AI Workflow California

Which California rules apply when my business uses these tools?

The rules turn on how a business uses a tool. The data it handles matters too. Check the agency sources on AI, data, tax and training help for your business.

Last updated .

Not legal or tax advice.

What did the saved research find?

The main question was: What are the best AI workflow automation tools? The research read the 3 pages as summaries from a page fetch tool on . Of the 3 top pages we could read for the main question, 0 give any of the 20 California facts on file. One more result couldn't be read.

Of the same 3 pages, 0 name any law at all.

The 3 AI answers were read on . Of the 3 neutral AI answers to the main question, 0 give any of the 20 California facts. The answers were taken from a browser in Arizona.

Does using AI change who answers for the work?

The Attorney General's advisory says: "Conduct that is illegal if engaged in without the involvement of AI is equally unlawful if AI is involved, and the fact that AI is involved is not a defense to liability under any law."

The Attorney General's advisory says: "For example, it may be unlawful under California’s Unfair Competition Law to:" Its first example: "Falsely advertise the accuracy, quality, or utility of AI systems. This includes claiming that an AI system has a capability that it does not; representing that a system is completely powered by AI when humans are responsible for performing some of its functions; representing that humans are responsible for performing some of a system’s functions when AI is responsible instead; or claiming without basis that a system is accurate, performs tasks better than a human would, has specified characteristics, meets industry or other standards, or is free from bias."

Read the full source. See the limits in the state AI guide.

What does the chatbot rule cover?

The Attorney General's advisory says: "California law prohibits the use of undeclared chatbots with the intent to mislead a person about its artificial identity in order to incentivize a purchase or influence a vote in an election. (Bus. & Prof. Code, § 17941.)"

The Governor's page is dated December 31, 2025. The Governor's page says: "AB 489 (Bonta): Prohibits AI chatbots from presenting themselves as doctors, nurses, or other licensed professionals to increase transparency and prevent misrepresentation by AI chatbots." It lists it under: "Starting January 1, a new set of California laws will take effect, impacting health care, housing, workplaces, schools, technology, and corporate disclosure requirements."

Read both sources in full: the state AI guide and the new laws page.

What does the agency say about AI in telemarketing?

The page says: "AB 2905 (Low) requires telemarketing calls that use AI-generated or significantly modified synthetic marketing to disclose that use. (Pub. Util. Code, § 2874.)" It also says: "All bills discussed below become effective January 1, 2025."

What tax rate does the state page give?

"7.25% statewide, before any district tax. The page labels its current rates 'effective '."

Source: California Department of Tax and Fee Administration. Read the full page and its limits.

What does the state say about AI used to hire staff?

The Civil Rights Department's page says: "the regulations were approved on June 27, 2025 and are set to go into effect on October 1, 2025." It says the regulations aim to: "Ensure employers and covered entities maintain employment records, including automated-decision data, for a minimum of four years." Of "Automated-decision systems" it says: "are increasingly used in employment settings to facilitate a wide range of decisions related to job applicants or employees, including with respect to recruitment, hiring, and promotion."

Source: California Civil Rights Department. Read the full page and its limits.

Which firms does the state privacy law cover?

The CCPA applies to a for-profit business:

"that collect consumers' personal information (or have others collect personal information for them), determine why and how the information will be processed, do business in California, and meet any of the following thresholds:"

"Have a gross annual revenue of $26.625 million or more ( effective January 1, 2025 ) for the preceding calendar year"

"Buy, sell, or share the personal information of 100,000 or more California residents or households"

"Derive 50% or more of their annual revenue from selling or sharing California residents' personal information."

"The CCPA also applies to some entities controlled by these businesses, certain joint ventures or partnerships made up of these businesses, and those persons that voluntarily certify to be subject to the CCPA."

"The CCPA does not generally apply to nonprofit organizations or government agencies."

Use that dated revenue figure.

Source: California Privacy Protection Agency. Read the full page and its limits.

Why use the newer revenue figure?

The law copy says:

"Pursuant to Civil Code § 1798.199.95(d), this monetary amount has been updated."

See the figure on the privacy page above.

Source: California Privacy Protection Agency. Read the full page and its limits.

What does the privacy page say about firms that process data?

The privacy agency's page says: "Additionally, the CCPA imposes separate obligations on service providers and contractors (who contract with businesses to process personal information) and other recipients of personal information from businesses." The law's text says a service provider: "means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumer’s personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:" The law's text then lists what the contract prohibits.

Source: California Privacy Protection Agency. Read the first page in full. Read the next page in full.

When do the new privacy rules apply?

These rules sit under the privacy law.

"The regulations go into effect January 1, 2026. However, there is additional time for businesses to comply with some of the new requirements, namely cybersecurity audits, risk assessments, and requirements for automated decisionmaking technologies."

"Businesses that use ADMT to make significant decisions must comply with the ADMT requirements beginning January 1, 2027."

"Effective Date: January 1, 2026"

Source: California Privacy Protection Agency. Read the first page in full. Read the next page in full.

What does the tax page say about software sent online?

The tax agency's Regulation 1502 says: "The sale or lease of a prewritten program is not a taxable transaction if the program is transferred by remote telecommunications from the seller's place of business, to or through the purchaser's computer and the purchaser does not obtain possession of any tangible personal property, such as storage media, in the transaction." It's marked: "Amended December 17, 2013, effective July 1, 2014." The tax agency's Publication 109 says: "Your sale of electronic data products such as software, data, digital books (eBooks), mobile applications, and digital images are generally not taxable when you transmit the data to your customer over the Internet. However, if as part of the sale, you provide your customer with a printed copy of the electronically transferred information or a backup data copy on a physical storage medium, such as a flash drive, your entire sale is usually taxable." It's marked: "Revision July 2026".

Source: California Department of Tax and Fee Administration. Read the first page in full. Read the next page in full.

What does the state say about a data breach?

The page says: "California law requires a business or state agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person." It also says: "Any person or business that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General."

Source: California Attorney General. Read the full page and its limits.

What does the state say about keeping data safe?

The page says: "This law requires specified businesses to use safeguards to ensure the security of Californians' personal information (defined as name plus SSN, driver's license/state ID, financial account number, username or email address in combination with password or security question and answer, and health insurance information) and to contractually require third parties to do the same. It does not apply to businesses that are subject to certain other information security laws."

Source: California Attorney General. Read the full page and its limits.

What must a site say about how it uses data?

The page says: "This law requires operators of commercial web sites or online services that collect personal information on California consumers through a web site to conspicuously post a privacy policy on the site and to comply with its policy. The privacy policy must, among other things, identify the categories of personally identifiable information collected about site visitors and the categories of third parties with whom the operator may share the information. The privacy policy must also provide information on the operator's online tracking practices. An operator is in violation for failure to post a policy within 30 days of being notified of noncompliance, or if the operator either knowingly and willfully or negligently and materially fails to comply with the provisions of its policy. This law takes effect July 1, 2004."

Source: California Attorney General. Read the full page and its limits.

What does the state say about recording private calls?

The page says: "Among other things, this law prohibits, with exceptions, electronic eavesdropping on or recording of private communications by telephone, radio telephone, cellular radio telephone, cable or any other device or in any other manner." It also says: "Violation can result in penalties of up to $10,000 and imprisonment in county jail or state prison for up to one year (sections 631-632.7)."

Source: California Attorney General. Read the full page and its limits.

What training help does the state list for small firms?

As posted October 2026:

"Small Business Program (SBP)"

"To facilitate direct small business contracts, SBP provides up to ( see Funding Limitations ) in training cost reimbursements for small businesses with 100 or fewer employees in California, but no more than 250 worldwide. Training hours for SBP contracts may range from 8 to 200 hours of instruction, and small business owners may be trained, along with their employees. Modifications to standard contract requirements are allowed."

Source: California Employment Training Panel. Read the full page and its limits.

How can you check what an AI tells me?

Take the free AI Honesty Test. It gives you six questions to ask in the AI you use. A 5-part email series comes with it.

Take the free AI Honesty Test

You can also open BreadHead's discovery booking page to discuss your work and whether BreadHead fits.

Book Your Discovery Call Now.

How we worked this out

We used the official agency pages listed below. The filed facts checked them on .

Citation

Use this name to cite the page: AI Workflow California. Page name: California rules. Use this link: https://aiworkflowcalifornia.com/california-rules.

Sources

Read the sources and their check dates below.

What changed

This draft adds the agency statements and the sources listed above.

  • First draft dated .
  • : Added the saved findings on the three pages and three AI answers, with their date and reading limits.
  • : All rule sections now use the filed source words. All cited sources are now listed.