SB 53 Whistleblower Protections: 1 Job Test, 4 Recipients and No Damages Clause

California gave AI lab employees a new right to report catastrophic danger, but only if managing that danger is part of their job. Labor Code Section 1107.1 names 4 recipients and leans on a definition set at more than 50 people or $1 billion from a single incident. SB 53 whistleblower protections are real, and they are much narrower than the coverage suggests.

The short answer. SB 53 bars a frontier developer from preventing or punishing a covered employee's disclosure to the Attorney General, a federal authority, a person with authority over them, or an authorised covered colleague. The employee needs reasonable cause to believe in a specific and substantial catastrophic danger or an SB 53 violation.

This post is written for the practitioner, because the safety or security employee deciding whether to report needs the clause text more than a board does. It is an analysis of statute text, not legal advice. If you face a live decision, pay a California employment lawyer before you act.

SB 53 whistleblower protections start with a job test

Most whistleblower laws ask what you reported. Section 1107 also asks what you are paid to do.

Who counts as a covered employee

The operative words are short. A covered employee is "an employee responsible for assessing, managing, or addressing risk of critical safety incidents". Critical safety incident then has 4 limbs in Section 1107(c): weight theft with resulting harm, harm from a catastrophic risk, loss of control causing death or injury, and deceptive subversion of developer controls.

That language came late. The San Francisco Public Press reports that dozens of lines were replaced between 2 and 5 September 2025, narrowing whistleblowers to staff in critical safety roles. Sophie Luskin of Princeton's Center for Information Technology Policy called the definition "both unprecedented and a high bar".

We think this is the clause most likely to be fought over first. Does an infrastructure engineer who patches weight storage hold that responsibility? Does a product manager who signs off a launch? The statute gives no job titles, and you should expect an employer to read it tightly once a dispute starts.

Which employers are bound

Section 1107.1(a) binds any frontier developer. The Business and Professions Code defines that as a person that has trained, or started training, a model above 10^26 integer or floating-point operations. Revenue does not matter for the retaliation ban. Revenue matters only for the anonymous channel, which is limited to large frontier developers with more than $500 million in annual gross revenues.

A small developer that crosses the compute line owes the notice duty and the retaliation ban, but it owes no anonymous channel. Our comparison of published SB 53 safety frameworks covers the disclosure side of the same statute, so this post stays with the employee.

SB 53 clause by clause: what Section 1107.1 actually says

The table quotes the enacted Labor Code text. The right-hand column is our reading, and it should be treated as that. The section took effect on 1 January 2026, according to Greenberg Traurig.

Quotes from Labor Code 1107.1 and 1107.2 as published by FindLaw, current as of 1 January 2026. Clause (c), which permits use of the Section 1102.7 hotline, is omitted for space and is not a limit on any right above.

Read together, the two limbs behave very differently. The violation limb adds little for most staff, because Section 1107.1(j)(1) confirms that everyone else can already report SB 53 violations under Section 1102.5. The danger limb is the new right, and only covered employees hold it.

Frontier AI whistleblower disclosures must clear a catastrophic-risk bar

A danger disclosure needs reasonable cause on a stacked test. Figure 1 sets out the gates in the order you meet them. Each one can end the claim before anyone reaches the merits.

The Labor Code calls it "a foreseeable and material risk" that a model will materially contribute to harm above the 50-person or $1 billion line. The harm must arise from one incident, and the model must be doing one of 3 things: expert-level help with mass-casualty weapons, unsupervised conduct such as a cyberattack, or evading control.

Three exclusions then narrow it again. Publicly available information does not count, nor does lawful federal government activity, nor does harm from combined software where the model did not materially contribute. The Public Press traced the federal carve-out to a 5 September 2025 amendment.

Critics say this bar chills reporting. Luskin argues that whistleblowers would need to show a risk that is foreseeable, material and more than a good-faith concern. We read it a little differently. The statute protects reasonable cause to believe, so you do not need to prove the risk, only to hold a reasonable belief about it. The test is still hard, and that distinction will matter in court.

Why the equity clause is not about clawbacks

Section 1107.2 looks like it might address equity pressure, and it does not. The words "damage to or loss of property" appear in the chapter's risk and incident definitions, so the clause stops a stock price fall from counting toward the $1 billion line. That is our reading of the text, and we have not found a court applying it.

The actual clawback problem is older. William Saunders, formerly of OpenAI, told a 2024 Senate hearing: "You would lose all the equity you had in the company if you didn't sign this agreement." Section 1107.1(a) reaches any contract that prevents a protected disclosure, which helps. It never mentions equity, and the Public Press rightly notes that silence.

What employers must provide under SB 53's internal channel

This is the most concrete part of the law, and the part a compliance team can actually be audited on. There are 3 duties, and only the first applies to every frontier developer.

First comes notice. A developer must either keep a notice posted in every workplace, with equivalent notice to new and remote covered staff, or give written notice each year and ensure it is received and acknowledged. Second, a large developer must run an anonymous process, with a monthly update to the person who disclosed on the investigation and the actions taken.

Third, those disclosures and responses reach officers and directors at least once each quarter, minus anyone accused. This is the clause we like most. It removes the comfortable claim that leadership never heard about a report, and that changes how a board has to behave.

One asymmetry deserves attention. Section 1107.1(e)(1) uses a good-faith belief standard for the internal channel, whereas Section 1107.1(a) uses reasonable cause for the protection itself. So a concern could qualify for the channel and fall short of retaliation protection. If you are using the channel, write down why your belief is reasonable, not merely sincere.

The state will soon publish some evidence. From 1 January 2027, the Attorney General must produce a yearly report with anonymized and aggregated information about covered-employee reports. Until that report appears, nobody outside the labs can say whether this channel is being used at all. Connecticut has since added its own frontier whistleblower duties, covered in our review of the Connecticut act.

How SB 53 compares with federal whistleblower routes

There is no general federal right to report AI danger. As Tech Policy Press authors put it in August 2026, "There is no single federal whistleblower law." Federal employees have wording close to SB 53's danger limb, "a substantial and specific danger to public health or safety", but private lab staff cannot use that statute.

Compiled from statute and bill text read on 6 November 2026. "None stated" means the quoted sections do not state a deadline. It does not mean no deadline applies, since general limitation law may do so.

Sarbanes-Oxley: strong terms for a narrow subject

18 U.S.C. 1514A protects internal reports and voids pre-dispute arbitration, which SB 53 does not. But it covers fraud-type conduct at companies with registered securities or Section 15(d) reporting, and its 180-day clock is short. A private lab is mostly outside it, although a listing, such as the one discussed in our analysis of Anthropic's IPO case, would change that. A safety concern fits only if it also amounts to something like misleading shareholders.

Dodd-Frank: the money route, with one trap

The SEC pays between 10% and 30% of money collected where sanctions exceed $1 million, and the statute grants 2x back pay. The trap is order of operations. In Digital Realty Trust v. Somers, the Supreme Court held that the retaliation provision "extends only to individuals who have reported violations of the securities laws to the SEC". If you report only inside the company, Dodd-Frank does not protect you.

Separately, SEC Rule 21F-17(a) says "No person may take any action to impede" direct communication with SEC staff about a possible securities violation. That helps wherever a confidentiality clause blocks a securities report. It does nothing for a pure safety concern.

Trade secret immunity has a gap for danger reports

Lab staff worry most about trade secrets, and 18 U.S.C. 1833(b) offers real cover. It shields a confidential disclosure to a government official or attorney made "solely for the purpose of reporting or investigating a suspected violation of law". A danger report with no suspected violation may not fit those words, and Section 1107.1 never mentions trade secrets. We would treat this as an open question, and we would take legal advice before attaching anything proprietary.

The federal AI bill is still only a bill

S. 1792, introduced on 15 May 2025 by Senator Grassley, covers contractors and voids arbitration and waiver. Its danger language has no 50-person threshold. It reaches "any failure to appropriately respond to a substantial and specific danger" to public safety, public health or national security.

In September 2026 Deseret News reported that Grassley wanted passage before the midterms and could seek unanimous consent. A same-week Newsmax report said it had "not yet received a Senate vote", and one objection could block the effort. We found no report of what followed, so treat the bill as pending until Congress.gov says otherwise. A near-identical amendment to the defence authorisation bill also exists, per Tech Policy Press.

What the AI accountability law leaves out

Comparing Section 1107.1 with its older California sibling shows what the drafters did not carry across. Section 1102.5 is the better test here, because Section 1107.1(g) copies the burden language of Section 1102.6 almost word for word. So the omissions look deliberate or at least visible.

Four phrases Section 1107.1 does not contain

Section 1102.5 protects a report "regardless of whether disclosing the information is part of the employee's job duties". Section 1107.1 omits this, even though every covered employee is defined by that duty. An employer could argue that a routine risk memo is just work rather than a disclosure, and we would want that argument closed.

Section 1102.5(b) also protects an employee the employer believes "disclosed or may disclose" information, which reaches pre-emptive firing. It also protects testimony to "any public body conducting an investigation, hearing, or inquiry". Neither phrase appears in Section 1107.1. Nor does the $10,000 per-employee civil penalty of Section 1102.5(f), although Section 1107.1(j)(2) keeps remedies under other state law available.

Damages, contractors and the press

Greenberg Traurig says covered employees "may pursue damages for any harm suffered", while Luskin says the law does not clarify what damages are available. The text supports Luskin's concern. Section 1107.1 names fees and injunctions, and the word damages appears nowhere in it. Cumulative remedies under Section 1107.1(j)(2) may fill that hole, but a court has to say so.

Contractors are also outside the text, along with auditors and red-teamers who are not employees. Luskin lists contractors, consultants and external auditors among those excluded. Press disclosure appears on neither list, here or in S. 1792. Readers comparing how workers gain rights by contract may find our review of union AI clauses useful, because bargaining can reach what these statutes miss.

Where this reading is weakest

Our scorecard flatters S. 1792, and you should discount it. We picked the 6 tests after reading the bill, and they leave out SB 53's best feature, temporary injunctions on reasonable cause that are not stayed on appeal. A fired employee who needs their job back this month may value that over double back pay after years of litigation. A bill that has not passed also has no case law, no agency practice and no enforcement record.

SB 53 has a fair defence too. Encode AI's Sunny Gandhi, whose organisation co-sponsored it, voiced concern to the Public Press about going too far on who gets access. Senator Wiener called the bill "a very bold new step in whistleblower protections" and said reporting could be "before or after" harm. We think the job test is too tight, yet a narrow enacted right beats a broad pending one, and it can be amended.

The evidence base is thin in one clear way. We found no reported decision applying Section 1107.1, so every reading here is text, not case law. Federal preemption could also change the picture, although our executive order ledger counted 0 state laws preempted at its last update.

Frequently asked questions

What to do before you report

If you work at a frontier developer, do one thing this week before any concern exists. Find your SB 53 notice under Section 1107.1(d) and check whether your job description mentions safety incident risk. If it does not, ask in writing whether the company treats your role as covered.

If you already hold a concern, sort it before sending it. Write 2 separate lines: which law you believe was broken, and what catastrophic danger you believe exists. Those lines point to different statutes and different recipients. Then take them to an employment lawyer, because Dodd-Frank's SEC requirement and the 180-day Sarbanes-Oxley clock can punish the wrong first move.

Related reading