On Wednesday, September 9, Governor Gavin Newsom signed two bills that set up independent outside checks on AI systems in California. On Thursday, September 10, he signed thirteen more aimed at kids: companion chatbots, social media feeds, AI in toys, age verification, and AI generated abuse material. That is a lot of law in 48 hours, and most of the coverage either cheered or panicked. I want to do the boring thing and walk through what the bills say, using the governor's own releases and the bill summaries, and then say what I think as someone who ships apps that will fall under some of this.
Usual caveat, and it matters more than usual here: this is general information, not legal advice. Several of these bills do not have effective dates in the announcement, and the details live in the bill text, not the press release.
Wednesday: who gets to audit AI
SB 813, from Senator Jerry McNerney, creates a framework for independent verification organizations, third parties that assess AI systems and models for compliance with state law. AB 1405, from Assemblymember Rebecca Bauer-Kahan, sets up a state registry for AI auditors with standards for independence, transparency, and integrity. The governor's release describes them together as creating "independent third-party evaluation and audit mechanisms" for AI, and pairs the signing with a call for the federal government to write national rules (Source). McNerney's quote is the clearest statement of intent: California is doing this "since Washington, D.C., is unable or unwilling to do so."
What this is: plumbing. It does not tell an AI company what its model may or may not do. It builds the thing that checks whether a company is doing what other laws already require, and it makes "we were audited" mean something specific, by someone registered, following published independence rules. Compare it to financial audits. Nobody thinks an auditor makes a company honest. They make the claim of honesty checkable.
Thursday: the kids' package
Thirteen bills, signed together, framed by the governor as "the strongest child safety chatbot and social media laws in the nation." The ones with the widest reach (Source):
- SB 1119 (Senator Steve Padilla, with Assemblymembers Buffy Wicks and Rebecca Bauer-Kahan) updates the companion chatbot rules. The release lists crisis protocols, parental controls, notifications about safety settings, independent child safety audits, and annual risk assessments. This is the bill the release calls "Adam's Law."
- SB 867 (Padilla) covers companion chatbots in toys. Earlier reporting described it as a multi year ban on the category; the release itself only gives the title, so treat the length of the ban as reported, not confirmed by the governor's office.
- AB 1709 (Assemblymember Josh Lowenthal) restricts addictive features for users under 16. The release names autoplay and algorithmic feeds specifically.
- AB 2 (Lowenthal) adds civil penalties for injuries to children.
- AB 1856 (Wicks) covers age verification signals in software applications. This is the one app developers should read closely, more on it below.
- SB 1276 (Senator Susan Rubio) expands the definition of child sexual exploitation to include digitally altered or AI generated material. The release cites a civil penalty of up to $250,000 per action for victims of deepfake pornography.
- The rest cover school issued devices, student data in AI systems, digital wellness instruction, computer science standards, and a reporting mechanism for abuse material.
Newsom's line on the package: "As innovation moves faster our protections must keep pace." And per the Transparency Coalition's legislative tracker, there are more than 30 additional AI bills still sitting on his desk with a September 30 deadline to sign or veto, so this is the first wave, not the whole story (Source).
What changes on your phone
If you are a parent, the two you will feel first are AB 1709 and SB 1119. The feed bill means platforms have to offer under 16 accounts something other than an autoplaying, algorithmically ranked stream. The chatbot bill means a companion chatbot has to have parental controls and has to tell you what its safety settings are, and it has to be audited by someone outside the company. Neither one bans a kid from talking to an AI. They change the defaults, and defaults are where all the power is.
If you are a developer, AB 1856 is the sleeper. Age verification signals in software applications means the operating system or the store is expected to pass an age signal to apps, and apps are expected to do something with it. I have not read the final text and I would not guess at the thresholds. But the direction is clear: "we do not know how old our users are" is going to stop being an acceptable answer for apps that serve kids or run feeds, and the burden is moving toward the platform layer, which is the only place it can realistically work.
Why a one person studio cares
I build thirteen apps and one of them, Solecito, is for kids learning to read Spanish. It has no account, no feed, no chatbot, no ads, and no network connection at all. Reading Thursday's package, I could not find a provision that touches it, and that is not luck. It is what "no tracking, ever" looks like when a legislature finally writes the rule down: the things they are regulating are the things I decided not to build. The audit bills are a different story. If a future version of one of my apps calls a cloud model, I would be on the hook for what that model does, and I would rather that be checked by someone registered than by nobody. I say that as the person who would be paying for the audit.
The honest criticism of this week is that fifteen bills is a lot of surface area for a state to enforce, and California has a track record of passing broad tech laws that get narrowed in court or sit unenforced for years. The audit framework in particular only works if the registry fills up with competent, independent people, and that is a hiring problem, not a legislative one. I would give it a year before judging whether Wednesday's bills did anything. Thursday's will matter faster, because platforms change defaults the moment the penalty is real.
If you want the federal version of the chatbot conversation, I covered the GUARD Act in July here. California just went first, again.
Bill summaries and quotes come from the Office of the Governor's September 9 and September 10 press releases and the Transparency Coalition's September 11 legislative update, linked inline. Where the release gives only a bill title, I have said so rather than fill in the details. General information, not legal advice. Verified September 11, 2026. If you are curious what a studio builds when it starts from no accounts, no feeds, and no cloud, the full lineup is at jcmobileappstudio.com/apps.
Comments
Be kind and stay on topic.
No comments yet. Be the first.