California Legislators Draw the Line on Clinical AI: What Health Care Organizations Need to Know

California’s 2026 legislative session did not simply regulate artificial intelligence (AI) in health care. It drew a bright line through the clinical encounter: licensed professionals remain responsible for clinical judgments, and organizations using AI tools are required to document how those tools are developed, tested, and overseen.

Five bills address the use of AI tools in health care, including tools that support diagnosis and treatment, psychotherapy encounters, the customer service channel, and situations in which clinicians decline to follow an algorithm. The bills have been sent to Governor Gavin Newsom and await his action. If the bills become law, most would take effect January 1, 2027. Enforcement would be divided among disparate authorities such as licensing boards, the Labor Code, and civil litigation rather than centralized under a single privacy regulator.

The legislative session, which closed on August 31, 2026, produced eight privacy bills and 16 AI bills. Five of those bills target health care. Because these measures impose distinct and detailed operational requirements, we are covering them in a multi-part series. Each installment will address a single bill and follow the same structure:

• What the bill does
• Key compliance obligations
• Exceptions
• Health care-specific analysis
• Practical, actionable takeaways
• Effective dates

The installments are designed to stand alone, allowing compliance, clinical, IT, and legal stakeholders to focus on the bills most relevant to their functions.

Organizations outside California should not dismiss the 2026 legislative session as a regional development. California has repeatedly supplied the blueprint for privacy and technology regulation elsewhere, from the California Consumer Privacy Act’s (CCPA) influence on state comprehensive privacy laws to the spread of its concepts covering data brokers, minors’ privacy, and automated decision-making. Multistate providers, payers, digital health companies, and vendors should read these bills as a preview of obligations other states are likely to adopt. Organizations that develop, deploy, or rely on AI tools in clinical or administrative workflows should evaluate compliance architecture and posture, and build programs that scale accordingly.

In This Series

• Part One: The 2026 California Legislative Session and Prohibition on AI Independently Performing Licensed Clinical Functions (AB 1979)
• Part Two: Bias Identification and Mitigation for Clinical Decision Support Systems (SB 503)
• Part Three: New Liability and Worker Protection Framework for AI-Driven Clinical Decision Support Systems (AB 2575)
• Part Four: Regulation of AI in Psychotherapy Services (SB 903)
• Part Five: The Right to Human Customer Service Act (AB 1609)
• Series-Wide Action Items for Health Care Organizations

Part One: The 2026 California Legislative Session and Prohibition on AI Independently Performing Licensed Clinical Functions (AB 1979)

Professional licensing and, in turn, clinical judgment, is largely a matter of state law. The California legislature has now answered a question that remains unsettled in most states: to what extent may AI tools be used in providing a licensed clinical function? According to AB 1979, an AI tool may inform a clinical decision, but the tool is not a substitute for a clinical decision by the licensed professional. Further emphasizing the primacy of clinical judgment by licensed professionals, it would be licensing boards, not privacy regulators, who would enforce that boundary.

AB 1979 distinguishes between the use of AI that informs licensed clinical decisions and AI that replaces licensed clinical decision-making. Organizations outside California should take note—a prohibition on AI performing licensed clinical functions is among the most likely concepts to be replicated in other states.

This first installment in our series examines where AB 1979 places that boundary, why most AI-enabled clinical tools remain permissible so long as a licensed professional retains decision-making authority, and how the bill’s site-based coverage definition may leave individual licensees exposed even where their practice location is not expressly covered.

What AB 1979 would do: AB 1979 would prohibit a “health facility, clinic, physician’s office, or office of a group practice” from using or deploying any AI-powered tool, system, or device to independently perform any clinical function that is required by law to be performed by a licensed professional. The bill would also prohibit the use of AI to direct, guide, supervise, or instruct unlicensed personnel in the performance of such functions.

Key compliance obligations: Health care organizations would need to:

• Ensure that AI systems do not substitute for licensed professional judgment in clinical care.
• Preserve the ability of licensed health care providers to exercise independent professional judgment whenever care is informed by AI outputs.

Any violation by a physician would be subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California, which may pursue injunctions to prevent unlicensed practice.

Exceptions: The bill does not apply to AI used for documentation or communication that does not require professional judgment, such as automated messages informing patients of updates to their health records. The same holds for routine retail and specialty pharmacy communications, including refill-ready and pickup reminders, shipment and delivery tracking notices, and prescription transfer confirmations. Those communications remain subject to the Health Insurance Portability and Accountability Act (HIPAA), the California Confidentiality of Medical Information Act (CMIA), and state sensitive-services confidentiality rules governing what may be disclosed and to whom. The bill would also not prohibit supervised trainees from using AI as part of a program leading to professional licensure.

Potential coverage gap for pharmacies: Notably, as the California State Board of Pharmacy (Board) identified in its April report, the bill’s definition of covered sites—“health facilities, clinics, physician’s offices, or offices of a group practice”—does not expressly include stand-alone retail pharmacies or pharmacy chains. The Board recommended offering amendments to “ensure the prohibitions extend to all pharmacist and advanced pharmacist practitioner sites,” aligning with the Board’s stated position that “AI cannot and should not supplant such clinical judgement” in pharmacy practice.

However, even if a stand-alone pharmacy is not a covered site, individual pharmacists may still face professional exposure. Pharmacists are licensed health care professionals under Division 2 of the California Business and Professions Code and the bill prohibits AI from independently performing “any clinical function that is required by law to be performed by a person with a professional license.” Accordingly, a licensing board could still take action to enforce the bill’s restrictions. That risk may be significant if a board invokes the bill’s provision authorizing injunctions against unlicensed practice.

Effective date: AB 1979 currently awaits the Governor’s signature. If signed (or if it becomes law pursuant to other constitutional procedures), barring a specific effective date, the law would go into effect on January 1, 2027.

Analysis: AB 1979 draws a clear line between AI that informs clinical decisions and AI that replaces them. This distinction is critical for health care entities using AI tools as an adjunct (e.g., for sepsis alerts, diagnostic suggestions, risk scoring, and clinical summarization), all of which remain permissible so long as a licensed professional retains decision-making authority.

The bill operates in parallel with, rather than in conflict with, HIPAA’s privacy and security requirements, since HIPAA does not directly regulate the permissible scope of clinical use of AI. However, organizations should be aware that the bill’s restrictions may intersect with CMIA obligations regarding the confidentiality of AI-generated clinical information shared across provider networks. Organizations should therefore focus not only on what an AI tool can do, but also on how the tool is used within the clinical workflow.

Practical takeaways: Health care organizations should consider taking the following steps:

• Inventory clinical AI systems. Identify AI tools used in diagnosis, treatment, clinical decision support, documentation, patient communications, and workflows.
• Evaluate clinical functions. Determine whether the use of any AI system could be characterized as independently performing a function reserved for a licensed clinical professional.
• Review workflows involving unlicensed personnel. Confirm that AI does not direct, guide, supervise, or instruct unlicensed personnel in performing licensed clinical functions, and design workflows to prevent the use of AI tools in directing unlicensed personnel in performing functions reserved for licensed professionals.
• Preserve human decision-making authority. Confirm and document that a licensed professional retains decision-making authority over AI-informed care.
• Update AI governance documentation. Incorporate required human oversight into existing AI governance policy.
• Map professional licensure requirements. Compare AI-supported workflows against the licensure requirements of each professional category involved.
• Assess practice-specific risks. Consider whether individual providers’ licenses may be implicated even when a location is not expressly included within the bill’s definition of a covered site.

In sum, AB 1979 fixes the outer boundary of permissible clinical use of AI by reserving licensed judgment for licensed professionals.

Part Two of this series examines SB 503, which shifts focus to how AI tools informing clinical judgment must be tested and documented for bias.

For questions on development or deployment of AI in the health care setting contact your Quarles attorney or:

• Meghan O’Connor: (414) 277-5423 / meghan.oconnor@quarles.com
• Candice Andalia: (202) 780 2627 / candice.andalia@quarles.com