{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/california-sb53-frontier-ai-cyber-provisions-2025/",
 "asOf": "2026-09-26",
 "id": "california-sb53-frontier-ai-cyber-provisions-2025",
 "date": "2025-09-29",
 "datePrecision": "day",
 "title": "California SB 53 requires frontier AI frameworks covering autonomous cyberattack risk and incident reporting",
 "lane": "policy",
 "kind": "regulation",
 "summary": "California's Transparency in Frontier AI Act (SB 53) requires large frontier developers to publish frontier AI frameworks addressing catastrophic risk, model weight cybersecurity and incident response, and to report critical safety incidents to the Office of Emergency Services. Its catastrophic risk definition includes a model engaging, with no meaningful human oversight, in conduct that is a cyberattack, where a single incident causes death or serious injury to more than 50 people or more than $1 billion in property damage.",
 "whyItMatters": "It is a binding US state law that ties catastrophic risk to autonomous cyberattack conduct by a model.",
 "actors": [
  "state-of-california"
 ],
 "topics": [
  "regulation-and-policy",
  "incident-reporting",
  "capability-thresholds"
 ],
 "atlas": [
  "model",
  "human-approver"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53",
   "publisher": "California Legislative Information",
   "title": "SB-53 Artificial intelligence models: large developers",
   "date": "2025-09-29",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "Catastrophic risk includes a frontier model engaging, with no meaningful human oversight, intervention or supervision, in conduct that is a cyberattack, where a single incident causes death or serious injury to more than 50 people or more than $1 billion in property damage or loss.",
   "locator": "Definitions, 'catastrophic risk'"
  },
  {
   "fact": "Critical safety incidents must be reported to the Office of Emergency Services within 15 days; an incident posing imminent risk of death or serious physical injury must be disclosed within 24 hours to an appropriate authority, such as a law enforcement or public safety agency.",
   "locator": "Critical safety incident reporting provisions"
  },
  {
   "fact": "Applies to frontier models trained above 10^26 operations; 'large frontier developer' means annual revenue above $500 million; civil penalties up to $1 million per violation.",
   "locator": "Definitions; enforcement"
  }
 ],
 "significance": 4,
 "fideQuestions": [
  "FID-077"
 ],
 "methods": [],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}