California SB 53 explained: The frontier AI law OpenAI wants toughened

California’s SB 53 is a state law, signed in 2025, that makes the companies building the most powerful AI models publish how they handle extreme risks and report serious safety incidents. It does not approve or ban models. It requires disclosure, and it lets the state sue companies that do not follow their own published rules.

The law is in the news because OpenAI has reportedly asked Gov. Gavin Newsom to strengthen it. Our report on that letter is here: OpenAI asks Newsom to toughen the California AI law it once opposed.

A food-safety label for the biggest AI models

Think of a restaurant that must post its hygiene plan and call the health department after a poisoning. Inspectors do not cook the food or approve each dish. They check that the plan exists, that it is published, and that the restaurant follows it.

SB 53 works in a similar way. Its formal name is the Transparency in Frontier Artificial Intelligence Act. “Frontier” means the most capable models at the leading edge. The law asks their makers to show their safety plans in public and to tell the state when something goes seriously wrong.

Who counts as a frontier developer

Coverage is based on computing power. According to the Future of Privacy Forum (FPF), a nonprofit policy group, a frontier model is one trained with more than 10^26 computational operations. Compute used in later fine-tuning or modification counts toward that total.

A “frontier developer” is anyone who trained, or started training, such a model. A “large frontier developer” is one with annual gross revenue above $500 million. Large developers carry the heaviest duties.

Using compute as the test has a practical appeal: it is a number a regulator can ask for and a company can state. It says little, however, about what a given model can actually do, which is a limit the later sections come back to.

Four duties: A published plan, a report per model, incident alerts, whistleblower cover

FPF’s summary lists the main requirements.

• A frontier AI framework. Large developers publish a document describing how they find, reduce and govern catastrophic risks. It covers governance, mitigation, cybersecurity practices and how the company aligns with recognized standards. Companies may redact material to protect trade secrets, security or national security.
• A transparency report. Every frontier developer publishes one before deploying a frontier model. It covers intended uses, restrictions, and summaries of risk assessments and results, including the role of any outside evaluators.
• Incident reporting. Critical safety incidents go to California’s Office of Emergency Services (OES) within 15 days of discovery, or within 24 hours if there is imminent danger of death or serious injury.
• Whistleblower protection. Employers may not retaliate against staff who report catastrophic risk, and must give notice of these rights and keep anonymous reporting channels.

The Governor’s office adds that the law sets up CalCompute, a consortium inside the Government Operations Agency that will develop a framework for a public computing cluster for research.

What “catastrophic risk” and “critical incident” mean in the text

The statute treats a risk as catastrophic when a frontier model could realistically and significantly help bring about large-scale harm: deaths or serious injuries to at least 50 people, or property and economic losses of at least $1 billion. It also points to particular scenarios. These include a model giving expert-level assistance with chemical, biological, radiological or nuclear weapons, carrying out crimes or cyberattacks with little human involvement, or slipping out of the control of its developer or user.

Critical safety incidents, per FPF, include unauthorized tampering that causes serious harm, a catastrophic risk actually materializing, loss of control causing injury or major property damage, and a model deliberately evading its developer’s safeguards.

These definitions matter for the current debate. As we reported, Mission Local says a state official told an August hearing that an earlier episode involving OpenAI’s agents did not meet the reporting threshold. That is that outlet’s account, and how the threshold applies in practice is one reason the wording gets attention.

Where it came from: A vetoed bill and an expert report

SB 53 was written by State Sen. Scott Wiener and signed by Newsom on September 29, 2025. It followed SB 1047, a tougher bill that Newsom vetoed in 2024. The Governor’s office says SB 53 draws on a report by AI experts he requested earlier in 2025. Three of those experts, Mariano-Florentino Cuéllar, Fei-Fei Li and Jennifer Tour Chayes, said the law moves toward the “trust but verify” principle in their report.

FPF lists what SB 53 dropped from SB 1047:

• a full shutdown capability, often called a kill switch;
• annual audits by independent third-party assessors;
• safety, cybersecurity and shutdown requirements before initial training;
• a 72-hour incident window, now 15 days;
• penalties tied to compute cost, now capped at $1 million per violation.

Those omissions are exactly where the reported OpenAI letter points. According to The Information’s public summary, as covered in our report, the letter backs shutdown controls, annual independent audits and better security. We could not read the letter, so the details are unconfirmed.

Strengths, limits and what to watch

The main strength is that disclosure is easy to check. A company that publishes a framework can be held to it. The Attorney General can bring civil actions, with penalties of up to $1 million per violation, scaled to severity, according to FPF.

The limits follow from the design. The law mostly asks what companies say they do, not whether it works. There is no mandatory outside audit, and no required shutdown mechanism. The compute threshold is a rough proxy for capability, so a model below it could still be risky. FPF notes that the California Department of Technology can recommend updates to key definitions, including “frontier model,” which the Legislature must then adopt. Earlier drafts gave the Attorney General rulemaking power over them, but the final version removed it.

Several things are worth following:

• whether any bill to amend SB 53 appears, and whether it adds audits or shutdown controls;
• how the Department of Technology’s yearly update recommendations treat the definitions;
• how the Attorney General enforces the law, and what counts as a reportable incident in practice;
• how the published frameworks of different companies compare once readers set them side by side.

Newsom’s office has said the law “was designed to be updated based on evolving threats and needs,” according to Mission Local, so changes are possible. Nothing we have read says one is planned.