California AB 979 (California Cybersecurity Integration Center: artificial intelligence)

• Authority: California
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2025-10-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Governance failure

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Competitive dynamics

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document primarily addresses cybersecurity risks related to AI systems, with good coverage of AI system security vulnerabilities (2.2), cyberattacks and weapons development (4.2), and governance structures (6.5). It has minimal coverage of privacy compromise (2.1) and competitive dynamics (6.4). The focus is on information sharing mechanisms to defend against cyber threats rather than broader AI risk domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Trade, Transportation & Utilities
• Information
• Educational Services
• Health Care & Social Assistance
• Public Administration (excl. National Security)
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Professional & Technical Services

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs Public Administration (excluding National Security) through mandatory requirements for state agencies and the California Cybersecurity Integration Center. It also has good coverage of Information sector (AI providers, developers, telecommunications), Educational Services (schools, universities), Health Care (California Health and Human Services Agency), and Utilities (California Utilities Emergency Association). The governance extends to state contractors and vendors across multiple sectors providing AI services to government.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding California state statute (AB 979) that amends the Government Code with mandatory requirements for state agencies. It uses mandatory language ('shall') throughout and establishes legally enforceable obligations for the California Cybersecurity Integration Center and state contractors/vendors.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: California State Legislature; The people of the State of California
• Summary: This is a California state bill (AB 979) enacted by the California Legislature, as indicated by the opening phrase 'The people of the State of California do enact as follows' which is standard legislative language.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer, AI_Infrastructure_Provider
• Entities: California Cybersecurity Integration Center; Office of Emergency Services; state contractors and vendors providing artificial intelligence services; AI providers; AI developers; AI adopters; utilities and other service providers; academic institutions; nongovernmental organizations
• Summary: The document targets state agencies (particularly the California Cybersecurity Integration Center and Office of Emergency Services) with mandatory obligations, and state contractors/vendors providing AI services with mandatory information sharing requirements. It also creates voluntary mechanisms for AI providers, developers, and adopters.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: California Cybersecurity Integration Center; Office of Emergency Services; Director of Emergency Services; Government Operations Agency; Office of Information Security
• Summary: The California Cybersecurity Integration Center, led by the Office of Emergency Services, is designated as the primary enforcement and coordination body. The Director of Emergency Services has authority to designate additional members, and the Government Operations Agency and Office of Information Security have consultation roles.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: California Cybersecurity Integration Center; Cyber Incident Response Team; Office of Emergency Services; California State Threat Assessment System; United States Department of Homeland Security — National Cybersecurity and Communications Integration Center
• Summary: The California Cybersecurity Integration Center serves as the monitoring hub, with a dedicated Cyber Incident Response Team for threat detection and response. It operates in coordination with federal monitoring entities and is required to submit reports to the Legislature.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document does not focus on specific AI development lifecycle stages but rather on operational monitoring and information sharing about AI-related cybersecurity threats. It primarily addresses the 'Operate and Monitor' stage through ongoing threat detection, reporting, and response mechanisms. There is implicit coverage of deployment through requirements for state contractors/vendors.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

No technical scope terms identified.

Technical Scope Summary

The document explicitly mentions 'artificial intelligence (AI)' and 'AI services' multiple times but does not define AI models, AI systems, or provide technical specifications. It references AI providers, developers, and adopters without distinguishing between frontier AI, general purpose AI, or other AI categories. No compute thresholds or model architecture specifications are mentioned.