AI Oversight in California: A Practical Guide for Executives, by Judith C. Wolff
AI is everywhere.
AI now touches nearly every part of a business, from hiring and pricing to the drafts in your inbox. The problem isn't too little information about AI; it's the flood. California's Legislature alone passed 26 AI-related bills in its 2026 session.
You can't absorb it all, and you don't need to. You need a process you can defend.
Why responsible AI use is part of your job.
You don't need a board seat to owe your company duties. California employees must work with ordinary care and diligence (Labor Code § 2854), and what you acquire through your job belongs to your employer (Labor Code § 2860). The documents, client files, customer lists, data and work product you handle aren't yours; you hold them for the company.
So you can't decide on your own to hand company or client information to an outside AI service. Uploading it to a personal AI account is like taking company files home and handing them to a stranger.
These rules set concrete expectations:
• Privacy concerns. Under the CCPA, risk-assessment duties began January 1, 2026, and businesses using automated decision-making for significant decisions must follow notice and opt-out rules by January 1, 2027. If your team uses AI for decisions like approvals or pricing, customers must be told in advance (notice) and often allowed to ask for a human decision instead (opt-out). Follow those steps and route opt-out requests correctly.
• Personal data inside AI. California privacy law covers information in "artificial intelligence systems that are capable of outputting personal information" (Civil Code § 1798.140(v)). Uploading client data to a personal or unapproved AI account creates a copy the company can't track. If that client asks the company to delete their data, it can't fully comply, and that legal problem traces back to your upload.
• Contracts with AI vendors. A business needs a written contract limiting how every service provider or third party that receives consumers' personal information may use it (Civil Code § 1798.100(d)). Uploading client data to an AI tool your company has no contract with may itself violate the law.
• Reasonable security. Businesses must reasonably secure Californians' personal information and require outside recipients to do the same (Civil Code § 1798.81.5). If poor security leads to a breach, consumers can sue for statutory damages (Civil Code § 1798.150). A careless upload can become a lawsuit.
• Employment. Starting July 1, 2027, the "No Robo Bosses Act" (SB 947) bars employers from relying solely on AI to discipline or fire workers. A person must review any such AI-assisted decision.
• Enforcement. Attorney General Rob Bonta plans to hire AI experts and investigative technologists to enforce these laws, so oversight gaps are more likely to be noticed.
Six practical steps towards compliance.
1. Know your company's AI policy. Know which tools are approved and what's off-limits. If there's no written policy, ask your manager or IT and get the answer in writing.
2. Use only approved tools and accounts. Keep work in company accounts, even at home.
3. Think before you upload. Don't upload client, patient or customer data, or trade secrets, unless policy clearly allows it. Test: would you email it to a stranger?
4. Be the human in the loop. Check AI output before relying on or sending it, and note how you checked. For AI-informed discipline or termination decisions, you may be the human reviewer SB 947 requires.
5. Know your industry's AI rules. In insurance, wealth management, health care or law, see the box below.
6. Speak up early. If AI is producing wrong or biased results, tell your manager or compliance team promptly. California protects good-faith reports of suspected legal violations (Labor Code § 1102.5).
In a regulated industry?
Insurance. AI can't make medical-necessity calls (Health & Safety Code § 1367.01; Insurance Code § 10123.135), and regulators watch for AI bias (Bulletin 2022-5).
Wealth management. Use only firm-approved AI tools; Regulation S-P requires firms to oversee vendors that handle customer data.
Medical. Label AI-written patient messages (Health & Safety Code § 1339.75), and never upload patient records without a business associate agreement (HIPAA; CMIA).
Legal. Starting in 2027, SB 574 bars delegating legal work to AI and requires verifying every citation (Code of Civil Procedure § 128.7). Client confidences stay confidential (Business & Professions Code § 6068(e)).
Your questions, answered
"I uploaded work documents to AI at home. Is there any risk to doing this?"
Yes. Consumer AI accounts may keep your uploads and, depending on settings, use them to train models. Uploading company files to a personal account can breach your confidentiality agreement or company policy, weaken trade-secret protection and, if personal data is involved, violate privacy laws.
"I have not had explicit permission from clients to upload their confidential documents to AI, but honestly to actually read the documents will take hours, and AI can have a good answer in less than 10 minutes. Can I get in trouble?"
Yes. Most client contracts and NDAs limit who may see confidential material. Sending it to an outside AI provider without permission may breach them, and saving time is no defense. Lawyers face added exposure under State Bar guidance. Safer options: have whoever manages the client relationship get consent, use a company-approved tool, or remove identifying details first. And check the AI's answer; you're still responsible for it.
"How can I make sure that when I upload information to AI, it either gets deleted afterwards or is never shared?"
You can't guarantee it, but you can reduce the risk:
• Use a business account. Business plans typically promise by contract not to train on your data.
• Read the data terms. Check how long uploads are kept, who can access them, and whether training is off by default.
• Change your settings. Turn off model training and chat history on any account you use.
• Ask about retention. For sensitive work, ask IT whether the provider offers zero-retention or deletion commitments.
• Share less. Upload only what the task needs, and redact names and identifying details.
Even "deleted" data may be kept for legal or safety reasons, so treat deletion as reduced risk, not a guarantee.
The bottom line.
You don't have to master every AI law. Know your company's rules, protect the information you're trusted with, check AI's work and speak up when something looks wrong. That's your best protection if a decision is ever second-guessed.
This article provides general information, not legal advice. For questions about your situation, talk to your company's legal or compliance team or your own attorney.
Comments