California Just Changed the Rules for AI in Health Care:
What Therapists Need to Know
Published: October 9, 2026
On September 30, 2026, California Governor Gavin Newsom signed two laws addressing artificial intelligence in health care. Assembly Bill 1979 (AB 1979) and Senate Bill 503 (SB 503) establish requirements involving clinical decision support systems, licensed professional judgment, and risks of biased outcomes when AI influences health care decisions. Both laws take effect January 1, 2027.
For California therapists, understanding these changes requires more than knowing that new AI legislation passed. Neither law establishes a blanket prohibition on using AI in psychotherapy, and neither imposes identical requirements on every mental health professional. Their application depends on the technology’s function, the type of health care organization involved, and the specific statutory provisions.
California lawmakers also passed SB 903, a separate bill that would have regulated AI use in psychotherapy more directly. Governor Newsom vetoed it. With several bills addressing related issues, mental health professionals need to distinguish between enacted requirements and proposals that did not become law.
What are California’s new AI laws, AB 1979 and SB 503?
AB 1979 and SB 503 address different aspects of AI-assisted clinical decision-making. AB 1979 focuses on preserving independent professional judgment and restricting AI from independently performing certain clinical functions reserved for licensed professionals. SB 503 establishes responsibilities for developers and covered health care organizations concerning known or reasonably foreseeable risks of biased impacts from clinical decision support systems.
Both laws define a clinical decision support system as an AI system that produces predictions, classifications, recommendations, evaluations, or analyses that aid clinical decision-making related to the timing of care, diagnosis, or treatment. These definitions appear in California Business and Professions Code §§ 22758(c)(4) and 22758.5(e)(4).
For behavioral health practices, the function of the technology is important. An automated appointment reminder performs a different function from software evaluating symptoms and recommending a diagnosis. The statutes specifically exclude certain administrative activities, including appointment management, reminders, patient education, pre-visit preparation, and payment processing, when those functions can be performed independently without a professional license.
A product containing AI does not automatically mean every feature qualifies as a clinical decision support system. Practices need to understand what the technology actually does, what information it uses, and whether its output influences clinical care.
What does California AB 1979 require when AI is used in patient care?
Under California Business and Professions Code § 22758.5, AB 1979 requires specified health care settings to take reasonable steps to ensure that licensed health care providers retain the ability to exercise independent professional judgment whenever patient care is informed by a clinical decision support system.
The requirement applies to covered health facilities, clinics, physician’s offices, and offices of group practices. The law does not simply require a licensed professional to be associated with the organization. It addresses that professional’s ability to exercise independent judgment in the care of an individual patient.
The same statute also prohibits covered settings from using AI to independently perform clinical functions legally requiring a professional license. Additionally, AI cannot be used to direct, guide, supervise, or instruct unlicensed personnel in performing clinical functions that require licensure. The statute contains an exception for trainees participating in supervised study or training programs while working toward licensure.
Consider an AI system that evaluates a client’s symptoms and generates a proposed diagnosis or treatment recommendation. The output may use appropriate clinical terminology and appear consistent with professional documentation standards. None of those characteristics establishes that the recommendation is appropriate for the individual client. The licensed professional must still be able to evaluate the information and exercise independent clinical judgment.
AB 1979 also contains a limited exception for automated decision systems used for documentation and communication that do not involve the application of professional judgment. This exception, established under § 22758.5(d), is not a blanket exemption for every AI documentation product. A system generating clinical interpretations or recommendations may raise different issues from one producing routine administrative communications.
For therapists, the professional responsibility remains familiar even if the technology is relatively new. Software may assist with clinical work, but it does not assume the responsibilities attached to a professional license.
Important for California Private Practices
California’s new AI laws do not automatically apply to every solo therapist or group psychotherapy practice. AB 1979 and SB 503 define specific covered health care settings, and those definitions matter. An independently owned psychotherapy group is not automatically considered a physician group practice under these provisions. However, other privacy, licensing, and professional obligations still apply.
Does California AB 1979 apply to all therapists and private practices?
No. AB 1979 does not automatically impose its clinical decision support requirements on every California therapist simply because they use AI.
The law identifies specific covered settings, including health facilities, clinics, physician’s offices, and offices of group practices. The definitions incorporated through Business and Professions Code § 22758.5(e) determine which organizations fall within those categories.
One particularly important detail for behavioral health practices is California’s definition of an office of a group practice. Under California Health and Safety Code § 1339.75(c)(6), that term refers to offices where two or more physicians are organized in specified legal structures. AB 1979 incorporates this definition rather than automatically including every independently owned psychotherapy practice with multiple therapists.
Similarly, the statutory definition of a physician’s office refers to an office of a physician in solo practice. An independently practicing LCSW, LMFT, LPCC, or psychologist should not assume their office falls within that definition simply because they provide health care services.
However, behavioral health organizations are not categorically excluded. A therapist working within a covered clinic, health facility, or other qualifying setting may encounter different organizational requirements than a clinician operating an independent psychotherapy practice.
Practices should evaluate their actual organizational structure and applicable statutory definitions rather than assuming every business described as a group practice is treated identically. Even where a particular provision of AB 1979 does not directly apply, existing confidentiality, licensing, professional judgment, and other legal requirements remain relevant.
Does California AB 1979 apply to mental health AI chatbots?
Yes. AB 1979 expands California’s Confidentiality of Medical Information Act (CMIA) to cover certain health care chatbot businesses. This is a separate component of the law from its clinical decision support requirements.
Under the amended California Civil Code § 56.05(i), a health care chatbot is a generative AI system with a natural-language interface that provides adaptive, human-like responses, is marketed as facilitating or supporting health services, and uses health-related information to provide those services.
That information may include details about a consumer’s physical or mental health or wellness that the person provides directly, allows the system to access, or that the chatbot collects, generates, or infers.
Under California Civil Code § 56.06(f)–(h), a business offering a qualifying health care chatbot for specified purposes is treated as a health care provider for purposes of CMIA. The business must maintain the confidentiality standards applicable under that law and is subject to applicable penalties for improper use or disclosure of medical information. This designation does not automatically make the business a health care provider under unrelated California laws.
This is particularly relevant in mental health, where consumers may share sensitive information with systems marketed as offering emotional support, wellness assistance, or other health-related services. Information generated or inferred through those interactions may also raise privacy concerns, even when the consumer did not explicitly provide it.
Not every chatbot or automated website assistant falls within the statutory definition. Whether the law applies depends on the technology’s functions, marketing, information practices, and purposes.
The expansion of CMIA reinforces an important compliance issue: privacy obligations do not begin and end with HIPAA. California may impose confidentiality requirements on businesses that are not traditional HIPAA-covered entities.
What does California SB 503 require for AI clinical decision tools?
SB 503 establishes requirements intended to identify and reduce known or reasonably foreseeable risks of biased impacts involving certain clinical decision support systems.
Under California Business and Professions Code § 22758, the law distinguishes between developers, who design, code, substantially modify, or otherwise produce clinical decision support systems for commercial or public use, and deployers, which are specified health care organizations using those systems.
A deployer is defined as a health facility, clinic, physician’s office, or office of a group practice that uses a clinical decision support system. Importantly, SB 503 defines an office of a group practice by reference to two or more physicians organized in specified legal structures. It does not automatically include every independently owned psychotherapy group practice.
Developers and deployers must make reasonable efforts to identify clinical decision support systems developed for use by deployers that are known to present, or have a reasonably foreseeable risk of, biased impacts when deployed in health programs or activities. Developers must make reasonable efforts to mitigate those risks.
For the systems identified under these provisions, SB 503’s developer documentation requirements include intended uses, known or reasonably foreseeable risks, high-level summaries of training-data types, demographic representativeness when available, performance evaluations and limitations, data governance measures, intended benefits, expected outputs, bias mitigation efforts, and recommendations for appropriate use and monitoring.
The required documentation must be made available upon request or at initial sale, whichever occurs earlier, and upon applicable material updates. Covered deployers must regularly monitor the identified systems and take reasonable, proportionate steps to mitigate known or reasonably foreseeable risks of biased impacts.
For mental health professionals, this becomes relevant when technology influences decisions about diagnosis, treatment recommendations, clinical prioritization, or access to care. A system may produce information that appears objective while performing differently across populations. When those outputs influence care, differences in performance can affect individual clients.
SB 503 defines a biased impact as an adverse impact, including diminished access to health care, quality of care, or outcomes, based on protected characteristics.
However, the law does not require every therapist who uses AI to conduct an independent algorithmic bias audit. Its definition of a deployer is limited to specified health care settings, including qualifying physician practices, clinics, and health facilities.
A vendor’s responsibility to evaluate its technology should not be confused with a practice’s responsibility to understand how it uses that technology. Those responsibilities may overlap, but they are not interchangeable.
Can California therapists still use AI for documentation and clinical work?
Yes. Neither AB 1979 nor SB 503 establishes a blanket prohibition on therapists using artificial intelligence for documentation, administrative functions, or clinical support.
California also has an existing law addressing certain AI-generated patient communications. Under California Health and Safety Code § 1339.75, enacted through AB 3030 in 2024, covered health facilities, clinics, physician’s offices, and offices of group practices using generative AI to produce written or verbal communications concerning patient clinical information must provide specified AI disclosures and instructions for contacting a human.
The disclosure requirement does not apply when a licensed or certified health care provider has read and reviewed the communication. This law took effect January 1, 2025, before AB 1979 and SB 503, and should be evaluated separately from the new clinical decision support provisions.
Whether a particular use of AI is appropriate depends on what the technology does, what information it receives, how its output is used, and which legal and professional requirements apply.
AI-assisted documentation provides a useful example. One product may help organize or format information entered by the clinician, while another may record sessions, generate clinical interpretations, suggest diagnoses, or recommend treatment interventions. These functions raise different questions about confidentiality, consent, accuracy, professional judgment, and the appropriate use of client information.
A therapist reviewing AI-generated documentation remains responsible for ensuring that the record accurately reflects the client, the services provided, and the clinical conclusions reached. A polished note is not necessarily an accurate note, and a clinically worded recommendation is not automatically an appropriate recommendation.
Practices should also avoid assuming that a product marketed for health care is appropriate for every clinical function. The actual technology, its configuration, and intended use are more important than the vendor’s marketing description.
Did California SB 903 become law?
No. Governor Gavin Newsom vetoed SB 903 on September 30, 2026, as confirmed in the Governor’s September 30, 2026 legislative update. Although the California Legislature passed the bill, its proposed restrictions did not become law.
SB 903, the Wellness and Oversight for Psychological Resources Act, would have established more specific requirements concerning the use of AI by mental health professionals in psychotherapy. Its proposed provisions addressed AI involvement in therapeutic recommendations, clinical assessments, and other activities associated with mental health treatment.
This distinction is important because information about proposed legislation frequently remains available after a bill has been amended, rejected, or vetoed. An article published while SB 903 was advancing through the Legislature may accurately describe what lawmakers proposed without accurately describing the requirements California ultimately enacted.
Therapists reviewing claims about new AI restrictions should confirm the bill number, final legislative status, and actual statutory language before treating those claims as legal requirements.
The veto of SB 903 does not eliminate other applicable privacy laws, professional standards, or licensing obligations. It means the specific restrictions proposed in that bill were not enacted.
Do California’s new AI laws matter if your practice doesn’t use AI?
Potentially. A therapist may not intentionally use an AI application during sessions or consult a chatbot for clinical advice, yet still have AI functionality available through existing practice technology.
EHRs, documentation platforms, assessment systems, scheduling software, communication tools, and other products may offer AI features. That does not mean every product in those categories uses AI or that every feature is subject to California’s clinical decision support requirements. Practices need to understand what their particular systems actually do.
Consider a practice that selected its EHR several years ago. At the time, the product may have provided documentation, scheduling, billing, and record management. Since then, the vendor may have introduced optional AI documentation tools, clinical assistance features, or other functionality that did not exist when the original agreement was signed.
The practice may never have purchased a separate AI product, but its existing technology may have changed.
Vendor reviews should therefore reflect current functionality, contractual terms, data-handling practices, and enabled features rather than relying entirely on the information available when the practice first purchased the software.
The presence of AI does not automatically make a product inappropriate. It does mean the practice needs sufficient information to understand what the technology does and determine whether additional compliance considerations apply.
Does HIPAA compliance mean an AI tool meets California’s requirements?
No. A vendor’s HIPAA compliance claims or willingness to sign a Business Associate Agreement (BAA) do not automatically establish compliance with California’s AI laws, professional licensing requirements, or other applicable privacy protections.
A BAA addresses specific responsibilities involving protected health information when a vendor performs functions on behalf of a HIPAA-covered entity or business associate. It does not determine whether every feature of the vendor’s product is appropriate for clinical use, whether AI-generated recommendations are reliable, or whether additional state requirements apply.
For example, a practice may have a BAA with its documentation vendor while still needing to understand whether an optional AI feature records sessions, generates clinical interpretations, retains information, or uses data for purposes beyond those originally evaluated.
Likewise, a developer’s responsibilities under SB 503 do not establish that every use of its technology satisfies a clinician’s professional obligations. California Business and Professions Code § 22758(d) expressly provides that the statute does not replace other applicable state laws regulating AI or automated decision systems.
HIPAA, state privacy laws, licensing standards, and AI-specific requirements may apply to different aspects of the same technology. Meeting one requirement does not eliminate the need to evaluate the others.
For additional information, see Guardian Clinical Essentials’ resources on AI, HIPAA, and next steps for mental health practices.
What should California therapists do before January 1, 2027?
California therapists and practice owners should begin by identifying where AI functionality exists within their operations and determining whether any of those functions influence clinical decisions.
That includes reviewing existing technology, understanding which features are enabled, and identifying what information those features access or generate. Systems used solely for administrative purposes may present different considerations from those producing clinical recommendations, evaluations, or predictions.
Practices should also determine whether they operate within one of the settings covered by AB 1979 or SB 503. Providing mental health services or employing multiple clinicians does not automatically establish that every provision applies.
Current vendor documentation, contractual terms, BAAs where applicable, data-handling practices, and AI-related policies should accurately reflect how the practice uses technology. If a vendor has introduced new functionality since the original review, the practice may need to evaluate whether its existing documentation and procedures remain appropriate.
For organizations operating across state lines, California’s requirements should be considered alongside the laws and professional obligations applicable in other jurisdictions.
The objective is not to rewrite every policy because California enacted another AI law. It is to understand the technology being used, identify the requirements that actually apply, and address gaps before they create problems.
Who has time to track every new AI, HIPAA, and privacy law? Apparently, I do. And I love it!
Sign up for the Guardian Clinical Essentials newsletter and get important compliance updates for behavioral health practices delivered straight to your inbox. No fluff, just the developments worth knowing about.
What California’s new AI laws mean for behavioral health practices
AB 1979 and SB 503 establish additional requirements for certain AI uses in health care beginning January 1, 2027. They address independent professional judgment, risks associated with clinical decision support systems, and privacy protections for qualifying health care chatbots. They do not create identical requirements for every California therapist or prohibit all AI-assisted clinical work.
For mental health practices, understanding these laws requires more than checking whether a vendor advertises HIPAA compliance. Practices need to know what technology they are using, what information it can access, what decisions it may influence, and which legal and professional requirements apply to those functions.
Effective compliance starts with understanding the actual operations of the practice, not relying on assumptions about the software or conclusions drawn from a headline.
Guardian Clinical Essentials™ provides behavioral health practices with customized compliance documentation, HIPAA resources, and consulting services addressing privacy, security, vendor management, and emerging technology requirements.
This article is provided for educational and informational purposes and does not constitute legal advice. Practices should evaluate the laws, licensing requirements, professional standards, and technology applicable to their specific operations.
Frequently Asked Questions
About California's New AI Laws
When do California's new AI laws take effect?
California AB 1979 and SB 503 take effect January 1, 2027. Both bills were signed by Governor Gavin Newsom on September 30, 2026. They establish requirements involving AI-assisted clinical decisions, independent professional judgment, and risks of biased outcomes in specified health care settings.
Are California therapists prohibited from using AI in 2027?
No.
California’s new laws do not establish a blanket ban on AI use by therapists. AB 1979 restricts certain uses of AI in covered health care settings, particularly when technology performs functions requiring professional licensure or interferes with independent clinical judgment. Other privacy, confidentiality, and licensing requirements may still apply.
Do California's AI laws apply to solo therapists and group practices?
Not automatically.
The clinical decision support provisions of AB 1979 and SB 503 identify specific covered health care settings. Their definitions of physician’s offices and offices of group practices do not automatically include independently operated psychotherapy practices. However, therapists working in qualifying clinics or health facilities may be affected, and other California laws may apply.
Can California therapists use AI to write progress notes?
California’s new laws do not categorically prohibit AI-assisted progress notes. However, the technology’s functions matter. Software that formats documentation may raise different concerns from technology that interprets symptoms, recommends diagnoses, or generates treatment decisions. Therapists remain responsible for documentation accuracy, confidentiality, and appropriate clinical judgment.
Does a HIPAA-compliant AI platform automatically satisfy California's AI laws?
No.
HIPAA compliance and a Business Associate Agreement do not establish that every AI feature meets California’s requirements. Practices must also consider the technology’s actual functions, data practices, applicable state privacy laws, and professional licensing obligations. A vendor’s general compliance claims are not a substitute for reviewing how a specific feature operates.
Did California pass SB 903, the AI psychotherapy bill?
No.
Governor Gavin Newsom vetoed SB 903 on September 30, 2026. The bill proposed additional restrictions involving AI and psychotherapy, but those proposals did not become law. California did enact AB 1979 and SB 503, which address certain uses of AI in health care.
Are mental health AI chatbots covered by California privacy law?
Certain health care chatbots are covered by California’s Confidentiality of Medical Information Act under AB 1979. Qualifying businesses offering generative AI chatbots that support specified health-related services may be subject to CMIA confidentiality requirements. Coverage depends on the chatbot’s functions, marketing, and handling of health-related information.
What should California therapists do before January 1, 2027?
Therapists and practice owners should identify AI functionality in their existing systems, review how those features use client information, and determine which legal requirements apply to their practice setting. They should also review relevant vendor agreements, confidentiality safeguards, and procedures for maintaining independent clinical judgment.
More AI + HIPAA Resources for Therapists
This article is part of Guardian Clinical Essentials™’ AI + HIPAA Resources Hub, created to help therapists and behavioral health practices understand how privacy, security, and compliance requirements apply when AI enters the practice.
You may also want to read:
About the Author
Samantha Schalk, LMSW-C, LMSW-M, CAADC, CIMHP, BCP3, CHPSE
Samantha is a licensed mental health professional, private and group practice owner, Certified HIPAA Privacy Security Expert (CHPSE), and the founder of Guardian Clinical Essentials™.
Her work focuses on helping therapists and behavioral health practices understand and implement requirements involving HIPAA, privacy, security, documentation, technology, and practice operations.
Drawing from her experience in clinical practice, supervision, practice ownership, and compliance consulting, Samantha develops practical compliance resources, training, and implementation guidance specifically for behavioral health professionals.
Learn more about Samantha and Guardian Clinical Essentials™.
Continue Exploring Guardian Clinical Essentials™
Looking for additional compliance, privacy, AI, documentation, and practice operations resources?
Explore the Guardian Clinical Essentials™ Resource Library for educational articles, implementation guidance, training opportunities, and practical resources designed specifically for mental health professionals.