Law / United States / 
California
Clinical Decision Support Systems Bias Mitigation Act (SB 503)
Cal. Bus. and Prof. Code Sections 22758 (SB 503, Ch. 857, Stats. 2026)
An AI risk obligations rule binding public and private bodies.
- Obligation class
- DPIA, Disclosure, Governance
As of .
What it requires
- Make reasonable efforts to identify any clinical decision support system you develop or deploy that is known or has a reasonably foreseeable risk of biased impacts in health programs or activitiesNIST AI RMFMEASURE 2.11
- As a developer, make reasonable efforts to mitigate the known or reasonably foreseeable risk of biased impacts of each such systemNIST AI RMFMANAGE 1.3
- As a developer, make available to deployers, on request or at initial sale and on material updates, a statement of the system's intended uses and known or reasonably foreseeable risks, with documentation of training data, evaluation, data governance, intended benefits, and recommendations for use and monitoringNIST AI RMFMAP 2.2
- As a deployer, regularly monitor each such system and take reasonable and proportionate steps to mitigate the known or reasonably foreseeable risk of biased impactsNIST AI RMFMEASURE 2.4NIST AI RMFMANAGE 1.3
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST AI RMF
- MAP 2.2Information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. Documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.
- MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.
- MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are documented.
- MANAGE 1.3Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- NIST Privacy Framework
- ID.RA-P2Data analytic inputs and outputs are identified and evaluated for bias.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.3-2Threats developers cannot resolve are passed to operators and on to end-users.
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.3.1-1Users told where and how their data is used, accessed and stored, with developers informing operators.
- 5.3.1-2.1That guidance covers proper use, limits and likely failure modes.
1 more
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What this law does
SB 503 was chaptered on as Chapter 857 of the Statutes of 2026. Developers and deployers of an AI clinical decision support system must make reasonable efforts to identify systems known or reasonably foreseeable to carry a risk of biased impacts in health programs or activities. Developers must make reasonable efforts to mitigate that risk.
Developers must also make available to deployers a statement of intended uses and risks and documentation of training data, evaluation, and recommended monitoring. Deployers must regularly monitor the systems and take reasonable and proportionate steps to mitigate the risk. A deployer is a health facility, clinic, physician's office, or office of a group practice. Compliance cannot be used as a defense to a claim of unlawful discrimination.
When LexLint raises it
When your app profile says your app handles health records or makes health care decisions.