AI Regulation Compliance: California's New AI Laws, the EU's New Deadlines, and How to Prove a Human Checked the Decision

California has signed new laws that stop employers from relying only on AI to fire or discipline workers and that set up a state registry for AI auditors, and the EU has reset its AI Act deadlines. If your business uses AI in hiring, HR, customer service or security, AI regulation compliance is shifting from having a policy to being able to show who checked a decision and what data it used.

This post started with a Security Boulevard commentary arguing that AI regulation has entered a new phase. That phrase is the author's opinion. The laws underneath it are real, and we checked them against government pages and published bill text.

What changed in AI regulation in 2026

What is confirmed about the new AI laws

• SB 947 is law. The published bill record lists it as Chapter 859, Statutes of 2026, with the line "This part shall become operative on July 1, 2027." The Labor Commissioner enforces it, public prosecutors can sue, and the bill summary describes a $500 civil penalty per violation.
• AB 1405 regulates auditors, not your business. It is Chapter 178. From January 1, 2029, nobody may offer or conduct a covered AI audit unless registered. It does not itself require any company to get an audit.
• SB 813 is voluntary. The author's office calls it a "voluntary flexible framework" under the Government Operations Agency.
• The EU moved some dates, not all. The European Commission lists transparency rules, such as telling people they are dealing with a machine, as applying from August 2026. Regulation 2026/1744 gives providers of systems already on the market until December 2, 2026 to meet the rule on marking AI output.

What is not known

• The final terms of SB 951. The governor's office confirms the disclosure duty. Earlier versions of the bill differed on notice periods (60 or 90 days) and worker counts, the bill page we could open mixes versions, and the official California site blocked our access. Law firm King & Spalding describes added disclosures in existing Cal-WARN notices, for establishments with 75 or more employees. Have counsel read the signed text.
• How "corroborate" will be read. SB 947 has not started, so there is no enforcement record to learn from.
• Federal pressure on state laws. Executive Order 14365, dated December 11, 2025, directs an AI Litigation Task Force to challenge state AI laws that conflict with federal policy. Whether it will target these laws is not known.
• The broad claim. The commentary says companies must now demonstrate that AI is safe and trustworthy. Nothing we reviewed creates a general US duty to do that. The duties are specific: certain decisions, certain notices, certain records.

Does AI regulation apply to my business?

It depends on where your workers and customers are, not only where your office is.

• You employ people in California and software scores, flags or recommends discipline or termination: plan for SB 947. A law firm summary we read gives no employer size threshold.
• You make consequential decisions about Colorado consumers with automated tools: the state legislature lists deployer duties such as notice at the point of interaction, a plain-language description within 30 days of an adverse decision, human review on request and three years of records.
• Your AI output is used in the EU: the AI Act reaches providers and deployers outside the EU in that case.
• You are in Ohio with no staff or customers in those places: these laws probably do not reach you directly, though customers and vendors may start asking the same questions.

Why AI governance matters for your company network

These rules turn into technical questions fast. Someone has to produce a record of what a system did, which data it used and which person reviewed it. If your AI tool runs under a shared admin account and keeps no exportable logs, that answer may not exist.

SB 947 also lets workers request their own data used in a covered decision, covering the prior 12 months, once every 12 months. That is a data retrieval job for IT as much as a legal job for HR.

AI agents raise the stakes because they act, not just advise. NIST's AI Agent Standards Initiative, which produces voluntary guidelines, lists agent authentication and identity among its research priorities. Treat each agent like a new employee, with its own login, limited rights and an activity trail.

AI compliance checklist for this week

AI regulation compliance questions people are asking

Can a California employer use AI to fire someone?

Yes, with limits. From July 1, 2027, the decision cannot rest solely on an automated system. If the system is the main basis, a human must corroborate it and the worker must get written notice.

Does my business need an AI audit?

California's AB 1405 does not require one. It regulates people who sell covered audits. An audit duty would have to come from another law or a contract.

What is the EU AI Act high-risk deadline now?

December 2, 2027 for stand-alone high-risk uses such as employment, and August 2, 2028 for AI embedded in regulated products.

Is the NIST AI Risk Management Framework mandatory?

No. NIST says it is intended for voluntary use. It was released January 26, 2023, and NIST says it is being revised.

What does AI governance mean in plain English?

Knowing who owns each AI tool, what it is allowed to do, who checks its work and which records prove that.

The bigger lesson

The details differ by state and country, but the direction is consistent: when software affects a person, someone should be able to say who checked it and show the record. Businesses that build that habit now will have less to retrofit when the deadlines arrive, whichever rules survive.

Need help building that record? See security hardening or request a quote.

Get security alerts by email, with the free checklist, on our security alerts page.

Sources: Governor of California, September 30, 2026; Governor of California, September 9, 2026; SB 947 bill record; SB 951 bill record; AB 1405 bill record; Senator McNerney on SB 813; King & Spalding summary; Colorado SB 26-189; Regulation (EU) 2026/1744; EU AI Act; European Commission AI framework; Executive Order 14365; NIST AI RMF; NIST AI Agent Standards Initiative.