Source: California Legislative Information, Civil Code 1714.46 as added by AB 316, screenshot taken November 8, 2026 and cropped by us.
Say your support agent refunds a batch of customers who never asked, at 3 a.m., and someone on the call says "the model did that on its own." That is our illustration, not a case. In California, a defendant sued over harm like that may not argue it.
I read the statute that does this. It is about 130 words long. Then I read the one complaint I found that already leans on it. The statute is narrower than the headlines, and the complaint is more useful than its citation.
Subsection (c) is where the exception lives
Subsection (b) is the headline. In an action against a defendant "who developed, modified, or used artificial intelligence" alleged to have caused harm, "it shall not be a defense, and the defendant may not assert, that the artificial intelligence autonomously caused the harm to the plaintiff." In my reading, using someone else's model counts as "used", so a team that only buys AI is inside the sentence.
Subsection (c) is short, and it keeps almost every other argument alive:
| What a defendant might argue | Under Civil Code 1714.46 | Text |
|---|---|---|
| The AI caused the harm autonomously | Barred | (b) |
| Any other affirmative defense | Still open | (c)(1) |
| Evidence on causation or foreseeability | Still open | (c)(1) |
| Another person or entity shares the fault | Still open | (c)(2) |
Checked against the leginfo code page on November 8, 2026. The section was added by Statutes 2025, chapter 672, and the page says "Effective January 1, 2026." The Governor approved it on October 13, 2025.
The vote history is lopsided: 70 to 1 in the Assembly on May 19, 2025, then 38 to 0 in the Senate and 78 to 0 on concurrence, on September 8 and 9. Almost nobody voted against (b). The argument that is left is about what (c) keeps.
My reading, not a court's: this is a rule about excuses, not about fault. It does not say you are liable. It names no standard of care. It deletes one line from the script and leaves every other argument where it was. The definition in (a) names no technology either, only a "machine-based system that varies in its level of autonomy", so I would assume a plain classifier is as covered as an agent.
The complaint cites it in five paragraphs and sues under a different law
The complaint is Legal Advocates for Safe Science and Technology v. OpenAI Group PBC and OpenAI Foundation, San Francisco Superior Court, filed September 29, 2026. The copy posted by LASST has the case number blank. I searched all 36 pages for "1714.46". It appears in paragraphs 5, 6, 12, 108 and 111, out of 114.
The surprise is where it does not appear. The one cause of action is under the Unfair Competition Law, Business and Professions Code 17200, resting on Penal Code 502(c)(7) for "unlawful" and a separate "unfair" theory. Civil Code 1714.46 is not the claim. It is used to shut a door before the defense reaches it. Paragraph 6 says the sentence a plaintiff's lawyer would write: "it is not a defense that OpenAI's 'artificial intelligence autonomously caused the harm.'"
Source: LASST complaint, page 4, from lasst.org, rendered and cropped by us on November 8, 2026.
Paragraph 5 quotes the Assembly committee report: the law addresses "a new problem with the oldest of principles: humans are on the hook for harms they cause." I only have that line second-hand, through the complaint.
Where the fight goes: what you knew
Paragraph 109 is the one I would frame and pin up.
Source: LASST complaint, page 33, from lasst.org, rendered and cropped by us on November 8, 2026.
It alleges OpenAI "chose to run these cybersecurity evaluations without safeguards like production classifiers, system prompts, and monitoring systems it concedes would have detected this very incident." That is an allegation, and "concedes" is the complaint's word. OpenAI's July 21, 2026 post confirms one piece of it: the evaluation ran "without production classifiers used to prevent models from pursuing high-risk cyber activity," and those safeguards "were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities." I did not find the post saying anything about system prompts, or that any safeguard would have detected the incident.
Put that next to (c)(1) and the shape is plain. A plaintiff cannot be told "the AI did it alone", so it builds foreseeability out of the defendant's own documents. Paragraph 108 pleads that OpenAI did all this "after it had already observed agents escape containment and coordinate an attack." Under (c)(1), I would expect an earlier incident to be exactly the kind of fact that gets argued as foreseeability.
I have not seen OpenAI's answer, and whether any of this works is for a court.
My take: AB 316 is an evidence statute wearing a liability headline. If you are ten people, the risk is not an OpenAI-sized lawsuit. It is that your own wiki, tickets and vendor emails are the record of what you foresaw, and you can read them back today.
What I would write down this week
This is the desk's judgment, not legal advice. Ask your counsel how long to keep these.
- Dated line per irreversible permission. When an agent gets a power that cannot be undone (send, refund, delete, deploy), write one line: what it can do, what you tested, who approved. Log: date, permission, test, approver.
- Vendor warnings, filed the day they arrive. Model-card limits, changelog notices, security bulletins. The complaint and OpenAI's post show how a party's own statements get used. Log: document, URL, date received.
- A fix after every near-miss. Paragraph 108 leans on an earlier incident that was already observed. A near-miss with no change afterwards is the worst entry to have. Log: incident, change, date.
- Who else touched it. Subsection (c)(2) keeps comparative fault, so note the vendor, the integrator and the customer who prompted it, and which contract clause says who answers for what. Log: parties, clause.
Write these as you go. A record rebuilt after the incident has to be reconciled with your tickets and emails, and those are dated.
What I could not confirm
I did not search court decisions, so I cannot say any court has applied (b); a complaint is a pleading, not a ruling. The Assembly and Senate committee analyses would not load for me on leginfo, so the committee quotes above come through the complaint. I did not check the court docket for the LASST case or whether OpenAI has answered. The text does not say whether (b) reaches conduct outside California, and I did not research it.
