What happened
Governor Gavin Newsom signed SB 574 on September 30, 2026, making California the first state to regulate how attorneys use generative AI. The law does not ban the technology. It limits certain uses, puts guardrails around others and requires disclosure in defined circumstances. It takes effect on January 1, 2027, and violations can lead to sanctions imposed by courts in some situations and by the state bar in others.
The requirements are specific. An attorney cannot delegate the practice of law to generative AI, and the same nondelegation limit applies to arbitrators. Attorneys may not enter confidential, personal identifying or other nonpublic information into a generative AI system that is not restricted to the attorney and people the attorney authorises. They must personally verify the accuracy of generative AI output, including every case and statutory citation, and correct anything that is erroneous or hallucinated. They must also disclose the use of generative AI for any document submitted to a court. For content provided to the public, disclosure is a judgement call rather than an obligation. Arbitrators may not rely on generative AI information from outside the record unless they first disclose it to the parties and, where practical, give them an opportunity to comment.
Enforcement has reach. The state bar may pursue these duties against all California licensed attorneys, including in house counsel and those appearing pro hac vice, and the citation verification rule applies to every paper filed in a California court regardless of where the filing attorney is licensed. Whether the court disclosure requirement can be enforced for filings made in out of state courts remains an open question. As the firm analysis on JD Supra notes, the statute partly formalises preexisting standing orders and ethics rules, since the Business and Professions Code and the California Rules of Professional Conduct already impose broad duties of confidentiality, competence, supervision and diligence that overlap with the new requirements. The authors suggest SB 574 may serve as a blueprint for other states.
Why this is a GRC story
Nondelegation is human in the loop, written into law. A named professional stays accountable for the output. That is the same principle sitting underneath most AI governance frameworks, except here it comes with sanctions attached.
Confidentiality rules map to model risk. The restriction on entering confidential or identifying information into unapproved AI systems is the data handling control many enterprises are still trying to achieve through policy alone.
Verification and correction are controls, not intentions. Personal review of citations and correction of hallucinated content require a defined process and evidence that it ran. A firm that cannot show its review steps is exposed.
Disclosure is the transparency lever. Regulators increasingly want to know when a machine was involved in producing a decision or a document. Expect licensing bodies in other professions to copy the structure.
What to watch
Watch whether other states adopt similar legislation, and how courts apply sanctions in the first cases, because penalties set the practical bar for everyone else. Watch too how in house legal teams write AI use policies to satisfy a statute that binds counsel and, indirectly, the business functions working alongside them. The template is now public for any regulated profession weighing rules of its own.
Attribution: Analysis based on Morrison & Foerster on JD Supra and related public reporting. This article is original commentary, not a repost of the source material.