California SB 524 (Law enforcement agencies: artificial intelligence.)

• Authority: California
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2025-10-10

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Governance failure
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• AI system security vulnerabilities
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of approximately 3-4 subdomains, with focus on AI system security (2.2), governance failure (6.5), and lack of transparency (7.4). Coverage is concentrated in transparency, accountability, and data security domains related to law enforcement AI use.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This document exclusively governs AI use in the Public Administration sector, specifically law enforcement agencies. It does not regulate AI use in other economic sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding California state law with mandatory requirements for law enforcement agencies, including specific obligations for disclosure, retention, and audit trails, with enforcement through state mandate mechanisms.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is enacted by 'the people of the State of California' through their legislative process, as indicated in the opening clause.

Target

• Entity Types: AI_Deployer, AI_Infrastructure_Provider
• Summary: The law explicitly applies to 'each law enforcement agency' and 'contracted vendors' who provide AI systems for generating police reports.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The Commission on State Mandates is explicitly named as the body that determines cost mandates and oversees reimbursement, indicating an enforcement and oversight role.

Monitor

• Entity Types: AI_Deployer
• Summary: The law requires law enforcement agencies themselves to maintain audit trails and retain drafts, creating a self-monitoring framework with documentation requirements.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Collect and Process Data
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Deploy and Operate and Monitor stages of the AI lifecycle, with requirements for disclosure, retention, and audit trails during operational use of AI systems by law enforcement. It does not substantially address earlier stages like planning, data collection, or model development.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems
• Generative AI
• Task-specific AI

Technical Scope Summary

The document explicitly defines and covers AI systems used for generating police reports, specifically mentioning systems that analyze body-worn camera footage and generative AI that enhances reports. It does not mention frontier AI, general purpose AI, foundation models, compute thresholds, or open-weight models.