Among U.S. states, the Golden State continues to be a regulatory frontrunner, with California AI regulation setting precedents that influence national policy and corporate governance practices.

California's approach to AI regulation encompasses employment discrimination protections, transparency requirements, consumer privacy safeguards, and safety measures that collectively represent the most sophisticated AI regulatory environment in the United States.

These regulations create compliance obligations and strategic considerations for companies across different growth stages.

California's AI regulatory framework has undergone significant transformation since the high-profile veto of SB 1047. It has evolved from broad legislation toward sector-specific regulations.

This shift reflects a more sophisticated understanding of AI's impact across industries.

California's SB 1047 and the path forward

 the landmark Safe and Secure Innovation for Frontier Artificial Intelligence Models Act (

) in late 2024, the legislative momentum around AI regulation has only accelerated in 2025. The governor's decision, while disappointing to AI safety advocates, reflected concerns that the proposed bill could stifle innovation and hinder the competitiveness of California's burgeoning AI industry.

"While well-intentioned, the bill does not take into account whether an AI system is deployed in high-risk environments, involves critical decision-making or the use of sensitive data," Newsom stated in his veto message.

However, the regulatory void left by SB 1047's veto has been filled by a comprehensive suite of targeted legislation that addresses specific AI applications and industry sectors. This more nuanced approach reflects lessons learned from early AI governance implementations and recognizes that different organizational contexts require tailored regulatory frameworks.

What does the current California AI regulation impact?

The current California AI regulation encompasses compliance frameworks that vary significantly based on company size, industry sector, and AI application context.

, known as the Generative Artificial Intelligence Training Data Transparency Act, was signed into law in September 2024, with documentation and disclosure requirements taking effect January 1, 2026. It mandates developers of generative AI systems to disclose detailed information about the datasets used to train their models. This legislation applies retroactively to systems released or substantially modified on or after January 1, 2022, creating immediate compliance obligations for most contemporary AI systems.

The California Privacy Protection Agency (CPPA)

 finalized comprehensive regulations in mid‑2025, 

with ADMT rules taking effect January 1, 2027

, and related risk assessment and cybersecurity audit requirements phased in between 2027 and 2030. These regulations require businesses to provide pre-use notices, implement meaningful human oversight, and maintain detailed audit trails of automated decision-making processes.

 are taking effect on October 1, 2025, establishing frameworks for AI-based tools used in hiring, performance evaluation, and workplace decision-making. These regulations impact third-party AI vendors and require employers to demonstrate proactive bias testing and risk mitigation efforts.

How do California’s AI laws impact companies across growth stages?

California's AI regulations create different compliance obligations depending on organizational size, resources, and growth trajectory. Understanding these variations will help you develop compliance and governance strategies that align with both current capabilities and future growth objectives.

1. SMB and private company considerations

Small and medium-sized businesses might find it challenging to navigate California’s AI regulations due to resource constraints and limited technical expertise. However, these regulations also create opportunities for SMBs to demonstrate sophisticated governance practices that can enhance stakeholder confidence and competitive positioning.

The transparency requirements under AB 2013 create documentation and disclosure obligations that can overwhelm smaller organizations lacking dedicated compliance resources. SMBs developing or substantially modifying generative AI systems must now maintain comprehensive records of training data sources, implement watermarking capabilities, and provide detection tools to users, all requiring additional development resources and ongoing maintenance.

For growth-stage companies preparing for funding rounds or strategic transactions, California AI regulation compliance demonstrates governance maturity that can make investors more confident. Organizations that proactively implement 

 frameworks position themselves favorably for due diligence processes and build scalable compliance infrastructure.

 can help growth-stage companies automatically identify compliance gaps and regulatory risks within their documentation, ensuring they meet California's transparency and disclosure requirements while preparing for investor scrutiny.

2. Mid-market and pre-IPO company requirements

Mid-market and pre-IPO companies face governance complexity as they scale operations and prepare for public market transition. California’s AI regulations create additional layers of compliance requirements that must be integrated with existing governance and IPO readiness initiatives.

Employment AI regulations create particular challenges for growing companies implementing AI-powered HR systems for the first time. Organizations must comply with FEHA requirements while building scalable human resources infrastructure, requiring careful coordination between legal, HR, and technology teams to implement appropriate governance controls.

Pre-IPO companies using AI for customer-facing applications must comply with the 

, including the new ADMT requirements. The regulatory framework's emphasis on meaningful human involvement in automated decision-making may require restructuring operational processes that were previously fully automated, creating implementation challenges during critical growth phases.

3. Enterprise and public company compliance

Large enterprises and public companies face the most comprehensive compliance obligations under California's AI regulatory framework, but they also possess the resources and infrastructure necessary to implement sophisticated governance solutions

The transparency requirements create fundamental changes in how technology giants approach AI development and commercialization. Companies like OpenAI, Google, Anthropic, and Meta must now provide detailed disclosures about their training data, implement watermarking and detection capabilities, and report safety incidents to regulatory authorities, potentially affecting competitive dynamics by reducing the proprietary nature of AI development methodologies.

Public companies must conduct comprehensive 

, implement opt-out mechanisms for automated decision-making, and ensure meaningful human involvement in significant decisions affecting consumers. The cybersecurity audit requirements add additional compliance layers that require ongoing investment in security infrastructure and documentation practices.

While SB 1047 will not come to pass, there are a host of other AI regulations in California that emphasize transparency, fairness and safety, requiring businesses to disclose their use of AI, conduct impact assessments and meet stringent privacy and nondiscrimination standards.

California’s AI regulations to increase accountability

Among the goals of the proposed AI regulations is to ensure that businesses disclose the use of AI to consumers and take action to limit discrimination by AI tools.

Several bills were under legislative consideration, including:

: This bill aimed to prohibit algorithms that disadvantage people based on gender, race, or sexual orientation, requiring impact assessments and notification of consequential decisions.

Inactive in the Senate as of August 2025. The bill was pulled before reaching the Governor's desk after amendments narrowed its scope to employment decisions.

2. AB 3204 (AI Registration Requirements)

: Requires businesses using personal information to train AI to register with the CPPA.

Legislative progress unclear. While amendments indicate provisions operative from February 2025, there’s no confirmation of final passage as of August 2025.

: Proposed AI risk management standards for state agency procurement, including NIST framework alignment and incident reporting.

Vetoed by Governor Newsom in September 2024 due to concerns about IT modernization disruption and costs.

4. SB 896 (California AI Accountability Act)

: Requires state agencies using generative AI to disclose its use publicly and perform risk documentation. Private businesses contracting with these agencies must also comply.

Signed into law September 29, 2024, effective January 1, 2025.

California’s AI regulations for specific industries

California's AI regulations now include several industry-specific requirements that have become law:

The Physicians Make Decisions Act (SB 1120)

: Signed into law September 30, 2024, effective January 1, 2025. Requires health insurers and healthcare service plans to ensure that licensed physicians supervise AI decision-making tools when approving, modifying, or denying provider requests, maintaining human oversight in medical decisions.

: Signed into law September 17, 2024, effective January 1, 2025. Enhances workers' control over AI-generated digital images and voices. Contracts involving AI-generated likenesses require informed consent and legal or union representation, strengthening performers' rights against unauthorized use.

: AB 801 (signed into law in late 2024) requires online services to delete student information upon request; AB 1824

(effective January 1, 2025) requires disclosure of AI-generated content in educational settings; and SB 970 (effective January 1, 2025) mandates warnings about generative AI technology risks for students.

Building compliance readiness for California AI regulations

California's AI regulatory framework creates the most sophisticated compliance environment in the U.S. The impact varies across company growth stages, which requires tailored approaches for startups, growth companies, and established enterprises.

Organizations operating in California markets need practical compliance strategies that address specific regulatory requirements while supporting business growth objectives. 

 provide practical pathways to address these compliance challenges while building scalable capabilities that support future regulatory evolution.

 to discover how California's AI regulations connect to global regulatory trends and gain expert insights on preparing for AI governance requirements, cybersecurity regulations, and compliance complexities across multiple jurisdictions.

What California’s AI regulations mean for your company

 are the link between day-to-day operations and effective governance oversight. These systematic processes enable organizations to identify risks early, ensure accurate financial reporting, and demonstrate regulatory compliance — providing boards and executives with the reliable information needed for strategic decision-making.

Organizations looking to strengthen their controls typically focus on two key areas: automating processes through dedicated 

 and creating robust documentation systems.

Whether you are documenting controls for financial reporting or enhancing your internal controls processes across your entire risk profile, having a comprehensive approach to document management for internal controls can make all the difference.

Here, we explore the approach organizations need to document internal controls, from initial risk assessment through ongoing monitoring and improvement.

Documenting internal controls: a step-by-step process

While internal controls processes can have

, documentation shouldn't be one of them. The good news is that internal controls documentation can be straightforward if you take a structured approach.

Here's our step-by-step guide to documenting internal controls:

1. Comprehensive risk assessment and mapping

Identify the processes and activities that create your most significant risks — the ones where key controls need to be measured and documented. Modern risk assessment extends beyond traditional financial risks to encompass operational, technological, and regulatory dimensions that reflect today's complex business environment.

Examples of risks requiring documentation include:

 Third-party vendor relationships, supply chain disruptions, and key personnel dependencies

 Artificial intelligence deployment, cybersecurity vulnerabilities, and system integration failures

 Evolving compliance frameworks, data privacy requirements, and industry-specific regulations

Organizations should also document risk appetite statements, risk tolerance thresholds, and interdependencies between different risk categories. This comprehensive approach ensures that internal control documentation addresses the full spectrum of organizational risk exposure rather than focusing solely on traditional compliance areas.

2. Establish a robust internal control framework

Put in place a structured internal control framework that sets out your approach to controls for all the key risks identified in your risk assessment, including setting control objectives, parameters, and comprehensive requirements around documentation standards.

Define roles and responsibilities across multiple organizational levels

Specify documentation standards that meet current regulatory expectations

Best practice frameworks incorporate the 

Committee of Sponsoring Organizations (COSO) Internal Control - Integrated Framework

 principles while adapting to contemporary challenges such as remote work environments, cloud-based systems, and automated decision-making processes.

The framework should specify documentation requirements for different types of controls, establish review cycles, and define escalation procedures for control exceptions or failures.

Record the measures, processes, or checks you implement to ensure your controls are met. Some processes will naturally be more complex than others and require more detailed documentation. Some, like internal controls for 

, may be mandated by regulations like the 

 and need to be documented to specific standards.

Modern documentation practices now extend beyond traditional process documentation to include system-generated audit trails, automated control monitoring results, and integration with broader governance platforms. As such, organizations should document both manual and 

, specifying the technology platforms, data sources, and exception handling procedures.

4. Detailed control specifications and dependencies

Capture all individual controls to build the complete picture of your internal control measures.

Control documentation must address the interconnected nature of business processes, where controls often depend on multiple systems, data sources, and organizational functions.

Organizations should map control relationships, identify single points of failure, and document backup procedures as a safeguard during system outages or personnel changes.

The documentation should specify performance indicators, tolerance levels, and escalation triggers. For controls involving third-party systems or processes, documentation must address vendor management requirements, service level agreements, and contingency procedures.

5. Clear accountability and responsibility structure

Document who owns each internal control, how they're held accountable, and how control performance is monitored and reported. Documentation should specify primary and secondary responsible parties, escalation pathways, and oversight mechanisms.

The accountability framework should integrate with performance management systems, so control responsibilities are reflected in individual and team objectives. Documentation must also address training requirements, competency standards, and succession planning to limit the impact of personnel changes.

6. Test your controls and document the results

essential components of the internal controls process

. Via sample testing, you must identify and document potential areas where your controls might fail. Note down all the controls that work as they should, and capture any exceptions in a remediation log to be addressed as soon as possible.

Organizations should also document testing frequencies, practical sampling approaches, and testing methods that ensure proper oversight while managing costs and time.

7. Regular review and continuous improvement

Even without exceptions, your controls should be tested regularly, and your entire approach revisited periodically based on changing business conditions or regulatory requirements. Documenting this review process is an essential aspect of establishing

Make sure to capture review results, improvement recommendations, and 

Internal control documentation examples and modern approaches

How do you document internal controls in practice? Here are common approaches organizations use.

 start with familiar tools that require minimal upfront investment:

Spreadsheet-based control matrices tracking control descriptions, owners, and testing results

Word document procedures outlining step-by-step control activities

Email chains for control testing, evidence, and exception tracking

Shared drive folders organizing control documentation by department or process

Leading companies are adopting more sophisticated methods that provide better visibility and efficiency:

Process flowcharts that visually map control activities within business processes

Automated control monitoring that generates real-time performance data

Dashboard reporting that provides instant visibility into control effectiveness

Exception management systems that track issues from identification through resolution

The shift toward technology-enabled documentation

While some organizations still rely on spreadsheets and document-based systems, other companies are moving toward integrated governance platforms that provide centralized control libraries, automated documentation generation, and real-time monitoring capabilities.

internal controls management software like Diligent

Centralized risk and control libraries that eliminate duplicate effort

Automated documentation generation that reduces manual work

Real-time monitoring that catches issues before they become problems

Integrated reporting that supports both operational management and investor presentations

Alongside more efficient compliant processes, reduced costs, greater confidence in your controls, and less potential for human error — a recognized potential 

 — automating your internal controls process can help to make documenting internal controls an in-built part of your controls design and implementation.

Realize the benefits of documenting internal controls

Effective internal controls documentation provides clear accountability structures, reduces compliance risks, and enables faster audit processes. Documenting internal controls preserves institutional knowledge during organizational changes while enabling data-driven decisions through consistent and transparent workflows.

However, manual documentation approaches quickly become bottlenecks for large organizations. Leading companies are implementing 

 that automate control testing and generate audit-ready reports.

Diligent's AI-driven Internal Controls Management

 can streamline compliance, reduce manual effort, and improve risk management.

How to document internal controls in 7 steps

This article originally appeared in our August 14 edition of the Diligent Minute Newsletter. For more insights like these, delivered straight to your inbox, subscribe

Transaction activity (acquisitions, funding rounds, and IPOs) may be lower on many corporate priority lists right now, as market slowdowns, policy uncertainty, and trade whiplash continue. M&A announcements recently 

That’s why Diligent is currently collecting insights from boards and executives about what’s working (and what’s not) when it comes to transaction readiness. If your organization has recently completed or is planning for a transaction, we encourage you to participate in our ongoing 

in collaboration with Wilson Sonsini, NetSuite, the CFO Leadership Council, and the CFO Alliance.

Despite recent turbulence, however, research from our 

 conducted with Corporate Board Member shows 76% of public company directors still see growth as the year’s top priority, and nearly 40% specifically cite M&A as a key agenda item for their boards, with smaller companies most likely to lean in as deals return.

Deals aren’t off the table; they may just be harder to attract. And that makes them even more valuable.That means getting your governance house in order should be a top priority, so you won't miss out when opportunity knocks.

 published by Diligent, dives into transaction preparedness and emphasized a key point worth repeating:Investors, regulators and the leadership teams putting a deal together today demand governance that’s fast, transparent and ready for anything.

Here are a few things to keep in mind for achieving this goal:

“We’ll tackle it when it happens” is no longer a viable strategy for transaction preparation.

When reporting is rushed, or due diligence not given its due, errors happen. Outdated information finds its way into documents, and important details fall through the cracks, impeding decisions, impacting valuations and even stalling deals entirely.

This last-minute scramble goes away when companies integrate transaction-ready governance into everyday operations. Compliance processes and audit reporting are robust. Board composition is strong. And the business itself is positioned to strike — successfully — when opportunity arises.

Getting your house in order requires the right tools

Transaction readiness also demands the right technology and processes. For example, think about all of the activities a merger or acquisition entails. Effective execution requires clean entity records, organized due diligence documentation and accurate, transparent audit trails that track progress as it happens.

Kristy Grant-Hart, Head of Advisory Services at Diligent, spoke from recent experience navigating Spark Compliance’s acquisition: “The pace and complexity of today’s deals is incredible. There is so much data and information to obtain in such a short time. Having connected, secure systems, and being ready for due diligence was absolutely critical in getting through the process smoothly. Unified collaboration across systems, data, and people is the key to success.”

Now is the time to bring such capabilities on board. Integrated reporting, AI-driven workflows, secure document management — they are all essential to minimizing risk and building investor trust.

Transaction readiness signals credibility and gives your company the edge when it counts.

PE and VC firms are understandably selective right now. They want to see clean financial reporting and clear governance structures, proactive risk management and agile, scalable systems. They want to invest in nimble, resilient companies who demonstrate progress against their objectives and deliver long-term value.

Disciplined transaction readiness gives them confidence.

What does this mean for your ongoing operations? For starters, benchmarking, due diligence reviews and scenario planning are more than rote compliance exercises. They’re strategies that sharpen your competitive edge.

Moreover, disciplined governance not only attracts more opportunities but also increases the likelihood of faster, smoother transactions and successful integration post-close.

As we have highlighted, while the IPO market remains cautious, it is far from closed. Meanwhile, the M&A pipeline is poised to accelerate as private equity firms seek exits and strategic buyers pursue growth.

The companies that embed transaction readiness into their culture today will be best positioned to act decisively and gain a competitive edge when the market shifts.

Want regular access to original research in the field of GRC? Bookmark our 

 for the latest surveys, podcasts and reports.

Preparing your team, tech and tactics for deals on the horizon 

Leadership in the boardroom is a multifaceted journey that requires a blend of diverse experiences, proactive engagement, and strategic preparation. At the Next Gen Board Leaders Summit, seasoned board chairs including Alicia Syrett, Founder of Madam Chair, provide valuable insights on what it takes to lead a board effectively and create a strong boardroom culture.

The ​​p​​ath to ​​b​​oard ​​l​​eadership

​​Board​ chairs typically reach their positions through a combination of executive experience, committee work, and active involvement in board matters.​There​’s no set formula, but d​​iverse backgrounds and a ​​bias for action​​​ a​re essential. Continuous learning, such as seeking out mentors and familiarizing oneself with board and committee responsibilities, can help build the necessary skills and credibility. ​That said, ​​i​t's also crucial ​for aspiring chairs ​to be realistic about the time commitment required for the role.

Resources and ​​p​​ractices for ​​e​​ffective board chairs

To excel in the chair role, familiarity with key resources like 'Robert’s Rules of Order' and practical articles like 'How to be a Good Chair' can provide a solid foundation. ​Bu​t it’s the consistent habits that matter most. ​​Strategic use of the agenda, starting meetings with ​​planning​ and forward-looking topics​, and conducting pre-meeting calls with directors can ​clarify priorities and ​foster alignment. Engaging directly with shareholders and proxy advisors is vital for anticipating issues and building trust. Regular communication with the CEO and fellow directors, as well as ​​creating​​ an environment where directors feel comfortable raising ​​tough questions and dissenting views​​ is also crucial.

: ​​A good​​ board chair ​​acts as​​ the 'conductor of the orchestra,' responsible for ensuring the board operates cohesively.

: Effective chairs take their responsibilities seriously, benchmark against other boards, and ​​seek​​ regular ​​feedback from​​ the CEO and fellow directors.

​​​Making the most of​​ meeting time

: By prioritizing strategic planning​, sharp agendas, and candid discussion,​ the chair can ​drive more meaningful outcomes ​​​​​​​in​​ limited meeting time.

​​M​aintaining a ​​s​​trong ​​b​​oardroom ​​c​​ulture

​​​Culture starts with the chair – and a​​ robust boardroom culture is essential for the board's effectiveness. Regular assessments, ideally conducted by third parties to gather unfiltered feedback, are critical. The chair should act on this feedback and​​ actively reinforce high expectations for board conduct and performance​​. By identifying and ​​actively drawing out​​​​​​ the strengths of each board member, the chair can ensure that the board remains a dynamic and effective decision-making body.

In summary, effective board leadership ​requires more than experience ​– it calls for ​​​​preparation, ​​intentionality, ​​and a commitment to fostering a strong, cohesive boardroom culture. By following the insights shared by experienced chairs, aspiring leaders can better navigate the complexities of board leadership and contribute to the success of their organizations.

Diligent

Blog

What California’s AI regulations mean for your company

How to document internal controls in 7 steps

Your Data Matters