California's New AI in Healthcare Laws: What AB 1979 and SB 503 Mean for Practices and Digital Health Companies

On September 30, 2026, the last day he had to act on bills from the 2025-2026 session, Governor Newsom signed California's newest package of healthcare AI laws. Two of them, AB 1979 and SB 503, go straight at clinical AI, and a third, SB 947, puts rules around automated decisions about employees. He also vetoed two bills that would have gone further, one on AI in psychotherapy and one protecting clinicians who override AI recommendations. Most of what passed takes effect January 1, 2027, which gives practices and digital health companies about eleven weeks to look at how AI actually shows up in their care model.

The message underneath all of it is consistent: AI can support care, but a licensed person has to stay accountable for it. We work with companies that use AI every day and think it is an amazing tool, so we don't read this package as anti-AI. We read it as California writing down what good programs should already be doing.

What passed and what didn't

Signed

AB 1979 (Bonta): licensed clinicians must keep independent judgment when AI informs care, AI cannot independently perform licensed clinical functions, and consumer health chatbots fall under California's medical privacy law. Effective January 1, 2027.
SB 503 (Weber Pierson): developers and deployers of clinical decision support tools have to identify and mitigate biased impacts, and developers have to hand over documentation. Effective January 1, 2027.
SB 947 (McNerney): human review of automated employment decisions. Effective July 1, 2027.

Vetoed

SB 903 (Padilla): limits on AI in psychotherapy.
AB 2575 (Ortega): anti-retaliation protections for clinicians who override AI.

Two days earlier, on September 28, the governor also signed AB 1609, a general consumer law on customer service chatbots at large businesses, which matters for bigger healthcare companies.

AB 1979: the clinician makes the final call

AB 1979 applies to health facilities, clinics, physician offices, and group practices. It requires them to take reasonable steps so that a licensed provider exercises independent professional judgment whenever care is informed by a clinical decision support system, which the law defines broadly as an AI system that produces a prediction, classification, recommendation, evaluation, or analysis that aids decisions about timing of care, diagnosis, or treatment.

It also draws two hard lines. AI cannot independently perform a clinical function that the law reserves for a licensed professional, and AI cannot be used to direct, guide, supervise, or instruct unlicensed staff in performing those functions. Scheduling, appointment reminders, and routine communications like record updates are carved out, and so are trainees working toward licensure. Enforcement runs through the licensing boards, and a violation is treated as unprofessional conduct, including the unlawful practice of medicine.

That last part is the piece we'd underline. If you work in PC/MSO structures you will recognize the logic right away, because it is the corporate practice of medicine doctrine applied to software. California has long said that a nonlicensed entity cannot practice medicine or control clinical decisions, and AB 1979 extends that same idea to a tool. The question a regulator will ask is the same one they ask about an MSO: who actually made the clinical decision, and can you show it.

For digital health companies, the places we'd look first are the workflows where AI quietly moved from assisting to deciding. That includes asynchronous visits where an AI-drafted treatment plan gets approved in a few seconds without real review, intake tools that route or triage patients based on a model's output, and programs where coaches or other unlicensed staff follow AI-generated guidance on things that are clinical in nature, like medication or dosing questions. None of these is automatically a problem, but each one needs a documented point where a licensed clinician looks, decides, and can override.

The chatbot provision most companies will miss

The provision in AB 1979 that will catch the most companies off guard isn't about clinical judgment at all. Any business that offers a consumer health care chatbot, meaning one people use to manage their health information or to get help diagnosing, treating, or managing a condition, will be treated as a provider of health care under California's Confidentiality of Medical Information Act (CMIA) when the law takes effect. That status applies only for CMIA purposes, so it does not turn a chatbot company into a medical practice for everything else, but it does bring CMIA's confidentiality duties and penalties along with it.

This matters because a lot of wellness apps and DTC platforms have operated on the assumption that they aren't HIPAA covered entities, so health privacy rules didn't really apply to them. In California that assumption gets much harder to hold onto. If your product has a chat feature that touches symptoms, labs, medications, or a connected medical record, it is worth mapping where that data goes, which vendors see it, and what your privacy policy and consents actually say.

SB 503: bias documentation becomes a vendor diligence item

SB 503 uses the same definition of clinical decision support and splits the work between developers, who build the tool, and deployers, who use it (which includes providers). Both have to make reasonable efforts to identify tools with a known or reasonably foreseeable risk of biased impacts, meaning worse access, care, or outcomes based on characteristics like race, sex, or age. Developers have to give deployers a statement of intended uses and foreseeable risks, along with documentation on training data and demographic representativeness, performance and bias testing, data governance, and recommended use and monitoring. Deployers have to keep monitoring the tool once it is live and act on the problems they find.

We talk a lot about vendor due diligence, and this is a good example of why. Large companies outsource diligence because it is ultimately a compliance function, and SB 503 turns one piece of that function into a statutory requirement. In practice it means your AI vendors should be able to hand you this documentation, your contracts should say who monitors what, and someone on your side should own the review. If a vendor can't produce it, that tells you something.

SB 947 and AB 1609

Neither of these is a healthcare-specific law, but both reach healthcare employers. SB 947 takes effect July 1, 2027 and says software output alone cannot justify discipline or termination, so a human has to check the decision against other evidence like personnel files, supervisor reviews, or work product. If you use productivity scoring or automated scheduling tools on clinical or support staff, that is the area to review.

AB 1609 takes effect January 1, 2027 and applies to businesses with more than $500 million in national gross annual revenue. Covered businesses can't present a customer service chatbot as a human, have to disclose when someone is talking to a bot, and have to make a good-faith effort to connect a customer to a person within 15 minutes of a request during business hours. Hospital communications about care, coordination, and payment are exempt. Most independent practices won't come anywhere near the threshold, but larger telehealth and health tech companies should check.

The two vetoes and why they still matter

SB 903 would have limited AI in psychotherapy to administrative and supplementary support, required real informed consent before AI recorded, transcribed, or screened patients, and barred marketing a chatbot as a "therapist." The governor vetoed it because the definitions were broad enough to sweep in legitimate clinical tools that were never meant to replace therapy.

AB 2575 would have protected clinicians from retaliation for overriding AI and stopped vendors from arguing that a clinician's failure to override was the real cause of harm. The veto message pointed to an unworkable evidentiary standard and the labor commissioner's lack of medical expertise to judge standards of care.

In both veto messages the governor said he supported the underlying goals and encouraged the Legislature to come back to them, so we'd treat these as a preview rather than a dismissal. Behavioral health companies using AI for intake, notes, or between-session support should expect a narrower version of SB 903 to return, and the liability question behind AB 2575, which is who is responsible when the AI is wrong and the clinician didn't catch it, isn't going away just because this bill didn't pass.

How this builds on what California already had

This package sits on top of laws that are already in effect. AB 3030 requires facilities, clinics, and physician offices that use generative AI for patient communications about clinical information to include a disclaimer and clear instructions for reaching a human. SB 1120 requires that medical necessity decisions in health plan utilization review be made by a licensed clinician rather than an algorithm. AB 489, which took effect this year, gives the licensing boards authority to go after AI systems that imply they are licensed health professionals.

Put together, California now has rules on how AI talks to patients, what AI is allowed to decide, how AI is marketed, how chatbot data is protected, and what bias documentation has to exist. That is a lot of ground covered by the state that has historically set the pace for everyone else, and even with pressure at the federal level against state-by-state AI rules, California is clearly not slowing down.

Our take

Taking physicians out of the loop isn't safe and isn't what patients want, and AI and doctors go hand in hand because neither one is perfect on its own. These laws land in the same place. The companies that should feel comfortable are the ones already running their clinical layer correctly, where physicians review protocols, actually meet with providers, and own clinical decisions, and where AI is used to make that work faster rather than to replace it.

The companies that should take a harder look are the ones that scaled by letting automation stand in for clinical oversight, especially where a medical director signs off on a protocol once and the system runs on its own from there. That model was already hard to defend under CPOM, and as of January 1 the AI layer gets its own scrutiny on top of it.

What to do before January 1, 2027

Inventory every place AI touches your care model, from intake and triage to charting, patient messaging, and staff tools, and name the person responsible for each one.
Document where a licensed clinician reviews and can override AI output, and make sure your medical director oversight policies reflect it.
Check whether any unlicensed staff are following AI-generated guidance on clinical questions.
Review any patient-facing chat feature against CMIA, including data flows, vendors, and consents.
Ask your clinical AI vendors for SB 503 documentation and update contracts to assign monitoring responsibilities.
Confirm your generative AI patient communications already carry the AB 3030 disclaimer and instructions for reaching a human.

How Camino helps

Camino helps practices and digital health companies build the operational side of this: mapping where AI sits in the care model, writing the clinical oversight and medical director policies that show a licensed clinician is making the call, building vendor diligence into onboarding, and keeping the PC/MSO structure aligned with how care is actually delivered. If you're using AI in a California program and want to see how it fits with these new rules, reach out and we'll walk you through it.

References

AB 1979 — Health care services: artificial intelligence
SB 503 — Health care services: artificial intelligence
SB 947 — Employment: automated decision systems
Newsom Approves 3 Health Care AI Bills, Vetoes 2 — California Health Care Foundation
Keeping Humans in the Loop: California Sets New Ground Rules for AI in Healthcare — Holland & Knight
Additional official bill records: AB 1609, SB 903, and AB 2575.
Governor's AB 2575 veto message
Background laws: AB 3030, SB 1120, and AB 489.

This post is for general information only and is not legal advice. For guidance on your specific situation, talk with qualified healthcare counsel.