Auditing Framework: SB 813 and AB 1405 Explained
On September 9, Governor Newsom signed Senate Bill 813 and Assembly Bill 1405, establishing first-in-the-nation standards for third-party audits and independent assessments of AI systems. SB 813 makes California the first state to establish a framework for certifying independent verification organizations with sufficient expertise and demonstrated independence from AI companies to objectively assess AI systems for safety and risk, while AB 1405 establishes a state registry for AI auditors and standards for their independence, transparency and integrity.
The dates matter. AB 1405 requires the Government Operations Agency to establish an AI Auditor Registry by January 1, 2029, and beginning that date, unregistered persons may not offer, sell or conduct a covered AI audit. Registered auditors must also display their registration number in advertisements for covered audits.
Notably, this is not a law the industry fought. Anthropic endorsed the bills, and OpenAI announced its support in the hours before Newsom's signing. Whatever happens in other states, the practical point for a practice owner is that "our AI is audited" is set to become a regulated claim in California. When a legal tech or health tech vendor tells you its model has been independently assessed, you will eventually be able to ask who did the audit and whether they are registered.
SB 1050: Synthetic Performer Disclosure Rules for Advertisers
This is the one marketers should flag first. SB 1050, signed by Governor Newsom on September 16, 2026, makes it unlawful for any person to create and publish an advertisement that prominently includes a synthetic performer without meeting the law's disclosure requirements.
AI-generated presenters are now cheap and everywhere. Law firms use AI avatars for explainer videos, and medical practices are experimenting with AI presenters for patient education and recruitment ads. If those creatives run where California consumers see them, the disclosure requirements may apply, and how they apply to a specific campaign is a question for your own counsel. One question worth raising with your agency or in-house team this week: does any live or planned ad feature a person who does not exist?
Child Safety: Chatbot Toys, Adam's Law and the New Design Code
California also rebuilt its child safety rules for AI. SB 867, signed on September 10, 2026, prohibits the manufacture, sale, exchange or possession with intent to sell any toy that includes a companion chatbot, defined as an AI system that provides adaptive, human-like responses, exhibits anthropomorphic features, and is capable of sustaining a relationship across multiple interactions.
The design code changed too. A law signed on September 10 repeals the California Age-Appropriate Design Code Act and replaces it with a framework requiring businesses that provide online services likely to be accessed by children to take reasonable steps to prevent specified harms to children. This sits alongside earlier action: Newsom signed the bipartisan Adam's Law, requiring safeguards around companion chatbots used by children, including suicide and self-harm protections.
Why should a firm or clinic care about toy chatbots? Because the definitions may be a signal. Legislators are writing rules for AI that sustains a human-like relationship over time, not just AI in toys. If your website chatbot handles intake for family law matters or pediatric appointment requests, minors may interact with it. Whether the reasonable-steps standard in the design code replacement reaches a particular website is a question worth putting to counsel rather than assuming an answer either way.
Workplace Surveillance, Neural Data and Data Broker Deadlines
Two more bills matter for anyone who employs staff or handles personal data. AB 1883 prohibits employers from using workplace surveillance tools that employ AI to collect neural data or recognize an individual's emotional state, subject to limited exceptions. The Labor Commissioner or a public prosecutor may enforce the provisions, violations carry civil penalties of up to $500 per violation, and the bill also allows for civil or injunctive relief, including punitive damages.
Modern monitoring and call analytics suites often ship with sentiment or emotion scoring switched on by default. If your firm uses call tracking with sentiment analysis on staff calls, or productivity software that scores mood, those features may raise questions under the new law. Vendors can usually tell you in writing whether such features exist and whether they can be disabled, and your counsel can advise on what the exceptions cover.
On the privacy side, AB 883 reduces the response deadline for data subject requests to data brokers from 45 days to 30 days and requires data brokers to provide notice of the right to submit deletion requests through DROP. And looking further out, wearable recording devices manufactured for sale must include a prominent recording indicator beginning January 1, 2028, with civil penalties of up to $2,500 per violation. Practices piloting wearable AI notetakers may want to track that one.
The September 18 Executive Order and the September 30 Deadline
The week ended with an escalation. On September 18, Newsom issued an executive order to accelerate independent oversight and advance the creation of an AI kill switch. The order directs actions to address the dangers of recent AI incidents, calls for national adoption of California's AI framework, and accelerates California's new law establishing independent verification.
More is coming before month end, since dozens of AI bills still sit on the governor's desk through September 30. And California is not alone. In New York, legislators passed a kids chatbot safety bill, an AI training data transparency act, the FAIR News Act, a data center moratorium and a ban on AI-assisted surveillance pricing, and Governor Hochul has until December 31 to sign the bills.
One caution: the federal picture cuts the other way. President Trump's December 2025 executive order proposed a uniform federal AI policy that would preempt state laws deemed inconsistent with federal policy, and directed the Attorney General to establish a task force to challenge state AI laws. Some of these California laws may face court challenges. How those challenges will resolve is unknown, and whether and how the signed laws apply to any particular organization in the meantime is a question for that organization's own counsel.
Questions Worth Raising With Your Team and Your Counsel
- Where does AI touch the practice today: website chatbots, intake bots, ad creative, transcription tools, staff monitoring software and vendor AI features?
- Does any current or planned ad prominently feature an AI-generated person, and if so, how might SB 1050's disclosure requirements apply?
- Could minors interact with the website chatbot, and what would reasonable steps to prevent harm look like under the design code replacement?
- Do monitoring or call analytics tools infer emotional state or collect neural data, and can vendors confirm in writing whether those features can be disabled?
- If a vendor sells an AI audit or certification, what are their plans for California auditor registration, and is their methodology on file?
- Who is watching September 30 for California signings and December 31 for New York, and who will review what lands?
The Bottom Line
California spent one week in September building the enforcement infrastructure that every other AI rule will plug into: certified independent verifiers, a state auditor registry, and an executive order pushing it all faster. The individual laws each involve fairly contained operational questions, an ad disclosure here, a vendor conversation there. Those questions are easier to work through now, while the list is short, and more bills are likely to land after the September 30 and December 31 deadlines pass. This article is general information about new legislation, not legal advice. For how any of these laws apply to your firm or practice, talk to your own counsel.
