A cluster of state artificial-intelligence statutes took effect on January 1, 2026, led by California's SB 53 and AB 2013, which moved from signing to obligation at midnight — and both regulate through mandated disclosure rather than prohibition, which makes the compliance artifact, not the model, the thing a regulator reads first. Coverage of the effective dates, including a January 2026 King & Spalding alert, emphasizes how fragmented the state layer has become in the absence of federal action.
3G Times publishes information, not legal advice; the statutes below carry their own definitions and exceptions, and applicability turns on specific facts.
Which instruments switched on January 1?
SB 53, the Transparency in Frontier Artificial Intelligence Act, applies to developers of covered large models — those trained above the statute's compute threshold — and requires publication of an AI transparency framework, safety-incident reporting consistent with that framework, and whistleblower protections for the developer's employees. AB 2013 reaches developers of generative AI generally: it obliges them to publish documentation of the data used to train released models, covering sources, composition, and curation, so that downstream deployers and their counsel can finally see what a model was built from. Both were signed in September 2024 with a deliberately long runway to January 1, 2026, and both enforce through state authorities and civil exposure rather than pre-approval licensing.
Who is covered, and from when?
SB 53's trigger is the developer's training run, not a customer's use case: a fintech that fine-tunes a third-party foundation model for underwriting is a deployer, while the frontier developer carries the framework and reporting duties. AB 2013's documentation duty likewise binds the developer of the generative system made available in California. The practical result for financial institutions is indirect but immediate — vendor due diligence now has a statutory artifact to demand, and its absence from an AI supplier's public materials is itself a finding.
What must the compliance file contain?
The new statutes converge on a documentation package. For covered vendors: the published transparency framework and its incident-reporting procedure; training-data documentation per AB 2013; and representations on whistleblower protections for staff close to the training pipeline. For deployers relying on those vendors: the mapping of each model to its supplier's disclosures, dated snapshots of what was published at contracting time, and an update path — because these are living public documents, and the record counsel will want in a dispute is what the vendor had posted when the institution relied on it. Colorado's much-debated AI Act looms behind the California pair, its effective date sitting at June 30, 2026 after the 2025 amendment pushed it back from February; legal teams budgeting for the year now sequence both.
What does this mean in practice?
- Add the artifacts to vendor checklists. AI procurement templates should require the SB 53 framework link and AB 2013 documentation as deliverables, with change-notification duties when either document moves.
- Snapshot what you relied on. Archive dated copies of vendor transparency pages into the contract file; a URL that changes silently is a defense that evaporates.
- Budget for the Colorado back half. Teams treating January 1 as the year's only AI compliance date will meet June 30 unprepared.
The direction of travel is unmistakable: state legislatures are regulating AI by forcing paper — frameworks, data statements, incident reports — and the institutions that treat that paper as a first-class compliance record are the ones that will file it before an examiner asks.
For more context, read Knowledge Graphs for Statutory Monitoring: Tracking Amendment Risk Across Jurisdictions by Machine.
For more context, read judicial standing orders generative ai.
For more context, read microsoft contract review ai.