Law / United States / 
California
Health Care Services Artificial Intelligence Act (AB 1979)
An AI sector rules rule binding private bodies.
- Obligation class
- Governance, Prohibition
As of .
What it requires
- Take reasonable steps to ensure that a licensed health care provider, acting within their scope of practice, keeps the ability to exercise independent professional judgment whenever a patient's care is informed by the output of a clinical decision support systemNIST AI RMFMAP 3.5
- Do not use or deploy an AI tool, system, or device to direct, guide, supervise, or instruct unlicensed personnel in a clinical function that the law requires a licensed person to perform, or to perform such a function independentlyNIST AI RMFMAP 3.3
- If you offer a health care chatbot to a consumer to manage the consumer's information or for diagnosis, treatment, or management of a medical condition, handle the information as a provider of health care under the Confidentiality of Medical Information ActNIST AI RMFMEASURE 2.10
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.2-1Business need and security risks written down and assessed before deciding to build an AI system.
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.1.4-5End-users told which uses of the system are prohibited.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
A violation of the Confidentiality of Medical Information Act that results in economic loss or personal injury is punishable as a misdemeanor, and deeming a health care chatbot business a provider of health care brings that business within it.
Who enforces it
Enforcement body
Medical Board of California or the Osteopathic Medical Board of California for a violation by a physician; the appropriate health care professional licensing board may seek an injunction or restraining order where a violation is the practice of a health care profession without a license.
What this law does
AB 1979 was chaptered on as Chapter 854 of the Statutes of 2026. A health facility, clinic, physician's office, or office of a group practice must take reasonable steps to ensure that a licensed health care provider keeps the ability to exercise independent professional judgment whenever care is informed by the output of a clinical decision support system.
Those providers may not use an AI tool, system, or device to independently perform a clinical function the law requires a licensed person to perform. A business that offers a health care chatbot to a consumer to manage the individual's information, or for diagnosis, treatment, or management of a medical condition, is deemed a provider of health care subject to the Confidentiality of Medical Information Act.
A violation of the clinical-function limits by a physician is subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California.
When LexLint raises it
When your app profile says your app handles health records, deploys a chatbot or makes health care decisions.