California's AI and deepfake package is law. The federal version is still a draft.

What happened

California enacted a package of AI rules, according to a compliance roundup published by InsideDeepTech tracking U.S. AI safety law in 2026. The package covers three things that matter to people who publish: companion chatbots, AI-generated child sexual exploitation material, and age-verification signals. The same roundup reports penalties reaching $250,000 per action for some deepfake-related conduct.

That is a state law with numbers attached.

In Washington, the picture is different. Reuters reported on Sept. 11, 2026 that Senate negotiators were considering a requirement that AI firms mitigate known major risks before releasing a model — a design-safety duty. The final text was not confirmed. No bill number, no vote.

So the enforceable thing this month is a state statute aimed at synthetic likeness and chatbot behavior, not a federal rule aimed at model labs — and those two point at completely different people.

What this is not

It is not a ban on AI-generated content. Nothing in the reporting stops you from using generative video, synthetic voice, or an AI-assisted edit.

It is not a copyright rule. This package is about likeness, sexual content involving minors, and minors' access — not about whether a model trained on your archive. Those are separate fights, moving on separate calendars.

It is not federal. A California statute reaches conduct in California. If you publish to a national audience from a California IP, assume it reaches you. If you are in Ohio, it does not automatically apply — but platforms enforce to the strictest state they operate in, which is how state law becomes your law without anyone passing anything.

And the $250,000 figure is not a general deepfake fine. The reporting ties it to specific conduct within the package. I could not confirm which conduct triggers the maximum, or the effective dates. Treat it as the ceiling described by the source, not as your exposure.

The part that touches your work

Three pieces.

Companion chatbots. If you have shipped an AI version of yourself — a persona that talks to fans, a Discord bot trained on your voice, a paid "chat with me" tier — you are now operating in a category the state named specifically. Rules written for companion chatbots do not care that yours is a merch product.

Age signals. Age-verification requirements land on whoever hosts the interaction. For most creators that is the platform. But if you run your own site, your own paywall, your own app, you are the host.

Synthetic likeness. The deepfake penalties are the reason to be careful with faces and voices you did not license. Parody and commentary carve-outs exist in some statutes; the reporting available does not confirm their scope here. Do not assume the carve-out you remember from a 2024 law survived into this package.

The Senate item is background for now. If a pre-release mitigation duty passes, the cost lands on labs first and shows up in your tooling second — later launches, more refusals, narrower defaults.

What to do about it

1. Inventory every AI persona you operate. Name, platform, whether it takes money, whether minors can reach it. One line each.
2. If you run a "chat with me" product, read the companion-chatbot section of the California package before your next billing cycle — not after.
3. Pull the license paperwork for every voice and face in your last 90 days of uploads. If any of it is unlicensed likeness, that is the item to fix this week.
4. If you host your own paywall or app, ask your provider in writing what age signals they pass. Get the answer in email.
5. Do not pay for a compliance audit off a single trade-press roundup. Confirm effective dates in the statute text first.
6. Leave the Senate bill alone until there is a bill number. Watching a negotiation is not preparation.