- within Insurance and Transport topic(s)
On Sept. 29, 2025, California Gov. Newsom signed Senate Bill 53, the Transparency in Frontier Artificial Intelligence Act, into law. Aimed at preventing catastrophic risks from advanced AI systems, the law sets requirements for large developers working with "frontier models"—including mandatory safety measures, adherence to national and international standards, and public transparency reports. A "frontier model" is defined by the amount of computing power used during training, fine-tuning, or modification—specifically, any model requiring more than 10^26 integer or floating-point operations.
Violations may lead to civil penalties, especially for failures that might result in mass harm (injury or death of 50 or more people) or financial losses exceeding one billion dollars. The law takes effect Jan. 1, 2026.
Among its provisions, Senate Bill 53 establishes whistleblower protections in the AI sector. Employees involved in risk assessment, safety management, or incident response are expressly shielded from retaliation when reporting violations or disclosing information about critical safety threats. To safeguard those who speak out, legislators of the bill have implemented notice and internal reporting procedures to ensure employees are able to report or disclose information without fear of retaliation.
What Is Considered a Catastrophic Risk?
"Catastrophic risk" is defined as "a foreseeable and material risk that a developer's development, storage, use or deployment of a frontier model will materially contribute to the death of, or serious injury to, more than 50 people or more than one billion dollars ($1,000,000) in damage to, or loss of, property arising from a single incident involving a frontier model" doing any of the following:
- Providing expert level assistance in the creation or release of a chemical, biological, radiological, or nuclear weapon;
- Engaging in conduct with no meaningful human oversight that is either a cyberattack or, if the conduct had been committed by a human, would constitute the crime of murder, assault, extortion, or theft; and
- Evading the control of its developer or user.
The statute expressly excludes lawful activity of the federal government, harm caused by a frontier model in combination with other software if the frontier model did not materially contribute to the harm, and information that a frontier model outputs if the information is otherwise publicly accessible in a substantially similar form from another source.
Which Employers Are Covered?
The new law applies to large developers of AI systems that have trained or are training a "frontier model." It imposes additional requirements on those whose annual gross revenues exceeded $500 million in the preceding calendar year. While some current models do not reach this high technical threshold, ongoing technological advancements may bring many models above this level in the coming years.
Who Qualifies as an Employee?
Covered employees include any employee responsible for assessing, managing, or addressing risk of critical safety incidents.
Critical safety incidents include the following:
- Unauthorized access to, modification of, or theft of the model weights of a foundation model that results in death, bodily injury, or damage to property;
- Harm resulting from a catastrophic risk, which includes events that lead to the death or serious injury of more than 50 people or more than one billion dollars in financial harm;
- Loss of control of a foundation model causing death or bodily injury; and
- A foundation model employing deceptive techniques against the frontier developer to subvert the developer's controls or monitoring—outside of a context of an evaluation designed to elicit this behavior—in a manner that increases catastrophic risk.
Overview of New Whistleblower Protections Statute
Prohibited Conduct
Employers and large developers are prohibited from adopting or enforcing any rule, regulation, policy, or contract that prevents employees from disclosing information about activities posing a catastrophic risk or violations of the law. Employees are protected if they have reasonable cause to believe the information they disclose reveals such risks or violations, and they may report to the attorney general, federal authorities, persons of authority over employees at their company, or authorized investigators. Cal. Labor Code § 1107.1(a).
Notice and Acknowledgement Requirements
Employers must provide clear notice to all employees about their rights under the law. This includes posting notices in the workplace, notifying new hires, and ensuring remote employees receive equivalent information. Written notice must be provided annually, with employees required to acknowledge receipt. Cal. Labor Code § 1107.1(d).
Internal Reporting Process Requirements
The law requires employers to implement a reasonable internal process for covered employees to anonymously report concerns about catastrophic risks or violations of the new law. Employers must provide monthly updates to the reporting employee on the status of investigations and responsive actions. Summaries of disclosures and responses must be shared with company officers and directors quarterly, except when those individuals are implicated in the alleged wrongdoing. Cal. Labor Code § 1107.1(e).
Consequences for Non-Compliance
Failing to comply may be costly. In addition to the attorney general having sole authority to seek civil penalties up to one million dollars per violation through a civil action, covered employees may also sue if they experience retaliatory adverse employment actions. Covered employees may pursue damages for any harm suffered, injunctive relief, and recovery of attorneys' fees.
Takeaways for Employers
Employers—particularly those developing AI or collaborating with major AI developers—should consider proactively updating internal policies and employee contracts to support safe, protected reporting of critical safety incidents, whether within the organization or to external authorities. Considering California's expansive definitions of "employee" and joint employer liability, AI developers may wish to also ensure that their service providers and contractors adopt compliant practices. This may require a review of not only internal contracts with direct hires but also third-party contracts for consistency with the law's requirements. Finally, employers may wish to carefully review all adverse actions taken against covered employees to confirm they are not retaliatory. Internal processes may need to be strengthened to safeguard employees who report safety concerns or potential violations.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
