Governor Newsom has signed AB 979 by Assemblymember Jacqui Irwin (D-Thousand Oaks), which requires the California Cybersecurity Integration Center to create a statewide AI Cybersecurity Collaboration Playbook to help agencies share cybersecurity threats and protect against attacks. The bill also calls for mandated reporting of threats by state AI contractors while ensuring confidentiality protections.

“This initiative would facilitate information sharing about threats to AI systems to promote safe deployment. Critically, the bill would mandate reporting mechanisms for state contractors and vendors providing AI services, requiring them to disclose known threats and vulnerabilities. It would also ensure that information can be shared confidentially between parties,” says the Assembly Floor analysis posted on September 12.

The development of AB 979 is tied to federal cybersecurity efforts initiated in the latter years of the Biden Administration.  A federal playbook focuses on AI’s reliance on non-deterministic models, which potentially creates new attack surfaces, exposing systems to risks like model poisoning.  It also underscores the need for standardized protocols such as the Traffic Light Protocol (TLP) to share sensitive cyber threat data responsibly.

The Joint Cyber Defense Collaborative (JCDC), created under the 2021 National Defense Authorization Act, brought together government agencies and private partners and the U.K.’s National Cyber Security Centre to coordinate cyber defense. In its final week, the Biden Administration oversaw the release of JCDC’s AI Cybersecurity Collaboration Playbook, a voluntary framework for sharing information on AI-specific vulnerabilities and risks across government, industry, and international partners.

The September 12 analysis states, according to the author, “[T]he state has multiple avenues in which this could be pursued, including through procurement contract language, the State Administrative Manual, or the State Information Management Manual”. In addition to mandatory reporting for state-related AI services, the California AI Cybersecurity Collaboration Playbook would also include a voluntary information-sharing mechanism for threats and vulnerabilities involving non-state-connected AI systems.”

The bill is estimated to cost approximately $713,000 in the first year and $463,000 ongoing until completion of the playbook, according to the analysis.