California’s AI Cyber-Risk Subpoena 2026: SB 53 Compliance Guide

California SB 53 compliance stopped being theoretical the moment state regulators reportedly sent a subpoena to a leading AI developer over cybersecurity risks in its models. For most of 2026, the Transparency in Frontier Artificial Intelligence Act looked like a disclosure law that companies could satisfy with a PDF and a press release. A subpoena changes that. If you build on, resell, or deploy large AI models in California, you need to know what investigators are asking for, and you need your incident records in order before anyone asks for them.

What’s actually new: the first real test of California SB 53 compliance

SB 53 was signed in September 2025 and took effect on January 1, 2026. It applies directly to “frontier developers,” meaning companies that train models using more than 10^26 operations of compute. Developers with more than $500 million in annual revenue carry the heaviest duties. They must publish a frontier AI framework explaining how they assess and mitigate catastrophic risk, release transparency reports when they ship new frontier models, and report “critical safety incidents” to the California Office of Emergency Services (Cal OES). The California Attorney General enforces the law, with civil penalties of up to $1 million per violation.

The reported subpoena focuses on AI cybersecurity risk. The law’s definition of catastrophic risk explicitly covers a model helping carry out a cyberattack with no meaningful human oversight, and its list of critical safety incidents includes unauthorized access to model weights. Investigators appear to be testing the gap between what a developer’s published safety framework says and what actually happened internally: which red-team findings were escalated, which incidents were reported, and on what timeline.

Public details are limited, and no one has found the developer in violation of anything. The signal is still clear. California AI enforcement has moved from guidance to compulsory process, and the documents that matter are the ones companies produce in the ordinary course of business: incident tickets, Slack threads, eval results, and vendor emails.

Why it matters

• Published frameworks are now evidence. An AI safety framework disclosure is a public promise. If internal practice does not match it, investigators can prove that mismatch easily, and SB 53 specifically prohibits materially false or misleading statements about catastrophic risk management.
• The reporting clock is short. Developers must report critical safety incidents to Cal OES within 15 days of discovery, or within 24 hours if there is imminent risk of death or serious injury. Companies that cannot reconstruct when they “discovered” an incident are exposed.
• Deployers get pulled in. SB 53 binds developers, but a subpoena to a developer can reach customer integrations, abuse reports, and support tickets. If your product surfaced a cyber-misuse case, your records may become part of someone else’s investigation.
• Whistleblowers have leverage. SB 53 whistleblower protections bar retaliation against employees who report catastrophic-risk concerns or violations, and large developers must provide an anonymous internal reporting channel. Many enforcement cases begin with an insider.
• Vendor due diligence is now a compliance task. If you choose a model provider without asking about its incident-reporting posture, you hand your company’s risk to a vendor you never vetted.
• Other states are watching. State AI regulation in 2026 is converging on the SB 53 template. How California enforces it will shape what New York and others do next.

How to use it today: an SB 53 readiness playbook

Most business owners reading this are not frontier developers. The goal is to be the company that answers a document request in a day instead of a month, whether the request comes from the Attorney General, a customer, or your own model vendor.

1. Decide where you sit. Write down whether you are a frontier developer, a fine-tuner, a deployer, or a reseller. Record which models you use, their providers, and whether any of your own training runs approach the compute threshold. Keep this one-page memo current.
2. Stand up an AI incident log now. Investigators want timestamps: when someone observed the issue, who knew, when it was escalated, and what was done. Use a structured format so you can search and export entries.

   # ai-incident-log.yaml (one entry per event)
   - id: AIINC-2026-0042
     detected_at: 2026-10-01T14:22:00-07:00
     detected_by: soc-oncall
     system: support-copilot (vendor model: provider/model-version)
     category: cyber-misuse | weight-access | loss-of-control | data-exposure | other
     description: >
       User prompted assistant to generate working exploit code for an
       unpatched internal service; output was partially functional.
     severity: low | medium | high | critical
     potential_sb53_critical_incident: false
     reasoning_for_classification: >
       No unauthorized weight access, no harm realized, human reviewed output.
     escalated_to: [security-lead, legal]
     escalated_at: 2026-10-01T15:05:00-07:00
     vendor_notified: true
     vendor_ticket: VND-88123
     regulator_notified: false
     remediation: Tightened system prompt; added exploit-pattern output filter.
     closed_at: 2026-10-03T10:00:00-07:00
   

3. Write down your classification rule. The record of how you decided whether something was reportable often matters more than the decision itself. Paste this into your incident runbook:

   SB 53 TRIAGE (complete within 24 hours of detection)
   1. Was there unauthorized access to, exfiltration of, or modification of model weights?  -> escalate to Legal immediately
   2. Did a model materially assist a cyberattack, CBRN effort, or act without meaningful human oversight?  -> escalate
   3. Did a model attempt to evade controls or behave deceptively in a way that raised catastrophic risk?  -> escalate
   4. Is there imminent risk of death or serious physical injury?  -> 24-hour clock; notify vendor + Legal now
   5. Otherwise: log, remediate, document reasoning, review weekly.
   Record: who decided, when, and why.
   

4. Send your model vendors a short questionnaire. Get their incident-reporting commitments in writing. Use this prompt to draft a version tailored to your stack:

   You are a compliance analyst. Draft a 10-question vendor due-diligence
   questionnaire for an AI model provider, focused on California SB 53.
   Cover: whether they are a "large frontier developer," a link to their
   published frontier AI framework, their critical safety incident
   reporting process and timelines, how they notify downstream customers
   of incidents affecting them, cybersecurity controls on model weights,
   their whistleblower channel, and data retention for abuse reports.
   Our use case: [describe product, data types, California users].
   Output as a numbered list with a "why we ask" note under each question.
   

5. Add a notification clause to AI contracts. Ask legal counsel to adapt language like this for new or renewing agreements:

   Provider shall notify Customer in writing within seventy-two (72) hours
   of determining that a critical safety incident, as defined under
   California Business and Professions Code Section 22757.11 or successor
   provisions, has affected or is reasonably likely to affect the Services
   provided to Customer, including a description of the incident, affected
   model versions, and recommended mitigations.
   

6. Inventory where the evidence lives. Subpoenas target email, chat, ticketing, and eval storage. Run a quick sweep to find which repos and docs mention AI safety or incident terms:

   # From your docs/runbooks repo root
   grep -rniE "red.?team|jailbreak|model weights|safety incident|exploit|misuse" \
     --include="*.md" --include="*.yaml" --include="*.txt" . \
     | cut -d: -f1 | sort | uniq -c | sort -rn
   

   Then confirm your retention settings in Slack, Google Workspace or Microsoft 365, and your ticketing system. Once you reasonably expect an investigation, delete nothing.

7. Publish an internal reporting channel. Even if the SB 53 whistleblower requirement does not formally apply to you, give employees an anonymous way to raise AI safety concerns, and document that it exists. It is cheap insurance, and it holds up well under scrutiny.

How it compares

SB 53 is not the only frontier AI rulebook. Here is how it lines up against the regimes most likely to touch a California business.

Regime	Who it covers	Incident reporting	Enforcement
California SB 53	Frontier developers (10^26+ FLOPs); heavier duties above $500M revenue	15 days to Cal OES; 24 hours if imminent risk of death or injury	Attorney General; up to $1M per violation
New York RAISE Act	Large frontier developers, closely aligned with SB 53 after 2025 amendments	72 hours after determining an incident occurred	New York Attorney General; new state oversight office
EU AI Act (GPAI rules)	General-purpose AI providers; stricter duties for systemic-risk models	Serious incidents reported to the EU AI Office without undue delay	Fines up to 3% of global turnover for GPAI providers
Colorado AI Act	Developers and deployers of high-risk AI used in consequential decisions	Discovered algorithmic discrimination reported to the AG	Colorado Attorney General

Build one incident process that meets the strictest clock you face and maps cleanly to each regime’s definitions. Running four separate processes is how deadlines get missed.

What’s next

Watch for three things. First, whether the subpoena turns into a public enforcement action or settlement. The first penalty under SB 53 will set the benchmark for what “materially misleading” means in a safety framework, and every large developer will rewrite its disclosures to match. Second, Cal OES guidance on how to format and submit incident reports, along with the anonymized annual summaries the law requires starting in 2027. Those summaries will show what kinds of incidents are actually occurring.

Third, the federal preemption fight. The White House has pushed to limit state AI laws, and litigation or congressional action could narrow SB 53’s reach. Do not plan around that. Preemption fights take years, and a subpoena issued today must be answered today. The documentation habits in this guide are good practice no matter which government ends up enforcing them.

Expect compliance pressure to move down the supply chain, too. As developers face scrutiny, they will push incident-notification and acceptable-use obligations onto customers through updated terms of service. Read your model provider’s next terms update carefully, because that is where SB 53 will reach most small businesses.

Frequently Asked Questions

Does California SB 53 compliance apply to my small business?

Probably not directly. SB 53’s obligations fall on frontier developers that train very large models. Deployers and resellers can still be drawn into investigations, receive document requests, and inherit contractual duties from their vendors, so keeping incident records is worth the effort.

What does a California AI subpoena typically ask for?

Expect requests for published safety frameworks and their earlier versions, internal risk assessments, red-team and evaluation results, incident logs, communications about specific events, and records showing when incidents were discovered and reported. Investigators focus on timelines and on gaps between policy and practice.

What counts as a critical safety incident for AI cybersecurity incident reporting?

Under SB 53, critical safety incidents include unauthorized access to or exfiltration of model weights that leads to harm, harm caused by a catastrophic risk materializing, loss of control of a model causing injury or death, and a model using deception to subvert developer controls in ways that increase catastrophic risk. Cyberattacks carried out with meaningful AI assistance and no human oversight fall within the catastrophic-risk definition.

How do SB 53 whistleblower protections work?

Covered developers cannot retaliate against employees who report, in good faith, that the company’s activities pose a specific and substantial danger from catastrophic risk or that the company is violating the law. Large frontier developers must offer an anonymous internal reporting process and give the reporting employee regular updates.

Who enforces SB 53, and what are the penalties?

The California Attorney General enforces the law. Civil penalties can reach $1 million per violation, including failing to publish required documents, making materially false statements, or failing to report incidents.

What should we do first this week?

Start a structured AI incident log, write down your triage rule, check data retention settings, and send your model vendors a due-diligence questionnaire. Those four steps cover most of what an investigator or a large customer will ask for first.