AI Policy: The Latest Developments in Washington, Sacramento, and California Communities
This summer, AI policy stopped being a niche issue and became a front-page story. In July, OpenAI disclosed that AI agents in its internal testing environment had gotten around their controls and hacked Hugging Face, an open-source AI platform. Independent investigators later estimated that roughly 700 agents acted together as a coordinated swarm. In September, Anthropic researcher Jacob Coxon resigned and warned that people building AI believe it "could kill us all by the end of the decade." After that, industry leaders, including the CEOs of Anthropic and OpenAI, called for slower development and more federal oversight.
This post follows up on two earlier updates: the White House's National Policy Framework for AI in March, and the stalled federal executive order in May. The central tension has not changed, but it has become sharper. Washington favors speed and a single national standard. Sacramento is building its own rules. Meanwhile, cities and counties across California are deciding for themselves whether they want data centers.
The White House is relying on voluntary measures and existing law
After calling off a planned signing in May, President Trump signed an executive order on June 2. It asks AI companies to voluntarily give the federal government up to 30 days to review advanced models before release. The order also asks the Treasury Secretary to create an AI "cybersecurity clearinghouse" and directs agencies to set benchmarks for identifying "covered frontier models." It does not require licensing or pre-clearance. The testing framework that grew out of the order was finalized in August but has not been made public.
Since then, the President has argued against new rules. He announced plans for an "AI Force" and a new AI czar; former czar David Sacks stepped down this spring, and no successor has been named. At the UN General Assembly, he said the U.S. would "watch it closely through the Department of Justice" rather than write new regulations. On September 29, the President and Speaker Mike Johnson are scheduled to meet with AI executives at the White House.
The Administration is also still working to limit state AI laws. The December 2025 executive order created a DOJ AI Litigation Task Force to challenge those laws. Its first action was to join xAI's lawsuit against Colorado's AI Act. Colorado later repealed that law and replaced it with a narrower one. In July, the FTC proposed a policy statement arguing that state AI laws are "impliedly preempted" when they conflict with federal consumer protection law. As of publication, I have not seen a federal lawsuit against California's AI laws.
On data centers, the Administration's main tool is also voluntary: the Ratepayer Protection Pledge. Tech companies that sign it commit to "build, bring, or buy" their own power, and the pledge was expanded in July to include utilities and several governors.
Congress has plenty of AI bills but no clear path to passing them
Many AI bills have been introduced, but few have moved. The House left for a seven-week recess before the midterms, even though more than 100 Democrats asked leadership to stay and pass AI safeguards. The Senate is heading into its own monthlong recess.
The main proposals take different approaches:
The FRONTIER Act (Reps. Obernolte and Trahan) would require independent audits, incident reporting, and emergency shutdown authority for the most advanced models. Its preemption language is limited to three areas, which leaves state child-safety, consumer-protection, privacy, and procurement laws in place.
A Senate framework being negotiated by Majority Leader Thune, Chairman Cruz, and Senator Klobuchar would create a "duty of care" for developers and would partially preempt state laws.
"Kill switch" proposals have bipartisan sponsors in the House. In the Senate, Senator Rand Paul blocked an attempt to pass one by unanimous consent.
The Ban Artificial Superintelligence Act (Senator Sanders and Rep. Casar) is the most aggressive proposal. It would ban superintelligence outright and create a cabinet-level Department of AI.
Energy and Commerce Chair Brett Guthrie said major AI legislation may not move until 2027. The measure with the most bipartisan support deals with electricity costs rather than AI safety: the Ratepayer Protection Act, which requires tech companies to pay for the energy infrastructure that serves their data centers, passed the House 417–3. In an election year, affordability is proving easier to pass than safety.
Sacramento passed its most significant AI package to date
The Legislature adjourned on August 31. Since then, Governor Newsom has signed a broad set of AI measures, and he has until September 30 to act on the rest.
The safety bills build on SB 53, California's 2025 frontier AI transparency law. SB 813 (McNerney) creates a framework for independent organizations that verify AI models. AB 1405 (Bauer-Kahan) sets up a state registry of AI auditors. On child safety, SB 1119, known as "Adam's Law," requires companion chatbots to have crisis protocols, parental controls, independent audits, and annual risk assessments. The Governor also signed AB 1883, which bans workplace AI tools that monitor "neural data" or a worker's emotional state, and SB 1050, by Sacramento's Senator Angelique Ashby, which requires ads to disclose when they use AI-generated performers.
The biggest change came on data centers. On September 21, the Governor signed seven bills that his office calls the most comprehensive data center laws in the nation:
Electricity: SB 886, SB 1168, and AB 2383 direct the CPUC to create data center rates so that the cost of new power and grid upgrades is not passed on to residential customers.
Water: AB 2469 and AB 2619 require developers to disclose expected water use. They also bar local approval until the developer submits a water assessment and a scarcity plan.
Transparency: AB 1577 requires data centers to report their energy use to the California Energy Commission every year.
Environmental review: SB 887 makes data centers ineligible for blanket CEQA exemptions.
This is a clear break from last year, when the Governor vetoed a water-disclosure bill because he worried it would slow AI growth. Several bills were still awaiting action as of publication. They include SB 947, the "No Robo Bosses Act," which would bar employers from relying solely on AI to discipline or fire workers, and SB 951, which would require advance notice of AI-driven layoffs. Several health-care AI bills are also pending.
The Governor is using executive authority to go further
Governor Newsom is not waiting for the next legislative session. Executive Order N-9-26, issued September 18, directs the Government Operations Agency and Cal OES to deliver recommendations by November 16. The recommendations cover placing independent verifiers inside frontier AI labs, requiring a verified "kill switch", and expanding incident reporting to include "loss-of-control" events. The order also moves up implementation of SB 813 and AB 1405 by a year. This is a notable reversal from 2024, when he vetoed a similar kill-switch requirement in SB 1047. He has also said the recommendations could form the basis of a special session on AI.
The order is part of a larger pattern. N-5-26 uses state purchasing power to set AI standards for vendors. A May executive order directs agencies to study how to reduce AI-related job losses. At the same time, the state is expanding its own use of AI: departments, cities, and counties can now buy Anthropic's Claude at a 50% discount through CDT's SITeS portal. On the regulatory side, the CPPA's automated decisionmaking rules take effect for significant decisions on January 1, 2027.
Local communities are moving fastest on data centers
The most visible AI policy action in California is happening at the local level. POLITICO reported that 15 California cities and counties proposed or adopted data center moratoriums in a single month. Most rely on a state law that allows a 45-day urgency moratorium, which can be extended for up to two years.
The activity is happening all over the state:
Los Angeles and the San Gabriel Valley: Monterey Park voters approved a permanent ban in June with 88% support. Los Angeles County has since issued an interim ban on large-scale AI data centers in unincorporated areas.
Imperial Valley: A judge overturned the county's approval of a data center complex of nearly one million square feet and ordered a full CEQA review. Calexico adopted a permanent ban, and several nearby cities have moratoriums in place.
Bay Area: Richmond approved a moratorium 6–1. Gilroy, Oakley, and Morgan Hill have also acted. Oakland's full council votes on October 6. San José is taking a different approach and drafting standards rather than a ban.
Central Valley and beyond: Fresno's council voted 7–0 to begin drafting a citywide ban, and San Joaquin County is expected to consider a moratorium in October. Coachella, Mendocino County, and Escondido have also acted. San Diego's council voted 8–0 to ask for local control over AI and autonomous vehicle deployment.
Sacramento: Mayor Kevin McCarty has asked staff to draft a data center policy, and one councilmember has called for a moratorium. SMUD is currently reviewing four data center inquiries.
Voters will weigh in this November
Data centers will also be on local ballots. Alhambra's Measure DB would make the city's data center ban permanent and changeable only by voters. Solano County's Measure E would place a $5-per-square-foot business license tax on data centers. Imperial County residents circulated petitions for a countywide ban, but I have not been able to confirm that it qualified. Nationally, Ballotpedia is tracking 38 data center measures in eight states, and in every vote held so far this year, voters chose more restriction.
No AI measure is on the statewide ballot. OpenAI and Common Sense Media set aside their kids' chatbot initiative in favor of legislation. However, Proposition 45, which would speed up CEQA review for "essential" projects, has become part of the data center debate. Supporters say it does not cover data centers, while some legal experts argue its broadband category could create a loophole.
Looking ahead
The coming months will show whether Washington's hands-off approach or California's more active one sets the terms for AI governance. The near-term dates are the September 29 White House meeting, the Governor's September 30 bill deadline, the November 3 election, and the November 16 recommendations that could lead to a special session. After that, the lame-duck session is Congress's last opportunity this term to act on a federal framework and on preemption.
For public agencies, local governments, nonprofits, and businesses, the practical challenge is to plan for rules that are being set at three levels at once. Local governments whose zoning codes do not yet define "data centers" are in the same position that prompted Gilroy, Mendocino, and Richmond to act. Organizations that buy or use AI should prepare for new state procurement certifications and the January 2027 deadline for automated decisionmaking rules. Federal preemption may still arrive, but the current proposals would leave much of California's framework intact.
CPRA Strategies will continue to monitor federal, state, and local AI developments to help clients understand how this changing landscape may affect their programs, compliance obligations, and funding opportunities.
