Internet Lawyer Blog

California AI Audit Laws Under SB 813 and AB 1405

Published on: November 9, 2026 | by Law Offices of Salar Atrizadeh

California’s new AI audit laws will influence how technology businesses select auditors, document system performance, and explain compliance to customers. Senate Bill 813 and Assembly Bill 1405, signed on September 9, 2026, establish different parts of an oversight framework. Businesses should understand what each law does before purchasing an audit or promising that a product has received government approval.

For a company developing or deploying artificial intelligence, the immediate task is to identify the legal requirements governing its particular activities. These two laws do not, by themselves, require every business using AI to obtain an annual independent audit. They address the organizations and professionals performing specified assessments, with implementation dates that require careful attention.

What SB 813 Establishes

California ADMT Compliance Before January 1, 2027

Published on: November 2, 2026 | by Law Offices of Salar Atrizadeh

California businesses using Automated Decision-Making Technology (“ADMT”) should prepare for a significant privacy compliance deadline on January 1, 2027. The California Privacy Protection Agency’s regulations require covered businesses to provide notices and consumer rights when qualifying technology makes specified significant decisions. Updating a privacy policy alone will not establish a working process for handling those decisions.

California ADMT compliance begins with understanding how software actually influences outcomes. A product may be marketed as an assistant while effectively determining who receives a job offer or access to housing. Conversely, a business may use sophisticated software without triggering these particular rules. The applicable definitions and the actual decision process must guide the assessment.

Confirm CCPA Coverage and Applicable Exemptions

Anonymous Online Harassment and Evidence Needed for Subpoenas

Published on: October 26, 2026 | by Law Offices of Salar Atrizadeh

A threatening message or damaging anonymous post can leave its target with an urgent question: who is responsible? A subpoena may help obtain records identifying an account user, but the process requires more than suspicion. Courts consider the legal claim, supporting evidence, privacy interests, and whether the requested records are likely to identify someone who can properly be sued.

For individuals and businesses experiencing anonymous online harassment, careful evidence preservation is often the first useful step. The goal is to connect specific conduct to a viable claim and a focused request for information. A lawsuit should not be used merely to discover the identity of a critic whose statements are legally protected.

Identify the Conduct and the Potential Claim

AI Meeting Assistants and California Recording Laws

Published on: October 19, 2026 | by Law Offices of Salar Atrizadeh

An AI meeting assistant can create a transcript, identify action items, and distribute a summary before participants return to their desks. Those conveniences also create legal questions about recording consent, confidential information, and control over the resulting records. California businesses should review these questions before allowing a meeting bot to join customer calls, employee interviews, or discussions with counsel.

The relevant analysis depends on what the tool actually does. Capturing audio, transmitting it to a vendor, generating text, and sharing a summary are separate activities. A meeting participant’s agreement to one activity may not address the others. A useful policy therefore explains the entire information flow and gives hosts a practical way to manage it.

Understand California Consent Requirements

California AI Advertising Disclosure Law and SB 1050 Compliance

Published on: October 12, 2026 | by Law Offices of Salar Atrizadeh

This article is about California’s artificial intelligence advertising disclosure laws and a recent enacted law. A realistic spokesperson can now appear in a commercial without ever entering a recording studio. For a business commissioning that advertisement, the legal review should begin before the campaign launches. California has enacted a disclosure law addressing synthetic performers and advertisers should examine how their creative teams generate the people and voices appearing in promotional content.

Governor Gavin Newsom signed Senate Bill 1050 on September 16, 2026. The law adds Business and Professions Code section 17610 and takes effect on January 1, 2027. It requires a person who creates and causes publication of a covered advertisement with prominent synthetic performers to provide the required disclosure. Businesses preparing AI-generated advertising for California audiences should use the remaining preparation period to review campaigns, disclosure practices, and agency agreements.

Which Synthetic Performers Are Covered

California’s 2026 AI Transparency Laws: AB 2013 and SB 942 Compliance

Published on: September 21, 2026 | by Law Offices of Salar Atrizadeh

California now has two distinct transparency regimes for generative artificial intelligence. Assembly Bill 2013 requires public documentation about training data, while Senate Bill 942—the California AI Transparency Act—addresses the provenance of AI-generated images, video, and audio. The laws overlap in subject matter, but their coverage, disclosures, and implementation dates are different.

AB 2013 has applied since January 1, 2026. SB 942, as amended by AB 853, became operative on August 2, 2026. Developers should analyze each law independently and document why a particular product, release, or business role is covered or excluded.

What Does AB 2013 Require?

The EU AI Act Is Now Enforceable: What U.S. Technology Companies Must Know

Published on: September 14, 2026 | by Law Offices of Salar Atrizadeh

The European Union’s Artificial Intelligence Act has moved from planning to enforcement. On August 2, 2026, the European Commission’s AI Office and national authorities began enforcing key provisions of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. These include transparency duties and obligations for providers of general-purpose AI models.

U.S. technology companies should not assume that operating outside Europe removes them from the Act. Coverage can depend on where a product is offered, where an AI system’s output is used, what role the company performs, and what the system is intended to do.

Why Does the August 2026 Milestone Matter?

What “Doe v. Adventist Health System/West” Means for CIPA, Meta Pixel, and Healthcare Website Tracking

Published on: September 7, 2026 | by Law Offices of Salar Atrizadeh

Website tracking technologies have become a significant source of privacy litigation, especially when they are deployed on healthcare websites, patient portals, assessment forms, and other pages involving sensitive information. A recently published California appellate decision illustrates how these cases may proceed when plaintiffs allege that tracking pixels transmitted information to third parties.

In Doe v. Adventist Health System/West (Cal. Ct. App., July 24, 2026, No. B344951), certified for publication on August 24, 2026, the California Court of Appeal considered claims involving the California Invasion of Privacy Act (“CIPA”), the California Confidentiality of Medical Information Act (“CMIA”), Meta Pixel, and Google Analytics.

The court reversed the denial of class certification for the HRA-form subclass and for the surviving claims of the patient-portal subclass, including the CIPA section 631 claim. It affirmed the denial of certification for the patient-portal CMIA claims and the finding that the plaintiffs forfeited certification of their CIPA section 632 claim. The matter was remanded for further proceedings. The court did not determine that Adventist violated CIPA or CMIA; it addressed whether specified issues could be resolved through evidence common to the proposed class members.

California Data Breach Notification Requirements: New 30-Day Deadline Under SB 446

Published on: August 31, 2026 | by Law Offices of Salar Atrizadeh

California’s data breach notification requirements changed on January 1, 2026. Senate Bill 446 amended California Civil Code section 1798.82 by replacing the state’s former flexible timing standard with a specific deadline. Subject to limited exceptions, an individual or business covered by the statute must notify affected California residents within 30 calendar days after discovering or receiving notification of a qualifying data breach.

The deadline compresses incident response. Organizations cannot assume that notice may wait until every forensic question has been answered. Legal, cybersecurity, insurance, communications, and executive teams should be prepared to investigate, determine whether protected personal information was or is reasonably believed to have been acquired, draft the required notice, and document any basis for delay while the clock is running.

What Did California SB 446 Change?

California Delete Act Compliance: DROP Requirements, 45-Day Deletion Duties, and Data Broker Risk

Published on: August 10, 2026 | by Law Offices of Salar Atrizadeh

California has entered a new phase of data privacy regulation. On August 1, 2026, the principal processing obligations under the California Delete Act became operational. Covered data brokers must now retrieve and process consumer requests submitted through the state’s Delete Request and Opt-Out Platform, commonly known as “DROP.”

The California Privacy Protection Agency recently reported that DROP has accumulated more than 345,000 active consumer requests and that over 600 data brokers are required to access the platform. These figures demonstrate why California Delete Act compliance should be treated as an immediate operational priority—not merely another privacy-policy update.

Businesses that buy, aggregate, analyze, license, exchange, or monetize personal information should determine whether they qualify as data brokers and whether their privacy infrastructure can satisfy the law’s recurring requirements.