California’s SB 1047 passed the state legislature in August 2024. The bill targeted developers of large-scale frontier models, requiring them to establish a safety framework, conduct risk assessments and report safety incidents. It has been sent to the governor, and the decision to sign or veto is pending. For companies neither incorporated nor deploying models in California, the bill is still worth reading: it sets out, in a discussable structure, what frontier model developers are expected to do.
Three duties
The core of the bill can be reduced to three duties. A safety framework requires developers to set out in writing their safety management arrangements, including allocation of responsibility, risk tolerance and handling procedures. Risk assessment requires identifying model capabilities, misuse scenarios and failure modes at key stages, and keeping a record. Incident reporting requires reporting safety incidents to the relevant parties. The duties support one another: without a framework, assessment lacks criteria; without assessment, reporting struggles to define what a safety incident is.
Frontier models are defined by scale
The bill applies to large-scale frontier models, with the dividing line drawn at training scale rather than product use or user numbers. That approach creates a practical problem: one company may develop several models, only some of which are in scope; as models iterate and scale changes, coverage may change too. Developers need to keep the basis for the scale judgment for each model, rather than relying on a general statement that they are not a frontier lab. Teams using third-party compute or foundation models should also confirm their position in the development chain.
A safety framework must be a process
Safety frameworks are easily written as statements of principle and are then hard to execute. A usable framework contains at least four elements: who is responsible for which category of risk; under what conditions work must pause or escalate; the frequency of testing and review; and the standard for record-keeping and external explanation. The framework need not cover every hypothetical scenario, but it should let a new engineer know whom to ask and against what standard to judge a problem. Integrating the framework with the existing model release process is more sustainable than building a separate system.
Risk assessment and incident reporting
The value of risk assessment lies in doing it early. An assessment should state the boundaries of model capability, the ways it could be misused, existing controls and residual risk. For models whose capabilities change quickly, assessment is not a single conclusion but a record updated with each version. The key to incident reporting is definition: which situations count as safety incidents, who decides, to whom they are reported, and what material is retained. Too broad a definition produces reporting overload; too narrow a one misses material risk. Whatever the governor decides, companies still need answers to these questions internally.
Signed or vetoed, the issue remains
The governor’s decision will settle whether SB 1047 becomes law. It will not remove frontier model safety duties from the corporate agenda. Related requirements travel through other channels: safety clauses in customer contracts, platform onboarding policies, due diligence by investors and insurers, and further legislative attempts at the US state level. For developers, the practical response is to keep a reusable safety file containing the framework, assessment records, incident handling process and version notes. The file can answer customer questionnaires and can be adjusted quickly when rules change, without starting from scratch.
For tracking regulation across jurisdictions, see multi-jurisdiction compliance; for security testing and incident response, see cybersecurity compliance; for safety clauses and risk allocation in contracts, see commercial contracts.
This article is based on public information about SB 1047 passing the California legislature in August 2024. The governor’s decision remains pending and the final outcome should be checked against the governor’s office announcement. It is for reference only and does not constitute legal advice.