California SB 574 and the Next Phase of AI Governance

Why California's new requirements for generative AI could influence information governance practices across the legal industry

Executive Summary

California has once again entered the national conversation about technology regulation. With the enactment of Senate Bill 574 (SB 574), the state has established statutory requirements addressing the use of generative artificial intelligence (AI) in legal practice and judicial proceedings.

Signed into law on September 30, 2026, and effective January 1, 2027, SB 574 addresses several concerns accompanying the growing adoption of generative AI within the legal profession: the protection of confidential information, the accuracy of AI-generated work product, the preservation of attorney judgment, and transparency regarding AI-assisted court submissions.

While the legislation directly concerns California's legal system and professional obligations, its implications warrant attention from law firms throughout the United States.

California has a history of influencing national discussions about privacy and information management. Its enactment of the California Consumer Privacy Act (CCPA) in 2018 preceded a wave of comprehensive state privacy legislation. Although other states have frequently adopted different legislative models, many have embraced similar underlying principles concerning responsible data collection, protection, and use.

SB 574 could contribute to a comparable development in the governance of generative AI within the legal industry. Its influence may emerge not only through future legislation, but also through court rules, professional responsibility guidance, client expectations, and the operational policies adopted by multijurisdictional law firms.

From an information governance perspective, the central implication is that AI can no longer be treated solely as a technology implementation or productivity initiative.

The information entered into AI systems, the materials those systems retrieve, and the content they generate must be evaluated within the firm's existing governance framework.

The resulting challenge extends beyond compliance with any single statute. Law firms must determine whether their existing policies, systems, and operational controls can adequately govern information throughout the AI lifecycle.

1. UNDERSTANDING SB 574: WHAT THE LAW REQUIRES

SB 574 establishes several obligations concerning generative AI, primarily through amendments to the California Business and Professions Code and Code of Civil Procedure.

The legislation does not prohibit attorneys from using generative AI. Instead, it imposes requirements intended to preserve professional accountability and safeguard information.

Principal statutory provisions

Area	Requirement
Professional responsibility	Attorneys may not delegate the practice of law to generative AI.
Confidential Information	Attorneys may not enter confidential, personal identifying, or other nonpublic information into an AI system unless access to the information is restricted to the attorney and authorized persons under confidentiality obligations, as specified in the statute
Accuracy	Attorneys using generative AI must take reasonable steps to verify outputs, including legal citations, and correct erroneous or hallucinated material they use
Court Disclosure	Attorneys using generative AI must disclose its use to the court for documents submitted to the court
Public-Facing Content	Attorneys must consider whether to disclose AI use when generative AI assists in creating content provided to the public
Citation Verification	Attorneys responsible for court submissions must personally verify citations, including citations not generated by AI, subject to the statute's procedural scope and exclusions
Arbitration	Arbitrators may not delegate any portion of their decision-making to generative AI and must make appropriate advance disclosures before relying on AI-generated information outside the record

Sources: California Business and Professions Code § 6068.1 and Code of Civil Procedure §§ 128.7 and 1282.1, as enacted by SB 574. [1]

These provisions reinforce established principles of legal practice while explicitly applying them to emerging technology.

The confidentiality requirement is particularly significant. It is not a blanket prohibition on submitting protected information to every generative AI platform. Rather, the statute establishes conditions concerning who can access information entered into a system and the confidentiality obligations governing that access.

Likewise, the requirement to personally verify citations is broader than the problem of fictitious AI-generated legal authorities. It addresses citations regardless of their source. The amendment to Code of Civil Procedure § 128.7 includes procedural exclusions in subdivision (g), which counsel should consider when determining its application to specific filings.

The legislation also contains provisions beyond attorney AI usage. It directs the Judicial Council to revisit California's existing standards governing judicial officers' use of generative AI and amends complaint procedures for certified alternative dispute resolution providers. The latter amendments contain provisions addressing the confidentiality, access, and disclosure of records associated with certain complaints.

Notably, SB 574 does not establish specific retention periods for AI prompts, mandate particular technological safeguards, or prescribe a comprehensive AI governance program. Those distinctions matter when evaluating what is legally required versus what firms should implement as a matter of sound information governance.

2. WHY THE IMPLICATIONS EXTEND BEYOND CALIFORNIA

The significance of SB 574 cannot be evaluated solely by considering the attorneys and proceedings directly subject to its provisions.

Law firms operate within an interconnected legal, regulatory, and technological environment. Practices adopted to satisfy requirements in one jurisdiction can influence operational standards throughout an organization.

California's history of influencing national privacy practices

California's CCPA helped accelerate the broader movement toward comprehensive consumer privacy legislation in the United States.

However, the development of state privacy laws also illustrates an important qualification: other jurisdictions do not necessarily copy California's statutes. Many states have adopted models more closely aligned with Virginia's Consumer Data Protection Act while incorporating their own requirements and exemptions.

The pattern is therefore better understood as regulatory convergence around common principles rather than uniform adoption of California law. [2]

SB 574 may contribute to a similar convergence in legal AI governance, particularly around confidentiality, professional accountability, verification, and transparency.

The national conversation is already underway

California is not acting in isolation.

In July 2024, the American Bar Association issued Formal Opinion 512, addressing attorneys' ethical duties when using generative AI. The opinion discusses competence, confidentiality, communication, supervision, candor, and fees. [3]

Individual courts have also implemented AI-specific requirements. For example, in January 2026, Florida's Eleventh Judicial Circuit established disclosure and verification requirements for AI-assisted court submissions. That order applies within the specified judicial circuit, not statewide. [4]

Separately, the State Bar of California updated its practical guidance on generative AI in May 2026, including consideration of emerging agentic AI capabilities. [5]

These developments demonstrate that oversight of legal AI usage is evolving through several channels simultaneously.

SB 574 adds a statutory dimension to a discussion already taking place among bar regulators, courts, and legal practitioners.

Multistate law firms face an operational challenge

For a national law firm, maintaining entirely separate AI governance practices for California and non-California offices may be administratively difficult.

A firm operating across multiple jurisdictions may choose to establish common enterprise controls for confidentiality, vendor approval, output verification, and professional oversight, while maintaining jurisdiction-specific procedures for requirements such as disclosure.

This does not make California law automatically applicable nationwide. 

Rather, it illustrates how regulation in one jurisdiction can influence enterprise-wide policies when standardized controls are more practical than fragmented processes.

Client requirements may produce similar effects. Corporate clients increasingly have reason to scrutinize how outside counsel handle confidential information when using AI, independent of whether a particular state statute directly applies.

Consequently, law firms should evaluate SB 574 not only as a California compliance issue, but also as an indicator of the controls that may become common expectations across the profession.

3. THE INFORMATION GOVERNANCE IMPLICATIONS

The immediate compliance questions surrounding SB 574 are relatively straightforward: which AI systems may attorneys use, what information may they enter, and what review and disclosure obligations apply?

The larger information governance questions are more complex.

Most law firms already maintain policies governing document management, records retention, legal holds, information security, client confidentiality, and acceptable technology use.

Generative AI introduces additional ways to access, process, transform, store, and redistribute information across these established environments.

The appropriate response is not necessarily to create an entirely separate governance program for AI. It is to determine how AI systems and their information flows fit within the existing IG framework—and where that framework requires modification.

3.1 Information classification and confidentiality

Traditional IG programs classify information according to factors such as sensitivity, ownership, business purpose, and retention requirements.

AI systems complicate this process because information may be copied, summarized, transformed, or incorporated into prompts and responses outside its original repository.

For example, an attorney may upload a confidential client document from the document management system into an AI application for analysis. The resulting information may exist in several locations:

• The original document within the firm's DMS

• The document or extracted text provided to the AI system

• The prompt or instructions supplied by the attorney

• The AI-generated response or derivative analysis

• Associated application history, logs, caches, or other retained copies, depending on the system's architecture

Each location introduces potential confidentiality, access, and lifecycle-management considerations. Simply restricting the original document within the DMS does not necessarily ensure equivalent protection throughout the AI workflow.

IG implication: Firms should extend information classification and handling rules to the full AI data flow, including inputs, retrieved materials, generated outputs, and retained application data.

This should include safeguards against information from one client or matter becoming accessible through another client's workspace or AI query.

3.2 AI-generated content and records retention

One of the more significant unanswered questions for information governance professionals concerns the treatment of AI-generated information under existing retention policies.

Consider an attorney using AI to develop an initial legal analysis. During the process, the attorney submits multiple prompts, uploads documents, revises instructions, and generates several iterations before saving a final memorandum to the DMS.

Which materials should be retained?

The answer should depend on their content, business purpose, applicable legal requirements, contractual obligations, and potential relevance to litigation.

Not every prompt or intermediate response necessarily constitutes an official firm or client record. Conversely, firms should not assume that information created through an AI system is automatically temporary or outside the scope of records retention.

A defensible IG program should address:

• Records classification. When AI-generated content becomes substantive matter-related work product or another record category subject to retention.

• Repository management. Whether records created through AI must be captured within an approved DMS or another governed repository.

• Retention and disposition. How applicable retention rules are extended to AI histories, uploaded files, generated outputs, and other stored information.

• Legal holds. How potentially relevant AI-related information is identified and preserved when a preservation obligation arises.

• Duplicate information. How firms avoid unnecessary retention of multiple copies without compromising required preservation or the integrity of the record.

• IG implication: Firms should evaluate AI-generated information under existing records classification and retention principles, developing additional rules where traditional policies do not adequately address AI-specific workflows.

The objective is not to retain everything created by AI. It is to ensure that information requiring retention is appropriately preserved, while unnecessary information can be disposed of in a controlled and defensible manner.

3.3 Vendor governance and information security

SB 574 places substantial importance on restricting access to confidential and nonpublic information.

For law firms, this highlights the need to evaluate more than an AI application's functionality, productivity benefits, or marketing claims about security.

Before authorizing sensitive client information to be processed through an AI platform, firms should understand:

• Where information is processed and stored

• Who can access prompts, uploaded materials, and outputs

• Whether information may be used for model training or service improvement

• What confidentiality obligations apply to the provider and its sub processors

• Whether client and matter security restrictions can be maintained

• What happens to retained information when the service is terminated

• Whether information can be exported, preserved, or deleted in accordance with applicable obligations

An enterprise AI subscription should not automatically be treated as evidence that every confidentiality requirement has been satisfied. 

Contract terms, technical architecture, access restrictions, and actual vendor practices should be evaluated together.

IG implication: Vendor selection and contracting should incorporate information governance requirements alongside conventional IT, cybersecurity, privacy, and procurement assessments.

3.4 Verification, provenance, and accountability

SB 574's requirements concerning AI-generated inaccuracies and legal citations also have important information governance implications.

The ability to demonstrate that appropriate verification occurred may become increasingly relevant to a firm's risk-management practices. This does not necessarily mean preserving every prompt, response, or internal review action indefinitely. It does suggest that firms should establish consistent verification procedures and determine what evidence of compliance is appropriate for particular workflows.

Examples include documenting attorney review of AI-assisted court submissions, maintaining reliable source references for factual assertions, verifying legal citations against authoritative materials, and ensuring accountability remains with the responsible legal professional.

These processes may require coordination among attorneys, knowledge management professionals, litigation support teams, and information governance personnel.

IG implication: Firms should incorporate source verification and professional accountability into AI-assisted workflows rather than relying solely on individual users to identify and correct errors without standardized procedures.

3.5 Disclosure and defensibility

The disclosure provisions of SB 574 introduce another consideration for law firm governance.

An attorney's use of AI may occur during research, document summarization, drafting, or revisions. Firms will need procedures for determining when AI-related disclosure is required and how those disclosures should be made.

The statutory text does not establish a single prescribed disclosure format or comprehensively define every practical trigger. Firms should have counsel assess these questions and monitor subsequent judicial or regulatory guidance.

The challenge increases for firms operating across jurisdictions with differing disclosure rules.

A standardized internal process could help establish which AI tools were used, the nature of their involvement, the responsible reviewer, and whether any applicable disclosure or certification requirement has been satisfied.

IG implication: AI governance should support reliable tracking and compliance processes without creating unnecessary records or collecting more information than the firm needs.

3.6 Governance of arbitration and other legal processes

SB 574's arbitration provisions reinforce the distinction between AI as an assistive technology and AI as a substitute for professional judgment.

Arbitrators may not delegate their decision-making to generative AI. The statute also addresses advance disclosure when relying on AI-generated information outside the record.

For organizations providing or supporting alternative dispute resolution services, the legislation creates additional reasons to evaluate how confidential materials are processed and how AI use is controlled.

Its amendments concerning certain State Bar-certified alternative dispute resolution complaint procedures also highlight familiar IG concerns: limited-purpose access, confidentiality, privilege protections, and appropriate handling of investigative records.

IG implication: AI governance should account for specialized legal workflows and not assume that the same rules apply uniformly to attorneys, arbitrators, administrative personnel, and other participants.

4. MOVING FROM AN AI ACCEPTABLE-USE POLICY TO AN INTEGRATED GOVERNANCE FRAMEWORK

Many law firms have already developed policies addressing the permissible use of generative AI. These policies are an important starting point, but policy language alone does not establish comprehensive governance.

A policy may prohibit the use of confidential client information in unapproved AI tools. Yet the firm must still determine how approved tools are assessed, how information access is restricted, how users are trained, and how compliance is evaluated.

Similarly, a policy requiring attorneys to verify AI-generated content is only effective when users understand the verification standard and the firm's workflows support compliance.

A mature approach should coordinate the following areas:

Governance Domain	Principal Considerations
Information Governance	Classification, approved repositories, recordkeeping, retention, disposition, and legal holds
Information Security	Access controls, isolation of client information, monitoring, and incident response
IT and AI Operations	Approved platforms, technical integration, permissions, application configuration, and system inventories
Legal and Risk Management	Confidentiality, privilege, professional responsibility, court disclosure, and contractual obligations
Knowledge Management	Authoritative research sources, accuracy standards, professional training, and validated workflows
Procurement and Vendor Management	Confidentiality terms, sub processors, data use, deletion commitments, and vendor oversight

The objective should be an integrated governance model in which each function understands its responsibilities and the controls operate consistently across the firm.

AI applications should be evaluated as components of the firm's information environment, not as isolated technology products.

5. PRACTICAL FRAMEWORK FOR LAW FIRMS: WHAT TO DO NOW

Although SB 574 does not prescribe an enterprise implementation plan, its January 1, 2027, effective date creates an immediate opportunity for affected firms to assess their readiness.

A broader national firm may use the same exercise to evaluate its AI governance maturity.

First 30 Days: Assess the Current Environment

1. Establish an inventory of AI applications. Identify approved, embedded, and known unapproved generative AI tools, including AI functionality within the DMS, document review platforms, Microsoft 365, research products, and other commonly used applications.

2. Identify information flows. Determine what information enters AI systems, where it originates, what the systems generate, and where resulting information may be retained.

3. Review existing policies. Compare current confidentiality, retention, acceptable-use, records management, and vendor governance policies against AI-related workflows.

4. Assess applicability. With legal counsel, identify which attorneys, proceedings, offices, and operations may be subject to SB 574 and other applicable professional obligations.

Days 31–60: Develop the Controls

5. Establish an approved-use framework. Define permitted AI applications, authorized information categories, prohibited practices, and approval procedures for sensitive use cases.

6. Update IG policies and retention schedules. Address AI inputs, outputs, application histories, and other generated or stored information where existing policies are insufficient.

7. Establish verification and disclosure procedures. Define practical review requirements and jurisdiction-specific disclosure workflows under the direction of legal and risk management.

8. Strengthen vendor reviews. Evaluate confidentiality restrictions, contractual safeguards, data handling practices, and deletion capabilities for approved AI services.

Days 61–90: Operationalize and Validate

9. Train users. Provide role-specific instruction addressing confidentiality, acceptable AI use, verification responsibilities, disclosure, and information handling.

10. Test representative workflows. Evaluate common use cases, including legal research, document summarization, AI-assisted drafting, and matter-based retrieval.

11. Establish compliance monitoring. Identify reasonable metrics, such as the percentage of authorized systems reviewed, the completion of required training, and whether relevant workflows incorporate appropriate review and disclosure controls.

12. Assign continuing oversight. Establish an accountable multidisciplinary group to monitor changes in technology, law, client requirements, and firm practices.

This framework is a recommended operational approach, not a list of requirements expressly imposed by SB 574.

6. THE BROADER INDUSTRY OUTLOOK

Three developments could influence how SB 574 affects law firms outside California.

Greater consistency in law firm AI governance

National firms may increasingly align confidentiality, verification, and vendor governance practices across offices rather than maintaining different baseline safeguards for each jurisdiction.

Local legal requirements would still need to be addressed separately, particularly where court disclosure procedures differ.

Greater scrutiny of AI information management

As AI becomes embedded in core legal workflows, traditional records management questions will become more prominent.

Firms will need to understand whether information is being duplicated outside governed repositories, whether content can be retrieved across matters, and whether existing retention and legal hold processes extend to AI-enabled applications.

These questions are not unique to California. They arise wherever attorneys and legal professionals rely on AI to process client information.

Increasingly formal expectations of accountability

Professional ethics guidance has long emphasized attorney responsibility for legal work, regardless of the technologies used.

SB 574 reinforces this principle through express statutory obligations, while courts in other jurisdictions have independently adopted AI disclosure and verification requirements.

The extent to which future legislation follows California's approach remains uncertain. Other states may adopt different requirements, rely on professional conduct rules, or address AI through judicial administration rather than legislation.

For law firms, this uncertainty strengthens the case for adaptable governance structures rather than policies narrowly designed around a single technology or statute.

7. MATTERN’S PERSPECTIVE: TREAT AI AS PART OF INFORMATION GOVERNANCE

For firms evaluating their response to SB 574, the most consequential decision may be how AI governance is positioned within the organization.

Treating AI as a separate technology issue can lead to fragmented oversight. IT evaluates security, attorneys assess usefulness, knowledge management supports adoption, and records management addresses information lifecycle questions only after new content has accumulated.

This approach risks repeating problems already familiar to information governance professionals: uncontrolled repositories, inconsistent classification, overlapping information ownership, policy exceptions, and difficulty applying retention requirements.

An integrated framework allows firms to build upon existing IG policies and infrastructure rather than creating parallel administrative structures.

The questions firms should ask are therefore broader than whether an AI platform is approved:

• Does the firm understand the information accessible to each AI system?

• Can existing matter security and confidentiality restrictions be preserved?

• Are AI-generated records managed consistently with comparable records created through traditional processes?

• Can relevant information be preserved when subject to a legal hold?

• Are retention and disposition processes applicable to the systems in which AI information resides?

• Can the firm demonstrate appropriate oversight and accountability for AI-assisted work?

Answering these questions requires a combination of policy, technology, operational process, and organizational responsibility.

The objective is not to restrict innovation unnecessarily. It is to establish conditions under which emerging technologies can be adopted without undermining the information governance controls that protect clients and support professional obligations.

Conclusion: A California Law With Potential National Consequences

Senate Bill 574 represents another development in the evolving relationship between technology, professional accountability, and the management of information.

Its immediate requirements concern the use of generative AI in California legal practice and related proceedings. Its broader significance lies in the governance questions it brings into focus.

As generative AI becomes embedded in legal research, drafting, document review, knowledge management, and other law firm operations, the boundaries between AI governance and information governance will become increasingly difficult to separate.

Whether other states adopt similar legislation remains to be seen. However, existing developments in professional ethics guidance and court rules demonstrate that these issues are already being addressed beyond California.

For law firms, the response should not be limited to monitoring new statutes. It should include a deliberate assessment of whether existing information governance programs can manage the information, risks, and responsibilities associated with AI-assisted legal work.

The firms that integrate AI into their established governance frameworks will be better positioned to adapt to changing requirements while maintaining the confidentiality, integrity, and defensibility of the information entrusted to them.

Sources and Further Reading

1. California Senate Bill 574, Chapter 858, Statutes of 2026. Official California Legislative Information (https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB574). Chaptered statutory text (https://legiscan.com/CA/text/SB574/2025).

2. International Association of Privacy Professionals, U.S. States Leverage Existing Models of Privacy Legislation, September 13, 2023. (https://iapp.org/news/a/u-s-states-leverage-existing-models-of-privacy-legislation).

3. American Bar Association, Formal Opinion 512, Generative Artificial Intelligence Tools, July 29, 2024. (https://www.americanbar.org/news/abanews/aba-news-archives/2024/07/aba-issues-first-ethics-guidance-ai-tools/).

4. Eleventh Judicial Circuit of Florida, Administrative Order 26-04, Disclosure of Use of Generative AI by Attorneys and Self-Represented Litigants, January 15, 2026. (https://www.jud11.flcourts.org/docs/ao-html/1b10ef43-b414-40e5-88d7-401f46d0a081.html).

5. The State Bar of California, Ethics & Technology Resources, including the updated 2026 Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law. (https://www.calbar.ca.gov/legal-professionals/ethics-compliance-practice-resources/ethics/ethics-technology-resources).

This paper provides an information governance analysis and operational recommendations. It is not legal advice. Specific statutory applicability, professional responsibility obligations, and court disclosure requirements should be evaluated by qualified counsel.