Gov. Gavin Newsom signed SB 574 on September 30, 2026, and somewhere in a few hundred California law firms, a managing partner just added “figure out what this means for us” to an already long list. Fair reaction. The law is short on specifics and long on duties, which is a particularly uncomfortable combination for anyone who bills by the hour and dislikes ambiguity.
Here’s the short version. The law takes effect January 1, 2027. From then on, attorneys practicing in California cannot delegate the practice of law to generative AI, cannot feed confidential or personal information into an AI tool unless access is genuinely restricted, must make sure every citation in a court filing has been personally verified, and must disclose AI use to the court. None of that sounds unreasonable on its face. What makes it hard is that AI compliance readiness isn’t a box you check once. It’s a set of standing technical controls your firm either has or doesn’t, and right now most firms don’t.
A quick AI readiness assessment built for law firms usually surfaces this gap in about an hour: the policy exists, the controls behind it don’t.
I think the firms that handle this well won’t be the ones who write the best policy memo. They’ll be the ones who build the boring technical plumbing underneath it.
What SB 574 Requires
SB 574 (Chapter 858, Statutes of 2026), authored by Sen. Tom Umberg, adds Business and Professions Code section 6068.1 and amends Code of Civil Procedure section 128.7. It also adds separate rules for arbitrators. Holland & Knight’s breakdown of the new law is worth reading in full. Four things stand out for anyone running IT or risk at a firm.
First, attorneys can’t hand over “the practice of law” to AI, though the statute never quite defines where assistance ends and delegation begins. Second, attorneys can’t enter confidential, personal identifying, or other nonpublic information into a generative AI system unless access to that information is restricted to the attorney and people the attorney has authorized who are bound to keep it confidential. Third, nothing filed in a California court can contain a citation that an attorney responsible for submitting it hasn’t personally verified, whether AI generated it or not. Fourth, an attorney who uses generative AI must disclose that use to the court for documents submitted to the court. The statute doesn’t say what the disclosure should look like or where it goes, and it has no exception for minor use. It also isn’t clear whether disclosure attaches only to filings AI helped produce or to every filing. Separately, attorneys must consider whether to disclose AI use in content they publish for the public.
Notice what’s missing: there’s no mention of logging software, no mandated audit trail format, no checklist for IT departments. The legislature wrote a professional responsibility law, not a technical spec. Building the AI compliance readiness behind it is left to you.
Why “We Have an AI Policy” Won’t Cut It
A lot of firms already have an AI use policy sitting in a shared drive somewhere. It probably says something sensible, like “don’t put client data into ChatGPT” and “always verify AI output before relying on it.” Good start. Not nearly enough.
Bloomberg Law’s coverage of SB 574 zeroed in on the same gap I’d flag: figuring out which filings used AI gets hard once AI is built into the research tools, drafting assistants, e-discovery platforms, and practice management software a firm already runs. If your compliance plan depends on an attorney remembering, after the fact, whether a drafting tool had AI features turned on, you don’t have a compliance plan. You have a hope.
What you need instead is a small number of real technical controls that don’t rely on memory or good intentions.
Control 1: Screen What Goes into the AI Tool
SB 574’s confidentiality provision isn’t really about banning AI. It’s about access control. Confidential, personal identifying, or other nonpublic information can go into a generative AI system only if access to that information is restricted to the attorney and people the attorney has authorized who are bound to keep it confidential.
Practically, that means you need to know, tool by tool, who and what can see the data once it’s submitted. A consumer-facing AI chatbot with no enterprise data agreement almost certainly fails that test. An AI feature embedded in your document management system, configured correctly, might pass it. The difference lives in the vendor contract and the access configuration, not in the marketing copy.
This is the same discipline behind local DLP for tools like ChatGPT, Claude, and Copilot, and it’s worth building a screening step into your intake process rather than trusting every attorney to make the judgment call alone, case by case, under deadline pressure. Firms that have already done this groundwork for general AI risk management are, frankly, ahead on SB 574 compliance readiness without having tried to be.
Control 2: Verify Every Citation, Every Time
The amendment to Section 128.7 is blunt: nothing filed in a California court can contain a citation that an attorney responsible for submitting it hasn’t personally verified, including citations an AI tool supplied. A paralegal’s cite-check alone won’t cover it. The statute doesn’t say which attorney counts when several are on the filing, so decide that for each matter in advance.
A technical control here looks less like software and more like workflow. Build a verification step into your matter management process, before filing, not during review of the final draft when everyone’s tired and the deadline is in two hours. Some firms are adding a citation checklist that has to be signed off digitally before a filing goes out, which at least creates a record that the step happened, even if it can’t force someone to read the case law carefully.
Sanctions under 128.7 aren’t theoretical. In Quinteros v. Harbor Distributing (2026), a California Court of Appeal upheld $6,000 in 128.7 sanctions against a firm and three of its lawyers over a brief with nonexistent citations and fabricated quotations.
Control 3: Tag AI Use So You Can Prove It (or Disprove It)
This is the control most firms are missing entirely, and it’s the one Bloomberg Law’s coverage zeroed in on. If a court asks whether AI touched a particular filing, can you answer with confidence in under a day? Most firms right now cannot.
The fix isn’t glamorous. It’s a disclosure tag, logged at the matter or document level, that records whether a generative AI tool was used in preparing a given filing and which tool. This doesn’t need to be complicated. It needs to exist, consistently, across every matter, so nobody’s reconstructing the answer from memory three months later when opposing counsel asks.
Think of it as an audit trail for AI touches, similar in spirit to the DLP and monitoring work firms are already doing around tools like Copilot and Claude. If you’re already logging AI activity for security reasons, you’re most of the way to logging it for SB 574 disclosure purposes too.
Control 4: Review the Whole Thing Quarterly
Your obligations under SB 574 won’t change, but your AI tool stack will. New features get added to existing software constantly, often without anyone in IT or risk signing off. A document platform that didn’t have AI drafting assistance in March might ship it by June.
Put a standing quarterly review on the calendar: which tools now have AI features, do they meet the confidentiality bar, has the citation verification workflow been followed, and does the disclosure log show what it should. Thirty minutes, four times a year, is a lot cheaper than finding out the hard way that a tool changed under you.
Where AI Compliance Readiness Fits into Your Broader Risk Picture
None of this exists in a vacuum. The confidentiality screening control overlaps heavily with general AI data loss prevention work. The disclosure tagging overlaps with the access logging most firms need anyway to manage AI risk across the firm, not just the SB 574 slice of it. If you’ve already worked through the kind of trust gap most firms face with AI risk, you likely have most of the raw material for SB 574 compliance sitting there already, just not organized around this specific law yet.
That’s the better way to think about AI compliance readiness generally. It shouldn’t be a separate project bolted onto your existing AI governance work. It should be a lens you apply to the governance work you’re already doing or should be doing. Firms treating SB 574 as a one-off memo are going to be rewriting that memo every time a new AI feature ships inside a tool they already use.
Getting Started
January 1, 2027 sounds far off until you remember how long it takes to implement a new workflow, get attorneys trained on it, and work out the kinks before it has to hold up in front of a judge. Realistically, firms need to start this quarter, not next.
If you haven’t mapped where AI already touches your practice, that’s the first move, before any of the four controls above make sense. From there, the confidentiality screening and citation verification pieces are usually the faster builds. The disclosure tagging tends to take longer because it has to plug into however your firm already manages matters and documents, and it’s the piece most firms underestimate.
We’ve built an AI readiness assessment specifically for law firms that walks through this gap analysis in a structured way rather than a gut check, and it’s a reasonable place to start if you’re not sure where your firm stands. Four controls, roughly an hour, and you walk away with a real list instead of a vague sense of unease.
Want to see where your firm stands before January 1? Request your free AI Readiness Snapshot and see the gaps before a court does.
Sources
- SB 574 bill text (California Legislative Information)
- SB 574 bill history (California Legislative Information)
- Office of the Governor, September 30, 2026 signing release
- Holland & Knight, “California Enacts Rules Governing Lawyers’ Use of Generative AI”
- Bloomberg Law, “California’s AI Law Hits Lawyers With Tough Disclosure Decisions”
- Quinteros v. Harbor Distributing, LLC, No. A174202 (Cal. Ct. App. June 11, 2026)
