All 27 chapters in this guide
Published
- Physicians
- Institutions
- Attorneys
Reviewed by Kanwar Partap Singh Gill, MD · sources checked
Artificial intelligence introduces questions about clinical judgment, product behavior, institutional deployment, patient communication, privacy, and evidence. These questions should be separated before responsibility is assigned. A tool can be useful and still require local validation. A clinician can retain professional duties while an employer or developer has separate responsibilities. A required disclosure is not proof that a system is safe, and a human signature is not a substitute for meaningful review.
The following legal map is current through November 5, 2026. It distinguishes statutes already in effect from enacted provisions scheduled to take effect on January 1, 2027. None should be paraphrased as a universal rule that every AI-related injury is automatically the physician's fault or automatically the vendor's fault.
Rules already in effect
| Law | Covered subject and principal requirement | Important limit |
|---|---|---|
| AB 3030, Chapter 848, Statutes of 2024; Health and Safety Code § 1339.75; effective January 1, 2025 | Covered facilities, clinics, physician offices, and group practices using generative AI for specified patient communications about clinical information must provide the required disclosure and instructions for contacting a human. | The statute includes an exception when a licensed or certified human health care provider reads and reviews the communication. Administrative matters such as billing and appointment scheduling fall outside its specified clinical-information category. |
| SB 1120, Chapter 879, Statutes of 2024; effective January 1, 2025 | Governs specified uses of AI, algorithms, and software in utilization management or utilization review by covered plans, insurers, and their contractors. | It is not a general statute governing every clinical AI product or hospital workflow. Medical-necessity decisions require the appropriate licensed professional judgment under the statutory framework. |
| AB 489, Chapter 615, Statutes of 2025; effective January 1, 2026 | Addresses misleading use of professional titles, terms, or representations in AI health information, advice, or services that imply licensed human professional status. | It should not be described as a universal disclosure requirement for every software tool or as immunity for a system that avoids a protected title. |
Sources: CDPH guidance on AB 3030, California Department of Insurance guidance on SB 1120, and California Board of Psychology advisory on AB 489.
AB 3030's human-review exception should be understood as a condition with factual content. A policy saying that a clinician is responsible for all messages does not by itself establish that the communication was actually read and reviewed. An organization should be able to identify its review process and distinguish automatically released messages from reviewed messages. The statute specifies presentation requirements that vary by written, audio, and video communication. Source: CDPH AFL 25-07.
SB 1120 addresses risks arising when software substitutes generalized inferences for individualized utilization review. The Department of Insurance explains requirements concerning relevant patient information, professional decision-making, discrimination, reviewability, and protection against improper denial, delay, or modification of services based on medical necessity. Its application depends on the regulated entity and coverage arrangement; Medicare, Medi-Cal, and other program questions should be evaluated under their applicable frameworks. Source: Department of Insurance guidance.
Enacted changes scheduled for January 1, 2027
AB 1979, Chapter 854, Statutes of 2026. The enacted measure adds Business and Professions Code section 22758.5 and amends provisions of the Confidentiality of Medical Information Act. Its clinical provisions require covered facilities, clinics, physician offices, and group practices to take reasonable steps to preserve a licensed professional's independent judgment when clinical decision-support technology informs care. It restricts using AI to perform specified functions legally requiring a licensed professional, including certain direction of unlicensed personnel in those functions. Its privacy amendments address covered consumer health chatbot businesses. Defined terms and exceptions matter; ordinary documentation or communication functions should not automatically be equated with independent clinical practice. These are forthcoming requirements as of this section's review date. Sources: chaptered text and Governor's September 30, 2026 AI legislation announcement.
SB 503, Chapter 857, Statutes of 2026. The enacted measure adds Business and Professions Code section 22758. It addresses reasonable efforts to identify known or reasonably foreseeable risks of biased impacts from covered AI in health programs or activities. Developers and deployers have distinct responsibilities, including specified documentation and mitigation obligations; deployers must undertake the required monitoring and proportionate mitigation. An organization can occupy more than one role. The statute should not be summarized as strict liability for every unequal outcome or as a guarantee that bias can be eliminated. Sources: chaptered text and Governor's signing announcement.
AB 1637, Chapter 536, Statutes of 2026. The forthcoming addition of Business and Professions Code section 2266.1 addresses responsibility for clinical notes and restrictions on alteration, with specified exceptions. The records page explains those provisions. Organizations adopting automated documentation should assess that law together with their existing record-integrity obligations. Sources: chaptered text and Governor's September 27, 2026 update.
AB 2575 was vetoed in September 2026. Its proposed requirements should not be represented as enacted law. Legislative proposals, final chaptered text, agency guidance, and safety recommendations must remain distinguishable. Source: Governor's September 30, 2026 legislative update.
What meaningful oversight requires in practice
Ambient recording, consent, and patient information
An ambient scribe introduces a recording question as well as a documentation question. California Penal Code section 632 generally prohibits intentional recording or eavesdropping on a confidential communication without all parties' consent, subject to the statute's definitions and exceptions. This is not a rule that every conversation in every setting has the same legal status. The practice should assess the actual recording process and consent requirements before deployment. Disclosure that a message was generated by AI and consent to recording are separate issues. Source: Penal Code § 632.
Evaluate what the service receives, whether audio or transcripts are retained, who can access them, and whether secondary uses are authorized. Where the vendor is a HIPAA business associate, required contractual safeguards should address permitted uses and disclosures and applicable subcontractor obligations. A business associate agreement does not authorize every use of patient information. Use an approved institutional workflow with an understandable patient process, appropriate access controls, and a defined retention and preservation policy; a clinician's personal consumer-AI account is not a substitute for that assessment. Source: HHS business associate contract guidance.
Effective clinical review
For a clinical tool, document its intended use, patient population, relevant limitations, local workflow, and responsible owner. Establish who can accept, reject, correct, or stop its output. Determine whether the user has enough time and information to detect a clinically consequential error. A nominal ability to override is of limited practical value when the interface hides the underlying evidence or the organization penalizes necessary review.
The 2025 SAFER organizational framework supports shared responsibility for AI safety, local evaluation, monitoring, and appropriate controls. These recommendations can inform a safety program, but they are not a freestanding rule deciding legal liability. Any applicable statutory, licensing, privacy, product, and institutional requirements must be evaluated separately. Source: SAFER Guides.
When a dispute arises, preserve the relevant model and software version, local configuration, available inputs, output, user presentation, review action, override, and subsequent changes where those records exist and are relevant. For a generative system, a later response to the same question may not reproduce the historical output. Retaining appropriate evidence requires a planned, privacy-conscious process; it does not justify indiscriminate collection of unrelated patient information.
Example: an automated message understates urgency
A system drafts a reassuring message about a result that should prompt urgent assessment. The message is released without actual clinical review. The patient relies on it and delays seeking care. The investigation should determine the applicable communication requirements, what the system received, what it generated, how the release setting was configured, who controlled it, and whether a clinician had a meaningful opportunity to intervene.
The plaintiff must still connect the alleged acts and omissions to compensable injury. A defense should examine the actual clinical timeline, system behavior, patient communication, and available opportunities for timely care. Neither side should infer causation solely from the label “AI.” For prevention, the organization should assign review responsibility, define which messages require escalation, test clinically consequential failure modes, and preserve a workable way to stop unsafe automated release.