California Enacts New AI and Consumer Privacy Laws
California Gov. Gavin Newsom has signed several bills aimed at regulating the use of artificial intelligence in health care settings. Collectively, the new laws reinforce and clarify existing principles requiring meaningful human oversight of AI tools that influence clinical decision-making. Among them, AB 1979 prohibits providers from using an AI-enabled tool, system, or device to independently perform clinical functions that state law reserves for licensed professionals or from directing unlicensed personnel to perform those functions. The bill also emphasizes that licensed providers must retain independent professional judgment when evaluating and acting on AI-generated recommendations in patient care.
AB 2575 protects the ability of health care professionals to override AI-generated recommendations and prohibits developers and deployers from using a clinician’s decision to override an AI system as a defense in litigation alleging harm caused by the system’s output. SB 503 requires developers to take reasonable steps to identify, assess, and mitigate foreseeable risks of bias arising from the use of AI-assisted clinical decision support systems.
The legislature also approved , The Wellness for Oversight and Psychological Resources Act, SB 903, was signed into law and prohibits the provision or marketing of psychotherapy services through companion chatbots, including representations that a chatbot is a therapist or provides therapy. The bill, which parallels legislation first of its kind legislation which enacted in Illinois and replicated elsewhere, requires review and oversight by licensed professionals when AI is used for certain mental health-related functions, including therapeutic decision-making, triage, screening, and the detection or assessment of an individual’s mental or emotional state.
Also enacted are two notable amendments to the California Consumer Privacy Act (CCPA). AB 1542 prohibits businesses from selling or sharing a consumer’s sensitive personal information with third parties unless the consumer intentionally discloses the information or intentionally interacts with the third party. SB 923 expands the CCPA’s deletion right to cover all information a business has collected about a consumer and requires businesses that operate exclusively online to provide a dedicated online mechanism, such as a webform or portal, for consumer requests in addition to an email address. Together, these measures strengthen consumer control over personal information and expand businesses’ compliance obligations under the CCPA.
