CA AB 1979
California Assembly Bill 1979 - Health Care Services: Artificial Intelligence
Deems a business that offers a health care chatbot to consumers, for managing their information or for diagnosis, treatment or management of a medical condition, to be a provider of health care subject to the Confidentiality of Medical Information Act. Requires health facilities, clinics and physician practices to preserve licensed professionals' independent judgment when care is informed by clinical decision support AI, and bars them from using AI to independently perform, or to direct unlicensed personnel in, clinical functions that require a professional license.
Jurisdiction
California
Enacted
Sep 30, 2026
Effective
Jan 1, 2027
Enforcement
Medical Board of California or Osteopathic Medical Board of California for physicians; health care professional licensing boards (injunctions where a violation is unlicensed practice); Confidentiality of Medical Information Act enforcement and private actions for health care chatbot providers
Approved by Governor Newsom and chaptered by the Secretary of State on September 30, 2026 as Chapter 854, Statutes of 2026. Adds Chapter 25.5 (commencing with Section 22758.5) to Division 8 of the Business and Professions Code and amends Civil Code Sections 56.05 and 56.06. Passed the Senate 29-9 on August 26, 2026; the Assembly concurred in Senate amendments 66-10 on August 27, 2026; enrolled and presented to the Governor on September 4, 2026. No urgency clause, so the act takes effect January 1, 2027 under Article IV, Section 8(c) of the California Constitution.
California Legislative Information: AB 1979, Chapter 854, Statutes of 2026 (chaptered text)Why It Matters
Brings consumer-facing generative AI health chatbots inside California's medical privacy statute, which carries a private right of action with $1,000 nominal damages, where they are offered for managing a person's health information or for diagnosis, treatment or management of a condition. Also puts into statute that health facilities and practices may not use AI to independently perform clinical functions reserved to licensed professionals.
Recent Developments
Signed September 30, 2026, the last day for gubernatorial action, alongside SB 503 on bias in clinical decision support systems (Chapter 857, Statutes of 2026). The same day the Governor vetoed SB 903, which would have barred offering or advertising therapy provided by a companion chatbot.
At a Glance
Applies to
Requires
Who Must Comply
- Businesses offering health care chatbots to consumers in California
- Health facilities, clinics, physician offices and offices of group practices that use clinical decision support AI or other AI tools
Safety Provisions
- A health care chatbot is a generative AI system with a natural language interface that gives adaptive, human-like responses, is marketed as facilitating or supporting health services, and uses information about a consumer's physical or mental health or wellness (Civil Code section 56.05)
- A business offering a health care chatbot to a consumer for managing the individual's information, or for diagnosis, treatment or management of a medical condition, is deemed a provider of health care subject to the Confidentiality of Medical Information Act (Civil Code section 56.06(f))
- Health facilities, clinics, physician offices and group practices must take reasonable steps to ensure a licensed provider retains independent professional judgment whenever care is informed by a clinical decision support system
- Prohibits using or deploying AI to independently perform, or to direct, guide, supervise or instruct unlicensed personnel in, any clinical function that the law requires a licensed person to perform
- Excludes automated documentation and communication that involves no professional judgment, such as record-update messages, reminders and helping patients find information at their request
Exemptions
Documentation and communication tools
Section 22758.5 does not apply to automated decision systems used for documentation and communication that involve no professional judgment, including automated messages about health record updates, reminders, or helping patients find information at their request
- • No application of professional judgment
Supervised trainees
The AI prohibition does not bar a trainee from using a tool as part of a supervised course of study or training program toward licensure
- • Trainee working toward licensure
- • Supervised course of study or training program
Compliance & Enforcement
Key Dates
Jan 1, 2027
Businesses offering health care chatbots are deemed providers of health care under the Confidentiality of Medical Information Act; clinical decision support and licensed-function rules in Business and Professions Code section 22758.5 take effect
Penalties
$250K/violation; criminal liability
Private Right of Action
Individuals can sue directly without waiting for regulatory action.
View on map
California
Focus Areas
Cite This
APA
California. (2026). California Assembly Bill 1979 - Health Care Services: Artificial Intelligence.
Related Regulations
CA SB 903
Would bar the use of AI to record or transcribe psychotherapy sessions, or to triage/screen a person for psychotherapy, without the patient's informed consent; prohibit advertising or offering psychotherapy services through companion chatbots (including claiming a chatbot is a therapist); and bar AI from making independent therapeutic decisions.
CA SB 947
Adds Labor Code Part 5.5.5 on employers' use of automated decision systems (ADS). Bars using an ADS to violate labor or civil rights law, to infer an employee's protected status, or to predict and act against workers exercising legal rights; bars relying solely on an ADS for disciplinary or termination decisions and requires human corroboration where an ADS output is the primary basis; and requires a written post-use notice and, on request, a description of the employee's data used. Operative July 1, 2027.
TX Healthcare AI Law
Requires healthcare practitioners using AI for diagnosis to review all AI-generated records and disclose AI use to patients. Mandates EHR data localization (Texas patient data must be physically stored in US). Applies to covered entities and third-party vendors.
NJ Kids Code
Codifies a New Jersey Age-Appropriate Design Code requiring covered online service providers to design services likely to be accessed by minors around minors' safety and wellbeing, including high-privacy defaults, limits on engagement-maximising design features, and data protection impact assessments. Enforced by the Attorney General with a private right of action for minors and their parents.
VT AADC
Vermont design code structured to be more litigation-resistant: focuses on data processing harms rather than content-based restrictions. AG rulemaking authority begins July 2025.
SC AI CSAM & Intimate Images Law
S.28 creates offense of obscene visual representations of child sexual abuse, including AI-generated CSAM. S.29 addresses morphed images of identifiable minors. Both bills criminalize creation, possession, and distribution of AI-generated sexual images without consent. Offenders added to sex offender registry.
Last updated October 4, 2026. Verify against primary sources before relying on this information.