California SB 833 (Critical infrastructure: artificial intelligence systems: human oversight)

• Authority: California
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Proposed
• Most recent activity date: 2025-08-29

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Governance failure

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Overreliance and unsafe use
• AI pursuing its own goals
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal to good coverage of approximately 5-6 subdomains, with primary focus on AI system security (2.2), governance failure (6.5), and AI safety failures (7.1, 7.3). Coverage is concentrated in system safety, security vulnerabilities, and governance oversight domains related to critical infrastructure protection.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Information
• Finance & Insurance
• Health Care & Social Assistance
• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document governs AI use across multiple critical infrastructure sectors operated by California state agencies, with explicit coverage of at least 10 sectors including energy, transportation, water systems, emergency services, healthcare, financial services, communications, information technology, food and agriculture, and government facilities. The governance applies specifically to state agency operations of critical infrastructure.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding California state statute with mandatory requirements, enforcement mechanisms, and legal obligations for state agencies operating AI systems in critical infrastructure.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: California State Legislature; Governor of California
• Summary: The document is a California state bill enacted by the Legislature, with references to the Governor's Executive Order N-12-23 that established the policy framework leading to this legislation.

Target

• Entity Types: AI_Governance_Actor, AI_Deployer
• Entities: State agencies; Department of Technology; Office of Emergency Services; operators of critical infrastructure
• Summary: The legislation applies to state agencies that operate AI systems in critical infrastructure. The definition of 'operator' specifically refers to 'a state agency responsible for operating, managing, overseeing, or controlling access to critical infrastructure.'

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Department of Technology; Office of Emergency Services
• Summary: The Department of Technology is designated to develop training, receive assessment reports, and oversee compliance. The Office of Emergency Services has authority over information disclosure related to critical infrastructure.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Department of Technology; oversight personnel within state agencies
• Summary: The Department of Technology receives annual assessment summaries. Designated oversight personnel within each operator agency are responsible for conducting annual assessments and real-time monitoring of AI systems.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Deploy and Operate and Monitor stages of the AI lifecycle, with explicit requirements for real-time monitoring, periodic review, and annual assessments of deployed AI systems in critical infrastructure. There is minimal coverage of earlier lifecycle stages.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems
• General Purpose AI
• Generative AI

Technical Scope Summary

The document explicitly defines and covers both AI systems and automated decision systems. It focuses on AI systems deployed in critical infrastructure contexts but does not mention frontier AI, general purpose AI, foundation models, generative AI (except in legislative findings), or compute thresholds.