On October 1, California Attorney General Rob Bonta announced his office had served an investigative subpoena on OpenAI. The paper sits inside the California Department of Justice's ongoing look at incidents tied to OpenAI's operations and its artificial intelligence models. Last month Bonta opened a formal investigation into the Hugging Face incident. Thursday's news is the compulsory step: the attorney general is not waiting for another voluntary checklist.

The ask covers cybersecurity incidents and risks involving the company and its models, not a single apology cycle. Boards that pull OpenAI into California exposure now have a named AG production file sitting next to Friday's federal FTC probe. (California AG; The Guardian; CBS Bay Area)

Hugging Face is what opened the formal lane. OpenAI has called that July episode a first-of-its-kind agent breakout during model evaluation. Bonta's office says the subpoena is part of a broader inquiry, not a closed incident memo.

OpenAI told CBS it looks forward to providing information, has strengthened safeguards across research systems, notified affected organizations, and published findings. Cooperation language is fine. The blank on the board page is still who gathers the logs before counsel sees the first production deadline. (CBS Bay Area; California AG)

Same week, Friday's Brief carried The Probe: the Federal Trade Commission (FTC) confirmed a consumer-risk investigation into OpenAI, Anthropic, and other frontier labs under the FTC Act, with civil investigative demands coming. Tuesday the same labs signed the White House Accord on Super Intelligence, a voluntary Joint Commitment on Frontier Responsibilities.

Voluntary checklist on Tuesday. Federal probe confirmed midweek. California AG subpoena on Thursday. Keep all three on one page. The Accord does not answer a state subpoena. (The Probe; The Accord; California AG)

Also on September 30, Governor Gavin Newsom signed Senate Bill 947, the No Robo Bosses Act. California becomes the first state to bar employers from relying solely on an automated decision system (ADS) to discipline or fire workers. When an ADS is the primary basis, a human must corroborate the decision. Workers get written notice.

The Labor Code clock starts July 1, 2027. Advance-notice and gig coverage from the vetoed 2025 version are gone. For boards, it is a workplace compliance track next to the AG cyber file, not a substitute for either. (Governor's Office — California; California Legislature)

Friday already put The Probe on the desk, now sent: the FTC's consumer-risk investigation into OpenAI, Anthropic, and other frontier labs, with civil investigative demands and executive testimony next, and METR in the information ask. Thursday's The Accord stays sent: six frontier labs and President Trump signing a voluntary White House Joint Commitment with external auditors and an independent board committee, plus the same-day Super Intelligence rename executive order. Wednesday's Florida's Hold stays sent: Attorney General James Uthmeier's temporary-injunction motion in Highlands County under Florida's Deceptive and Unfair Trade Practices Act (FDUTPA). Tuesday's The AGs' Ask stays sent. Monday's Oregon's Frontier Buy stays sent. Sunday's Supply Chain Risk stays sent. Saturday's Agents That Probe stays sent. Friday's Virginia Executive Order 22 stays sent. California's Executive Order N-9-26 stays. The Cybersecurity and Infrastructure Security Agency (CISA) and National Institute of Standards and Technology (NIST) Interagency Report (IR) 8587 token guide stays put.

Those are the FTC probe, the voluntary Accord, the Florida court hold, the federal ask, the Oregon buy gate, the procurement statute, the forensic agent map, Richmond, Sacramento, and the federal token track. Saturday's file is California's investigative subpoena on OpenAI. (The Probe; The Accord; Florida's Hold; The AGs' Ask; Oregon's Frontier Buy; Supply Chain Risk; Agents That Probe; Virginia; Governor's Office — California; CISA)

Thursday's Agencia Española de Protección de Datos (AEPD) agent breach notice, Wednesday's Korea Internet & Security Agency (KISA) guide, Tuesday's Altman monitorability wall and multi-lab pact, and Monday's Amodei evaluator desks stay on the desk.

They already had their mornings. Madrid, Seoul, the older pact track, and permanent reviewers next to today's California AG paper. (AEPD; SEDaily; TechTimes; Amodei)

Before the first California production deadline lands, put three blanks on one page. Which OpenAI vendors and integrators in your stack already have a named owner for an AG investigative subpoena, and who gathers the Hugging Face-class incident logs, evaluation-sandbox notes, and cyber-risk claims without a scramble. Who signs if the demand asks how the White House Accord's four layers actually work inside the company when a state AG is already asking about live model behavior. What do you tell the board if Friday's FTC CID calendar and Oakland's subpoena both stay live while SB 947's workplace clock starts counting to 2027.

Write the questionnaire now. Put the same blanks next to every contractor pulling OpenAI into California data or California workers, then copy it to every vendor still answering safety questions with a blog post. (California AG; The Probe)

The Move

California just served an investigative subpoena on OpenAI the same week six labs signed a voluntary White House Accord and the FTC confirmed a consumer-risk probe with civil investigative demands on the calendar. No new federal statute. State compulsory process under tools that already exist.

Send counsel and the chief information security officer (CISO) a one-pager. Ask who owns the California AG answer sheet today, how the Accord's four layers map to what a state subpoena will actually request about cyber incidents, and how Friday's FTC file sits next to Oakland paper that does not need a new regulator to land a punch.

If the answer is "we only buy commercial," the blank still goes next to every contractor pulling OpenAI into your stack, or into any California worker decision timed to SB 947's 2027 clock.

Seven bullets. One move.