California's AI Transparency Laws: Compliance Guide for Nonprofits

The Law Most Nonprofits Haven't Heard Of, But Should Have

While high-profile bills like SB 1047 dominated AI news coverage in California, the most consequential AI law for nonprofits is one that received far less attention: the California Fair Employment and Housing Act (FEHA) Automated Decision Systems Regulations, finalized in June 2025 and in effect since October 1, 2025. Unlike many California AI laws that target large tech developers, FEHA applies to any California employer with five or more employees.

If your nonprofit uses AI tools in any part of the hiring process, including resume screening software, applicant ranking systems, job matching platforms, interview scheduling tools, or performance evaluation systems, these regulations apply to you right now. The FEHA regulations are also not limited to tools your organization builds. Off-the-shelf AI software that your HR or recruiting team uses to make or support employment decisions falls within scope.

What makes these regulations particularly impactful is their prohibition on adverse impact. Even if an AI system treats all candidates the same on its face, if it produces discriminatory outcomes for protected groups under California law, including race, national origin, sex, gender, disability, religion, pregnancy, age, and sexual orientation, that constitutes an impermissible employment practice unless the employer can demonstrate job-relatedness and business necessity. This is a high standard borrowed from decades of employment discrimination law, now applied directly to algorithmic systems.

California's AB 2013, the Generative AI Training Data Transparency Act, took effect January 1, 2026. It requires any entity that designs, codes, produces, or substantially modifies a generative AI system for public use to publish detailed disclosures about the data used to train their models. The required disclosures cover data sources, whether personal information is included, IP and copyright considerations, data acquisition details, and processing history.

For most nonprofits, AB 2013 does not create a direct compliance obligation because it applies to AI developers, not users. If your organization uses ChatGPT, Claude, Gemini, or other commercial AI tools, you are not the developer and are not required to file disclosures. However, the law creates an important new lever for nonprofit vendor due diligence: the AI tools you use should now have published training data disclosures on their websites that you can review.

This matters because training data transparency is directly connected to questions nonprofits frequently ask about their AI tools: Was the model trained on personal information? Could it reproduce copyrighted content? Does it embed biases from historical data? AB 2013 compliance disclosures won't answer every question, but they create a new baseline of information that thoughtful nonprofits should incorporate into their AI selection and governance processes.

One important caveat: as of early 2026, AB 2013 faces an active First Amendment legal challenge. Elon Musk's xAI filed a federal lawsuit in late December 2025 arguing the law constitutes compelled speech. The law remains in effect while litigation proceeds, but the legal landscape may shift. Organizations should monitor developments while continuing to incorporate training data disclosure review into their vendor practices regardless of the law's ultimate fate.

Beyond the broadly applicable FEHA regulations, several California AI laws target specific use cases that are particularly relevant to mission-driven organizations. Understanding these is especially important for nonprofit leaders in health, social services, and youth programming, where AI tools are increasingly common and where the stakes of misuse are highest.

Nonprofits that receive funding from California state agencies, or that operate under state contracts to deliver services, face an additional layer of consideration beyond the laws described above. Governor Newsom's Executive Order N-12-23, issued in September 2023, directed state agencies to establish AI risk assessment procedures, AI procurement guidelines, and mandatory staff training requirements. While this order applies to state agencies rather than nonprofits directly, its influence is increasingly felt by organizations that work with those agencies.

State agency AI procurement guidelines now require executive-level oversight of AI tools, continuous monitoring, and demonstrated alignment with responsible AI principles. As these standards become embedded in state contract requirements, nonprofits that deliver state-funded services may find themselves asked to demonstrate AI governance practices that parallel what state agencies are required to do internally. This is a trend worth monitoring closely, particularly for organizations in health and human services, child welfare, workforce development, and other heavily state-contracted service areas.

Even without explicit contractual requirements, building AI governance infrastructure now positions your organization well for the direction regulations are heading. This includes maintaining an AI use register documenting what tools are deployed and for what purposes, establishing an internal AI point of contact, creating an incident response protocol for AI failures, and developing staff policies around acceptable AI use in program delivery. For more on building this foundation, our guide on building AI champions within your organization offers practical starting points.