Healthcare Controversies · AI, records and responsibility
Signed but Not Written
Who is responsible when artificial intelligence creates an incorrect clinical note or order
California has statutes on AI patient messages, AI in utilisation review, AI titles and — from 2027 — physician control of notes. None allocates responsibility for an AI-generated error; the records that would show its cause sit with the employer and the vendor.
The dispute, and why it matters
Ambient documentation systems now listen to a visit and draft the note. Some propose diagnoses, problem-list entries, orders and billing codes. The clinician reviews — or is supposed to review — and signs. When the draft is wrong and the signature is there, the familiar answer is that the physician is responsible. The controversy is whether that answer remains adequate when the error was produced by a system the physician did not choose, configured by an employer the physician does not control, under productivity expectations that leave little time to check it.
This article takes the narrow question — who is responsible for an incorrect AI-generated note or order — and reads it against the laws and professional statements in force or published as of 1 November 2026. The site's comprehensive investigation of ambient AI, its business model and its redistribution of work and risk is Who Owns the Decision? (29 October 2026); model standards are at the AI medical-record integrity proposal and the policy background at Generative AI in medical documentation.
Finding, as of 1 November 2026
California law does not contain a rule that allocates responsibility for AI-generated clinical documentation as such. Proved It contains four statutes that answer adjacent questions — disclosure of AI patient communications, physician control of utilisation review, title protection against AI systems, and, from 1 January 2027, physician responsibility for and control over patient notes — and professional bodies that place ultimate responsibility on the physician while asking that liability follow the party best placed to prevent harm. Proved Documented The practical consequence is that the signing physician carries the professional exposure, while the records that would show whether the error lay with the tool, its configuration or the time allowed to check it are held by the employer and the vendor. Inference
Stated by the operative text itself: a statute, regulation, court opinion or the study's own published results.
An official dataset, agency report, guideline or plan publication, read for what it measures and no further.
Reported by a party, news organisation or secondary summary; confined to what the reporter says.
KPSGILL analysis from structure, incentives or comparison — labeled, never promoted to fact.
A question the public record does not yet answer; the record that would answer it is named.
Four statutes, four different questions
California's AI-related health statutes are often cited together. They regulate different actors and different moments, and none of them was written primarily about the accuracy of the clinical record.
| Statute | Who it regulates | What it requires | What it does not do |
|---|---|---|---|
| AB 3030 (2024), H&S §1339.75 — operative 1 Jan 2025 | Health facilities, clinics and physician practices using generative AI for patient communications | A disclaimer that the communication was AI-generated and clear instructions on reaching a human; exemption where a licensed provider reads and reviews the communication | Regulate notes, orders or record accuracy; it addresses messages to patients about clinical information |
| SB 1120 (2024), H&S §1367.01; Ins. Code §10123.135 — operative 1 Jan 2025 | Health plans and disability insurers conducting utilisation review | AI tools may not supplant provider decision-making; medical-necessity determinations only by a licensed, competent clinician | Govern clinicians' own documentation or order-entry tools |
| AB 489 (2025), B&P §§4999.8–4999.9 — operative 1 Jan 2026 | Developers and deployers of AI systems | No terms implying that AI output is provided by a licensed person; each prohibited use a separate violation | Address documentation accuracy or allocate liability for errors |
| AB 1637 (2026), B&P §2266.1 — operative 1 Jan 2027 | Physicians, and anyone who would alter their notes | Patient notes are the authoring physician's responsibility regardless of setting; alteration only by the author or listed exceptions | Mention AI; apply to conduct before 1 Jan 2027 |
AB 3030 requires that a generative-AI communication of patient clinical information include “A disclaimer that indicates to the patient that the communication was generated by generative artificial intelligence” and “Clear instructions describing how a patient may contact a human health care provider.” Proved K02 It does not apply where the communication is “read and reviewed by a human licensed or certified health care provider.” Proved The exemption is itself an allocation of responsibility: review by a licensed person converts an AI communication into the provider's communication. Inference
SB 1120 provides that an AI or algorithmic tool used in utilisation review “does not supplant health care provider decisionmaking,” and that “A determination of medical necessity shall be made only by a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues involved.” Proved K03 It places a human at the point of decision on the payer side.
AB 489 makes title-protection laws “enforceable against a person or entity who develops or deploys a system or device,” and prohibits AI terms implying that “the care, advice, reports, or assessments being offered … is being provided by a natural person in possession of the appropriate license.” Proved K04 It polices representation, not accuracy.
AB 1637 and the signed note
The statute that comes closest to the question is the one that does not mention AI. AB 1637 (Caloza), approved on 27 September 2026 as Chapter 536 and operative on 1 January 2027, adds section 2266.1 to the Business and Professions Code. Proved K01 It defines “patient notes” as “notes, after-visit summaries, and diagnosis and treatment plans,” and provides: “A physician and surgeon's patient notes shall be the responsibility of that physician and surgeon, regardless of the clinical setting.” Proved Notes “shall not be altered, modified, or edited in any fashion by anyone other than the authoring physician and surgeon or any of the following”: a scribe, medical assistant or other authorised individual acting under delegated authority; a physician adding notes after care has been transferred; and a supervising physician editing the notes of residents, interns, fellows or other postgraduate trainees. Proved K01 According to the Legislative Counsel's digest, violations fall within the Medical Practice Act's existing provisions. Attributed
Read against ambient documentation, the section produces three inferences, none of which has been tested in any decision. Inference
First, an accepted and signed AI draft becomes the physician's note. The statute makes the note the physician's responsibility “regardless of the clinical setting.” Nothing in it distinguishes a note the physician typed from one the physician adopted. Inference That reinforces the conventional allocation rather than displacing it.
Second, post-signature changes by systems or staff are constrained. If a deploying organisation's software or coding staff alter a signed note — revising a diagnosis to support a code, re-populating a problem list, inserting template language — the alteration would have to fit one of the listed exceptions. Inference Whether an automated process acting on an organisation's instructions is “anyone other than the authoring physician,” and whether an AI tool can be an “other authorized individual acting under delegated authority,” are open; the word “individual” suggests a person. Open
Third, the section strengthens the physician's claim to control the record. A physician who is responsible for the note regardless of setting has a statutory basis for refusing alterations and for insisting that the audit trail preserve the original. Inference The section does not, however, create a duty on vendors or employers to provide the time, interface or audit capability that verification requires. Proved K01
The section operates from 1 January 2027. Applying it to earlier conduct would require a separate legal basis; this article does not treat it as retroactive. Inference
The federal boundary: when is AI a device?
Whether an AI function is regulated by the Food and Drug Administration determines whether it has been reviewed for safety and effectiveness before use. FDA's final guidance on clinical decision-support software, issued on 29 January 2026 and superseding the version issued on 6 January 2026, explains the four statutory criteria under which software is excluded from the device definition: it is not intended to analyse medical images or signals; it displays, analyses or prints medical information; it supports or provides recommendations to a health care professional; and it is “intended for the purpose of enabling such health care professional to independently review the basis for such recommendations that such software presents.” Documented K09K10
Two passages matter for responsibility. The guidance states that “in cases where a software function provides a specific preventive, diagnostic or treatment output or directive, the software function fails Criterion 3.” Documented K10 It also states that “If only one option is clinically appropriate and the software function otherwise meets all criteria under section 520(o)(1)(E), FDA intends to exercise enforcement discretion.” Documented The guidance discusses automation bias and time-critical decision-making under Criterion 4. Documented K10
The structure of the exclusion is itself a responsibility rule. Software escapes device regulation on the premise that a professional can independently review the basis of its output. Inference Where documentation systems are deployed so that independent review is impractical — because the basis is not displayed, or because time does not permit — the premise weakens, while the regulatory status remains whatever the manufacturer's intended use places it. Inference Device status is not a measure of reliability, and non-device status is not a finding of safety. Documented Ambient scribes and the device boundary are treated in more detail at When an AI medical scribe becomes a medical device.
What the professional bodies say
The Federation of State Medical Boards, in policy adopted by its House of Delegates in April 2024, states that “the physician is ultimately responsible for the use of AI and should be held accountable for any harms that occur,” that “failure to apply human judgement to any output of AI is a violation of a physician's professional duties,” and that “it is important to recognize the need for verification of AI-generated clinical information for accuracy.” Documented K05 The FSMB is not a regulator; its policies inform the state boards that are. Documented
The American Medical Association's October 2026 issue brief on liability for clinical AI quotes AMA policy that “liability and incentives should be aligned so that the individual(s) or entity(ies) best positioned to know the AI system risks and best positioned to avert or mitigate harm do so.” Documented K06 That is a different principle from the FSMB's: it allocates by capacity to prevent harm rather than by signature. Inference
The Medical Board of California's analysis of AB 2575 for its 20 August 2026 meeting states that “AI may not represent itself as a physician and it may not practice medicine, including diagnosing and treating a patient,” and that “The Act does not prohibit a physician from using tools, such as AI, in the course of their work.” Documented K07 The Board took a neutral position on the bill. Documented
The bill that did not become law
AB 2575 (Ortega) would have addressed liability defences in cases involving clinical decision-support systems, including defences resting on a provider's failure to override such a system, as described in the Board's analysis. Attributed K07 It was vetoed on 30 September 2026. Proved K08 The veto leaves California without a statute addressing how responsibility for decision-support errors is apportioned in litigation; general negligence and professional-liability principles continue to govern. Inference The veto message was not reviewed for this article, and no inference is drawn about the Governor's reasons. Open
Who controls what: a responsibility map
The map below sets out, for each actor, what it controls, the governing text as of 1 November 2026, and the record that would show a failure. It is KPSGILL's analytical framework Inference, built from the sources cited; it is not a statement that any actor has failed.
| Actor | What it controls | Governing text (1 Nov 2026) | Record that would show the failure |
|---|---|---|---|
| Signing clinician | Review, correction and signature; whether to accept a drafted diagnosis or order | Professional duty of care; FSMB policy on verification; from 1 Jan 2027, B&P §2266.1 responsibility for notes | Draft-versus-signed comparison; time between draft availability and signature; corrections made or not made |
| Employer or deploying organisation | Tool selection, configuration, templates, default orders, productivity expectations, training, audit-trail retention | General corporate-practice doctrine; AB 3030 for patient communications; AB 1637 alteration limits from 2027 | Configuration records; template and default-order versions; schedule and visit-length standards; training logs; post-signature amendment logs |
| Vendor or developer | Model design, intended use, display of the basis for outputs, error reporting, update cadence | FDA device framework where applicable; CDS guidance criteria; AB 489 representation rules | Intended-use statements; validation data; version history; known-issue reports; whether the basis of a recommendation is displayed |
| Payer or utilisation-review entity | Use of algorithms in coverage decisions | SB 1120: no supplanting of provider decision-making; necessity determined by a licensed, competent clinician | Decision logs showing reviewer identity, time spent and override of algorithmic output |
| Regulators and boards | Discipline, guidance, enforcement | Medical Practice Act; Board guidance; FDA authority over devices | Complaints, investigations and guidance issued; whether any addresses AI-generated documentation |
The asymmetry is visible in the right-hand column. Inference The records that would show whether an error originated in the tool, its configuration or the time allowed to check it — configuration histories, version logs, schedule standards — are held by the organisation and the vendor. The record that shows the error was signed is the one the clinician created. A responsibility rule that looks only at the signature will therefore tend to find the clinician, whatever the cause. Inference
The strongest arguments on each side
The strongest case for physician-centred responsibility
- The signature is a professional act; patients and payers rely on it as the clinician's attestation, and diluting it would weaken the record's reliability.
- Only the clinician was present and knows what happened in the encounter; no vendor or employer can verify a note's accuracy as well.
- Clear individual responsibility creates the strongest incentive to read before signing; diffuse responsibility invites everyone to assume someone else checked.
- Existing law already holds physicians responsible for staff-drafted notes; AI drafting is a new tool, not a new principle, and AB 1637 confirms the rule from 2027.
The strongest case for distributed or enterprise responsibility
- Clinicians do not choose the tool, its defaults or the visit length; holding them solely liable for errors induced by those choices misplaces the incentive to fix them.
- Automation bias is a documented risk that FDA's own guidance discusses; a system designed so that errors are hard to see shares responsibility for errors not seen.
- Vendors and deploying organisations are best placed to detect error patterns across thousands of notes — the AMA's ‘best positioned’ principle.
- Verification time is a resource; if the organisation does not provide it, responsibility for the predictable consequence should follow the decision not to provide it.
The positions are not mutually exclusive. A rule can hold the signing clinician professionally responsible for the content of the note while also holding the deploying organisation responsible for configuration, time allowance and audit-trail integrity, and the vendor responsible for the accuracy of its representations and the display of its reasoning. Inference
Governance standards that would make the question answerable
The Joint Commission and the Coalition for Health AI released initial voluntary guidance on the responsible use of AI in health care on 17 September 2025. Documented K11 It is organised around seven elements: policies and governance; privacy and transparency; data security and use; ongoing quality monitoring; voluntary, blinded safety-event reporting; risk and bias assessment; and education and training. Documented It recommends that organisations “request information from developers/vendors on how AI tools were tested and validated for their intended use,” and states that “Healthcare organizations should have a process to monitor and regularly evaluate the safe performance of AI-enabled clinical tools.” Documented K11 The guidance is not an accreditation standard. Documented
Its relevance to responsibility is practical. Local monitoring, safety-event reporting and validation records are precisely the documents that would allow an error to be traced to its source. Inference An organisation that deploys ambient documentation without them leaves the signature as the only evidence of who was responsible. Inference
What remains open
Established as of 1 November 2026
- From 1 January 2027, patient notes are the authoring physician's responsibility regardless of setting, and alterations by others are limited to listed exceptions. Proved
- AI patient communications require disclosure unless a licensed provider reads and reviews them. Proved
- Plans may not let algorithms supplant provider decision-making on medical necessity. Proved
- AI systems may not use terms implying licensed human authorship. Proved
- The FSMB places ultimate responsibility on the physician; the AMA asks that liability follow the party best positioned to prevent harm. Documented
Not established
- Whether an AI tool can be an ‘authorized individual’ under §2266.1(c)(1).
- Whether automated post-signature changes count as alteration ‘by anyone other than’ the author.
- Any California decision apportioning liability for an AI-generated documentation error.
- Any Medical Board guidance specifically addressing AI-generated notes or orders.
- Whether ambient documentation tools in use meet FDA's non-device criteria in the way they are actually deployed.
Reform options, and how to judge them
The options below are KPSGILL proposals Inference, each paired with the evidence that would show whether it works.
| Option | What it would do | How to judge it |
|---|---|---|
| Draft retention | Require the unedited AI draft to be preserved alongside the signed note | Availability of drafts in audits and disputes; storage and privacy safeguards |
| Provenance marking | Mark in the record which content was AI-generated, which was edited and by whom | Accuracy of provenance markers in sampled records |
| Verification time standards | Require deploying organisations to set and disclose visit and review-time standards for AI-drafted notes | Correlation between review time and correction rates |
| Order-entry firewall | Prohibit AI-proposed orders from being placed without a separate affirmative clinician action | Rate of AI-proposed orders accepted without modification; adverse-event reports |
| Board guidance | Medical Board guidance on verification duties and on organisations' obligations under §2266.1 | Issuance; complaints and investigations citing it |
| Shared-liability statute | Apportion liability among clinician, deployer and vendor by control and capacity to prevent harm | Claims outcomes; changes in vendor and deployer safety practices |
Correction history
No corrections since first publication on . Material corrections will be dated here, with the superseded text preserved and labeled.
Sources
Official issuers, statutes, opinions and original studies are preferred; reproductions of primary legal text are identified. Checked 1 November 2026 unless stated. A source that opens is not proof of every neighbouring claim.
- K01AB 1637 (Caloza), Chapter 536, Statutes of 2026 — Business and Professions Code §2266.1 (chaptered text)
- K02AB 3030 (Calderon), Chapter 848, Statutes of 2024 — Health and Safety Code §1339.75 (chaptered text)
- K03SB 1120 (Becker), Chapter 879, Statutes of 2024 — Health and Safety Code §1367.01; Insurance Code §10123.135 (chaptered text)
- K04AB 489 (Bonta, M.), Chapter 615, Statutes of 2025 — Business and Professions Code §§4999.8–4999.9 (chaptered text)
- K05Federation of State Medical Boards — Navigating the Responsible and Ethical Incorporation of Artificial Intelligence into Clinical Practice
- K06American Medical Association — Issue brief: Liability for clinical AI (October 2026)
- K07Medical Board of California — Legislative analysis of AB 2575, Board meeting 20 Aug 2026, Agenda Item 7.J
- K08AB 2575 (Ortega), 2025–26 session — bill record
- K09U.S. Food and Drug Administration — Clinical Decision Support Software, final guidance (guidance page)
- K10U.S. Food and Drug Administration — Clinical Decision Support Software guidance (PDF)
- K11The Joint Commission and Coalition for Health AI — Guidance on the Responsible Use of AI in Healthcare (RUAIH)
Healthcare Controversies · opening investigations
- 01 · Gender-dysphoria care · California lawCompetence, conscience and equal access
- 02 · Denominators, reasons, limitsWhat the physician-objection surveys show
- 03 · Competence by task · accessWhen does a patient need an endocrinologist?
- 04 · CMS-2451-F · HCAI · litigationThe October 13 federal funding rule and California's response
- 05 · Fresno · independent-practice economicsHalf a county on Medi-Cal
- 06 · Fresno · Kings · MaderaCalViva's 2025 access survey
- 07 · FQHC payment · completion of careBeyond the billable visit
- 08 · Private equity · MSOs · CPOMClinical independence after SB 351
- 09 · AI notes, orders and responsibilitySigned but not written
All fifteen categories and 150 topics · Licensure, NPI and certification (physician-authority series) · Policy library · Editorial standards