Critical infrastructure: artificial intelligence systems: human oversight.

Plain English Breakdown

The bill summary does not provide specific details about penalties for non-compliance or the exact nature of the required training.

Rules for AI in Critical Infrastructure

The bill requires state agencies managing critical infrastructure to have human oversight of artificial intelligence systems and report any harmful events.

What This Bill Does

• Requires state agencies operating critical infrastructure to set up a system where humans monitor AI systems in real time.
• Needs these agencies to review and approve actions suggested by the AI before they happen.
• Makes sure that people who oversee AI get specialized training on safety protocols and risk management techniques from the Department of Technology.
• Asks oversight teams to conduct an annual assessment of covered AI systems and report their findings to the Department of Technology.
• Requires reporting any harmful events caused by AI to the Office of Emergency Services.

Who It Names or Affects

• State agencies managing critical infrastructure
• People who oversee artificial intelligence in these agencies

Terms To Know

Critical Infrastructure

Important systems and assets that are vital to the security, economy, health, or safety of a country.

Artificial Intelligence (AI)

Computer programs that can learn from data and make decisions like humans do.

Limits and Unknowns

• The bill does not specify what happens if an agency fails to follow the rules.
• It is unclear how much training will be needed for oversight personnel.
• Details about penalties for failing to report AI adverse events are not fully explained.

Official Summary Text

SB 833, as amended, McNerney.
Critical infrastructure:
automated decision
artificial intelligence
systems: human
oversight: adverse event reporting.
oversight.
Existing law, the California Emergency Services Act, establishes the California Cybersecurity Integration Center within the Office of Emergency Services to serve as the central organizing hub of state government’s cybersecurity activities and to coordinate information sharing with various entities. Existing law also requires the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and information, as prescribed.
This bill would
require
require, on or before July 1, 2026,
an operator, defined as a
state agency
in charge of specified
responsible for operating, managing, overseeing, or controlling access to
critical infrastructure, that deploys
artificial intelligence
a covered artificial intelligence (AI) system, as defined,
to establish a human oversight mechanism
to monitor
that ensures a human monitors
the system’s operations in real time and
review
reviews
and
approve
approves
any plan or action proposed by the
artificial intelligence
covered AI
system before execution, except as provided. The bill would require the Department of Technology to
administer
develop
specialized training in
artificial intelligence
AI
safety protocols and risk management techniques to oversight personnel. The bill would require
oversight personnel for
an operator to conduct an annual assessment of its
artificial intelligence systems and automated decision
covered AI
systems, as specified, and to submit a summary of the findings to the department.
The bill would make findings and declarations related to its provisions.
This bill would require any entity that engages in conduct that could materially impact critical infrastructure safety, security, or operations to report an artificial intelligence (AI) adverse event, as defined, in a form and manner prescribed by the Office of Emergency Services, as provided. The bill would subject each entity that fails to provide an AI adverse event report to a specified civil penalty. The bill would authorize the office to, among other things, authorize public or private entities to receive information about individual events or aggregated statistics for the purpose of collaboratively addressing identified harms, except as provided. The bill would include related findings and declarations.
The bill would preclude disclosure of specified information by the office.
Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.
This bill would make legislative findings to that effect.

Current Bill Text

Download Bill PDF