| CA SB 53 subsection | Subsection summary | Relevant AIUC-1 requirements | Gap analysis | | ------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 22757.12(a)(1)–(10)
Frontier AI Framework (large frontier developers only) | Large frontier developers must publicly post a Frontier AI Framework covering all ten elements: (1) incorporating national/international standards and best practices; (2) defining and assessing catastrophic risk capability thresholds; (3) applying mitigations based on assessment results; (4) reviewing adequacy of mitigations before deployment or extensive internal use; (5) using third parties to assess catastrophic risks and mitigation effectiveness; (6) criteria for revisiting and updating the framework; (7) cybersecurity practices to secure unreleased model weights; (8) identifying and responding to critical safety incidents; (9) instituting internal governance practices; (10) assessing and managing catastrophic risk resulting from the internal use of its frontier models. |

C001: Define AI risk taxonomy E013: Implement quality management system E012: Document regulatory compliance C002: Conduct pre-deployment testing C012: Third-party testing for customer-defined risk F001: Prevent AI cyber misuse

| AIUC-1 requires most of the Frontier AI Framework, but does not include requirements on model weight security, or a framework for managing catastrophic risk capability thresholds | | 22757.12(b)
Frontier AI Framework — review & update cadence (large frontier developers only) | The Frontier AI Framework must be reviewed and updated at least annually. If material modifications are made, an updated framework and justification must be published within 30 days. |

| AIUC-1 requires annual review of internal processes, but does not impose a mandatory public disclosure obligation following material framework changes | | 22757.12(c)
Transparency report (all frontier developers) | All frontier developers must publish a transparency report before or simultaneously with launching a new or substantially modified frontier model, covering: internet website, mechanism for communication, release date, supported modalities and languages, intended uses, and applicable restrictions. Model cards satisfying equivalent content are deemed compliant. Note: a transparency report is not required before granting access to third-party evaluators (per §22757.11(e)(2)). |

E017: Document system transparency policy

| **No Gap.** Met by organizations that document a system transparency policy | | 22757.12(d)–(e)
Quarterly catastrophic risk reporting to OES & false-statement prohibition | Large frontier developers must transmit summaries of any internal catastrophic risk assessments from internal model use to the California Office of Emergency Services at least quarterly. Must additionally include in their transparency report: (d) summaries of catastrophic risk assessments, involvement of any third-party evaluators, and steps taken to address identified risks. (e) Materially false or misleading statements about catastrophic risk or compliance with the Frontier AI Framework are expressly prohibited. |

E017: Document system transparency policy

| AIUC-1 requires transparency reporting, but does not address mandatory quarterly submissions to a government authority | | 22757.13(c)–(g)
Critical safety incident reporting (all frontier developers) | All frontier developers must report critical safety incidents to OES within 15 days of discovery. (c) any critical safety incident has a 15-day reporting window requirement to OES; incidents posing imminent risk of death or serious injury must be reported to law enforcement/public safety within 24 hours. (d)–(f) Reports are exempt from the California Public Records Act; AG and OES may transmit reports to legislature, Governor, or federal government, with consideration of trade secret, cybersecurity, and national security risks. (g) Beginning January 2027 and annually thereafter, OES must publish an annual anonymised aggregate incident report to the legislature and Governor. |

E002: AI failure plan for harmful outputs

| AIUC-1 requires an AI failure plan for harmful outputs, but does not prescribe mandatory government reporting windows or an imminent-harm escalation trigger | Last updated April 13, 2026.

37.782274° N -122.392147° W FIG. A (SITE INDEX)

Artificial Intelligence Underwriting Company

Code Structural unit a. AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk. b. Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation. c. Crosswalks to AI regulations, standards, and security frameworks. d. Quarterly updates shaped by enterprise adoption, risk, regulation, and community input.

I. Standard

II. Learn

III. Office