On 29 September 2024 California Governor Newsom vetoed Senate Bill 1047. The bill would have required developers of frontier models to establish safety frameworks, conduct risk assessments and report safety incidents. The veto turned on innovation, cost and regulatory scope. It did not end the American debate about frontier models; it put the divergence on the table: state legislation first, or a unified federal framework.
What the bill required
The core of SB 1047 was a self-regulatory duty on the developer side: establish a written safety framework, assess model capabilities and foreseeable risks, and report safety incidents to a designated authority. Responsibility sat with the developer rather than the user or the platform. That approach differs from the product-side conformity model of the EU AI Act and comes closer to a logic in which greater capability carries greater duty.
What the veto reasoning reveals
The stated reasons centred on innovation, cost and regulatory scope. Opponents worried that compliance burdens would push smaller developers out of the market, and that a state law would become a de facto national standard. Supporters argued that the externalities of frontier models cannot be resolved by voluntary commitments. The underlying dispute is about timing: set rules before capabilities manifest, or remedy harm after it occurs.
State paths versus the federal path
US AI governance has long run on several tracks at once: federal executive measures, agency guidance and procurement rules on one side, and a growing body of independent state legislation on the other. The veto of SB 1047 does not stop state-level activity. For companies, the real risk is not whether one bill becomes law, but that different states impose different requirements on the same product, producing a patchwork of obligations.
Practical consequences for the US market
AI companies selling into the United States need to separate three questions: whether the product falls within the definition of a frontier model; whether there is substantive business and a user base in California or other states; and whether the existing safety framework can withstand questions about risk assessment and incident reporting. Even without a statutory duty, customer contracts, insurance terms and investment due diligence may require similar content.
Writing the safety framework into a checkable document is the cheapest preparation. It should cover the boundaries of model capability, the assessment method, the risk-handling process, incident classification and reporting paths. Such a document is usable across state law, federal rules and customer review.
Three indicators to watch
Whether the legislature reintroduces a similar bill; whether federal agencies absorb the requirements through procurement or sector guidance; whether major model developers convert voluntary commitments into published safety reports. Changes in these three areas will directly affect how compliance resources are allocated.
For a comparison of US rules with other jurisdictions, see our multi-jurisdiction compliance service; for implementing a safety framework and incident response, see cybersecurity compliance.
This article is based on public information about the veto of SB 1047 by the Governor of California on 29 September 2024. It is for reference only and does not constitute legal advice.