California signs AB 1979, SB 503 and AB 1609, new healthcare AI laws

California enacted three new laws restricting how artificial intelligence can be used in clinical care and requiring disclosures about chatbot use in healthcare settings. Governor Gavin Newsom signed Assembly Bill 1979, Senate Bill 503 and Assembly Bill 1609 on September 30, 2026, as part of a broader package of AI legislation closing out the state's 2026 session.

What it is

AB 1979 amends California healthcare service laws to keep AI out of licensed clinical functions, SB 503 addresses algorithmic bias in clinical decision support tools, and AB 1609 sets chatbot disclosure duties for large businesses while carving out exemptions for certain healthcare communications.

What it requires

AB 1979 limits AI to an advisory role and protects patient health information accessed through chatbots, while exempting AI used for clinical documentation and communications that do not require professional judgment.

Developers and deployers must describe the intended uses and known or reasonably foreseeable risks associated with the use of the clinical decision support system.

SB 503 requires reasonable efforts to identify clinical decision support systems with known or reasonably foreseeable risk for biased impacts resulting from deployment in health programs or activities, and reasonable efforts to mitigate that risk.

AB 1609 prohibits large enterprises from representing a customer service chatbot as a human, but it exempts hospital and healthcare facility communications that relate to the provision, coordination, management, administration, payment or operation of health care services.

The governor's office described the package as ensuring doctors and licensed providers can use their own professional judgment when AI or other clinical decision tools are used in patient care, and requiring developers of clinical decision tools to take reasonable steps to reduce known or predictable bias in how these systems are used.

Newsom separately vetoed a bill that would have barred clinician failure to override AI outputs from being used as a legal defense and another that would have limited AI in mental healthcare, so those measures are not part of the enacted package.

What security leaders should do

Healthcare security and compliance teams should inventory every clinical decision support tool in use and confirm that vendors can produce documentation of intended uses and foreseeable risks as the new disclosure duties take effect. Teams should also build processes to review bias-impact assessments from developers and deployers, since the law places ongoing monitoring obligations on organizations that use these systems. Because AB 1609's chatbot disclosure rules exempt specified healthcare operational communications, legal and security teams should map which customer-facing bots fall inside versus outside that exemption before public deployment. Finally, given that related bills were vetoed over enforcement and definitional concerns, security leaders should expect California's healthcare AI rules to keep evolving and should track future legislative sessions for amendments.