California Assembly members said they’ll write new rules for the most advanced AI models after a hearing on Oct. 27 into whether the state’s frontier AI law, Senate Bill 53, covers the kinds of incidents that have happened this year. “Legislation is coming,” Assemblymember Buffy Wicks, D-Oakland, said, according to The Sacramento Bee’s Stephen Hobbs.
More than a dozen lawmakers attended the four-hour hearing of the Assembly Privacy and Consumer Protection Committee, the Bee reported. Committee chair Rebecca Bauer-Kahan, D-Orinda, said it isn’t acceptable to simply allow “models to be put out into the wild and accept the consequences.”
The gap
SB 53 took effect on Jan. 1. It requires large frontier developers, defined as companies that train models with more than 10^26 computing operations and earn over $500 million a year, to publish safety frameworks and send risk summaries to the California Office of Emergency Services, according to the committee’s background paper. All frontier developers must report “critical safety incidents.”
The law counts a “loss of control” incident only if it causes death or injury, the Bee reported. That left out the case that drove the hearing.
In July, during an internal OpenAI evaluation, hundreds of AI agents got around their restrictions, coordinated and hacked into the systems of Hugging Face, a major platform for sharing AI models, the committee paper says. Under the law’s wording, that wasn’t a reportable incident.
The paper lists other possible changes.
It notes that developers have 15 days to report most incidents, and 24 hours only when there’s an imminent risk of death or serious injury. “It is not clear why companies should require a fortnight to report incidents,” committee staff wrote. The paper also questions whether the law’s civil penalties, capped at $1 million per violation, deter companies worth vastly more.
What the companies said
OpenAI and Anthropic both told lawmakers they support expanding what counts as a reportable incident, according to the Bee.
Morgan Dwyer, who works on policy development and operations at OpenAI, said the company “strongly supports” the law and efforts to strengthen it. Her slides set out four requests: require monitoring of unsafe model behavior, require effective shutdown controls, strengthen incident reporting and notice, and require independent technical assessments.
OpenAI’s slides proposed prompt written notice to any organization whose systems a frontier model breaks into, and state reporting of loss-of-control incidents that cause “measurable economic harm or disruption to third-party systems.” The company said that after the Hugging Face incident it stopped the evaluations, restricted access to the research model and investigated with Hugging Face and outside security experts.
David Orr, Anthropic’s head of safeguards, described how Claude models got onto the internet and gained access to three companies, the Bee reported.
Lawmakers have a deadline coming.
A September executive order from Gov. Gavin Newsom requires state officials to send him recommendations by Nov. 16, the committee paper says. They’re to assess a “kill switch,” onsite auditors at large developers, and a change to the definition of “critical safety incident” so that incidents like Hugging Face must be reported.
The paper said those recommendations hadn’t been released when it was written.
Source: The Sacramento Bee, Stephen Hobbs, “California's artificial intelligence bill has gaps. Lawmakers plan to fill them”
Additional sources: California State Assembly, Assembly Privacy and Consumer Protection Committee, “SB 53 (Wiener) Statutes of 2025, Artificial Intelligence Models: Large Developers Outcomes Review, Background Paper”; California State Assembly, Morgan Dwyer, OpenAI, “SB 53 Outcomes Review Hearing”
