California Healthcare AI Transparency and Accountability Bill

Overview

California Assembly Bill 2575 (AB 2575) represents a significant legislative effort to regulate the integration of artificial intelligence (AI) and clinical decision support systems (CDSS) into California's health care landscape. Introduced by Assembly Member Liz Ortega, the bill establishes a regulatory framework that prioritizes patient safety, protects the professional judgment of health care workers, and imposes liability standards on AI developers and deployers. Legislative passage was completed on August 31, 2026, when the Assembly concurred in Senate amendments, sending the measure to the Governor.

Definitions

AB 2575 introduces and relies upon several key definitions to delineate the scope and application of its provisions within the healthcare sector. While the full text provides precise legal definitions, the core concepts include 'artificial intelligence' (AI), which is broadly understood as a machine-based system that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. This definition is crucial for encompassing a wide array of AI technologies, from diagnostic algorithms to administrative automation tools, ensuring comprehensive regulatory coverage. A closely related term is 'generative artificial intelligence' (GenAI), which specifically refers to AI systems capable of producing novel content, such as written or verbal patient communications, and is subject to particular disclosure requirements under the bill.

Another central definition is 'clinical decision support system' (CDSS), which refers to technology, including AI, used for patient care that assists healthcare professionals in making clinical decisions. The bill often uses 'covered tool' to refer collectively to AI and CDSS, signifying any such system deployed in patient care settings. These definitions are critical because the bill mandates specific transparency, inventory, and liability requirements for health facilities, clinics, physician's offices, or group practices that utilize or deploy these 'covered tools' for patient care. Understanding these terms is fundamental to comprehending the obligations imposed by AB 2575 on healthcare providers and technology developers, ensuring that all relevant AI applications in clinical settings are adequately addressed by the proposed legislation.

Governance and Institutional Framework

The governance and institutional framework for AB 2575 leverages existing regulatory bodies within California's healthcare and labor sectors, rather than establishing entirely new agencies. The bill's provisions interact with the established authorities of the State Department of Public Health, which is responsible for the licensure and regulation of health facilities and clinics, and the Medical Board of California, tasked with the licensing, regulation, and discipline of physicians and surgeons. These existing structures are expected to integrate the new requirements related to AI and CDSS, ensuring that the deployment and use of these technologies adhere to the state's broader health and safety standards. The bill's approach suggests an intention to embed AI oversight within familiar regulatory mechanisms, allowing for a more streamlined implementation process and leveraging the expertise of established bodies in healthcare governance.

Furthermore, AB 2575 significantly involves the Labor Commissioner in its enforcement mechanisms, particularly concerning the protection of healthcare workers. The bill declares a public policy that workers providing direct patient care should be free to use their professional judgment and should not be penalized for relying on employer-approved technology. It also explicitly prohibits employers from retaliating or discriminating against workers who override AI outputs if, in their professional judgment, it is appropriate for patient care or necessary to comply with applicable law. In cases of such retaliation or discrimination, the bill authorizes workers to file a complaint with the Labor Commissioner, thereby expanding the commissioner's purview to include AI-related workplace disputes in healthcare settings. This dual approach, integrating AI regulation into both healthcare facility oversight and labor protection, underscores the comprehensive nature of AB 2575 in addressing the multifaceted impacts of AI on health services and the workforce.

Key Focus Areas

AB 2575 primarily focuses on three critical areas to ensure the responsible integration of AI in healthcare: transparency, the protection of professional judgment for healthcare workers, and enhanced accountability for AI developers and deployers. Regarding transparency, the bill mandates that health facilities, clinics, physician's offices, or group practices using or deploying clinical decision support systems (CDSS) for patient care must make an inventory of all such systems available upon request. This inventory must be accessible to licensed healthcare professionals, other persons using or viewing CDSS outputs, and even patients whose care may be affected. Beyond a simple list, the bill requires the disclosure of specified information about each CDSS, including its intended use, data inputs, performance characteristics, and known risks or limitations, thereby empowering users and patients with crucial information to make informed decisions.

The protection of professional judgment is another cornerstone of AB 2575. The legislation explicitly states that it is the public policy of California that healthcare workers providing direct patient care are free to use their professional judgment to make assessments and decisions within their scope of practice. It prohibits employers from using or deploying technology, including AI, to replace or eliminate a worker's professional judgment in patient care. Crucially, the bill safeguards workers from retaliation or discrimination if they choose to override the output of a covered AI tool when, in their professional judgment, such an override is appropriate for the patient or necessary to comply with legal obligations, including civil rights law. Finally, the bill addresses accountability by prohibiting developers, modifiers, selectors, or deployers of AI or CDSS from asserting a defense that a healthcare worker's failure to override an AI output constitutes a superseding cause that severs their liability for alleged harm. This provision aims to ensure that responsibility for potential harm caused by AI systems remains with those who develop and deploy them, preventing the shifting of blame to frontline healthcare providers.

Implementation Framework

The implementation framework for California AB 2575 is designed to integrate new AI-related requirements into existing healthcare operational structures, focusing on practical steps for health facilities, clinics, and physician's offices. A primary aspect of this framework involves the creation and maintenance of a comprehensive inventory of all clinical decision support systems (CDSS) currently in use or deployed for patient care. This inventory must be made available upon request to licensed healthcare professionals, other individuals utilizing or reviewing CDSS outputs, and patients potentially impacted by these systems. This requirement, set to take effect by July 1, 2027, for CDSS, necessitates a systematic approach to identifying, documenting, and regularly updating information about all AI tools employed in clinical settings. Furthermore, the bill mandates that specific information about each CDSS—such as its developer, intended purpose, data inputs, performance metrics, and any known risks or limitations—be disclosed. This implies the need for internal policies and procedures to ensure that this detailed information is readily accessible and understandable to relevant stakeholders, fostering a culture of transparency in AI utilization.

Beyond documentation and disclosure, the implementation framework emphasizes the crucial role of human oversight and professional judgment. Healthcare employers will be required to establish policies that affirm a worker's right to exercise their professional judgment and to override AI outputs when clinically appropriate, without fear of retaliation. This necessitates clear communication and training for staff regarding these rights and the processes for documenting overrides. For generative AI systems used in patient communications, facilities must ensure that all such communications include a clear disclaimer indicating AI generation and provide explicit instructions for patients to contact a human healthcare provider. These provisions collectively require a multifaceted implementation strategy that includes technological auditing, policy development, staff training, and patient education, all aimed at embedding responsible AI practices within daily healthcare operations and ensuring that AI tools serve to support, rather than supplant, human expertise and patient-centered care. The Labor Commissioner's role in addressing worker complaints further underscores the need for robust internal mechanisms to prevent retaliation and uphold professional autonomy.

Monitoring and Evaluation

Monitoring and evaluation under AB 2575 will primarily rely on a combination of existing regulatory oversight bodies and the new mechanisms established by the bill, particularly concerning worker protections. Health facilities, clinics, and physician's offices are already subject to licensure and regulation by the State Department of Public Health and the Medical Board of California. These entities will likely incorporate compliance with AB 2575's transparency and professional judgment provisions into their regular inspection and review processes. For instance, the requirement to maintain and disclose an inventory of clinical decision support systems (CDSS) could become a point of audit, ensuring that healthcare providers are indeed tracking and making available the necessary information about their AI tools. The ongoing oversight by these established bodies will be crucial for verifying that the mandated disclosures are occurring and that AI is being integrated in a manner consistent with patient safety and quality of care standards.

A significant component of the monitoring and evaluation framework is the role of the Labor Commissioner. AB 2575 empowers healthcare workers who experience retaliation or discrimination for exercising their professional judgment to override AI outputs, or for relying in good faith on employer-approved technology, to file a complaint with the Labor Commissioner. This mechanism provides a direct avenue for workers to report non-compliance related to their professional autonomy and protection from adverse employment actions. The Labor Commissioner's investigations and enforcement actions will serve as a critical feedback loop, highlighting areas where employers may be failing to uphold the bill's intent regarding human oversight and worker rights in AI-driven healthcare environments. Over time, the aggregate data from such complaints, alongside routine regulatory assessments, could inform future amendments or supplementary guidance to AB 2575, ensuring the legislation remains effective and responsive to the evolving landscape of AI in healthcare.

Penalties, Liability, and Appeals

AB 2575 introduces significant provisions concerning penalties, liability, and appeals, particularly focusing on accountability for harm caused by artificial intelligence (AI) and clinical decision support systems (CDSS) in healthcare. A cornerstone of the bill's liability framework is the explicit prohibition against a defendant—whether a developer, modifier, selector, or deployer of an AI tool or CDSS—from asserting a defense that the failure of a licensed healthcare professional or other healthcare worker to override an output of the system is a superseding cause severing the defendant's liability for alleged harm. This provision is designed to ensure that accountability for AI-related harm cannot be easily shifted away from those responsible for the design, implementation, and selection of these systems, thereby placing a greater onus on developers and deployers to ensure the safety and reliability of their AI tools. It aims to prevent a scenario where a human-in-the-loop is used as a shield against liability, reinforcing the idea that AI should support, not absolve, human responsibility.

In terms of penalties and enforcement, the bill leverages existing legal frameworks and introduces specific protections for healthcare workers. Violations of existing provisions related to the licensure and regulation of health facilities and clinics are generally considered a crime, and AB 2575's new requirements would expand the scope of these criminal provisions by placing new obligations on these entities. Furthermore, for instances of retaliation or discrimination against a worker who exercises their professional judgment to override an AI output or relies on employer-approved technology, the bill provides a clear appeal mechanism: the worker is authorized to file a complaint with the Labor Commissioner. This allows for administrative enforcement and potential remedies for workers whose rights under the bill have been violated. The combination of expanded liability for AI-related harm and a clear recourse for workers facing adverse actions underscores AB 2575's commitment to robust accountability and the protection of professional autonomy within the AI-integrated healthcare environment.

Relationship to Other Instruments

California AB 2575 operates within a complex web of existing legal and regulatory instruments governing healthcare and technology. It builds upon and modifies existing state laws, including those related to the licensure and regulation of health facilities and clinics by the State Department of Public Health, and the Medical Practice Act which governs physicians and surgeons through the Medical Board of California. By introducing new requirements for the use of AI and clinical decision support systems (CDSS), AB 2575 effectively amends and supplements these foundational healthcare statutes, ensuring that the integration of advanced technology aligns with established standards of care and patient safety. For example, the bill's requirement for disclaimers on generative AI-generated patient communications pertaining to clinical information expands upon existing transparency obligations within patient care.

Moreover, AB 2575 interacts with general civil liability laws, specifically by adding Section 1714.48 to the Civil Code. This addition directly addresses the liability of developers and deployers of AI and CDSS, preventing them from asserting a defense that a healthcare worker's failure to override an AI output severs their liability for harm. This provision is a crucial modification to traditional tort law principles, designed to allocate responsibility more effectively in the context of AI-driven systems. The bill also adds Article 2.7 to Chapter 2 of Division 3 of the Labor Code, establishing new public policies regarding worker professional judgment and protection from retaliation. This integration into the Labor Code highlights the bill's dual focus on patient safety and worker rights, demonstrating how it weaves new AI-specific regulations into established legal frameworks to create a comprehensive and cohesive regulatory environment for AI in healthcare.

National/Federal Alignment

California AB 2575, while a state-level initiative, aligns with and complements broader national and federal discussions and existing regulations concerning artificial intelligence and healthcare. At the federal level, agencies like the Food and Drug Administration (FDA) have been developing frameworks for the regulation of AI and machine learning in medical devices, particularly focusing on safety and effectiveness. While AB 2575 does not directly regulate medical devices in the same manner as the FDA, its emphasis on transparency, risk disclosure, and accountability for AI tools used in patient care is consistent with the overarching goal of ensuring AI safety and reliability in clinical settings. The bill's provisions for an inventory of clinical decision support systems and disclosure of their characteristics can be seen as a state-level effort to enhance transparency, mirroring federal calls for greater understanding of AI systems' operations and potential biases.

Furthermore, AB 2575's focus on protecting professional judgment and preventing retaliation against healthcare workers for overriding AI outputs resonates with the broader ethical principles being discussed at a national level regarding human oversight in AI systems, especially in high-stakes domains. Federal initiatives and guidelines often stress the importance of human accountability and the augmentation, rather than replacement, of human expertise by AI. The bill also implicitly interacts with federal privacy laws like the Health Insurance Portability and Accountability Act (HIPAA), as the use of AI in healthcare inherently involves the processing of protected health information. While AB 2575 primarily addresses the operational aspects of AI use and liability, its requirements for transparency and responsible deployment contribute to a more secure and ethical environment for handling patient data, thereby indirectly supporting the objectives of federal privacy regulations. By establishing specific state-level safeguards, California is proactively addressing gaps and providing a detailed regulatory model that can inform or interact with future federal AI policies in healthcare.

Implementation Timeline

The legislative timeline for Assembly Bill 2575 includes its introduction on February 20, 2026, Assembly passage on May 27, 2026, and committee reviews through June and July 2026. The bill cleared the Senate Appropriations Committee suspense file on August 13, 2026, was amended on August 28, 2026, and passed the Senate on August 31, 2026. The Assembly concurred in Senate amendments on August 31, 2026, completing legislative passage. The requirement for health facilities to maintain and disclose a CDSS inventory takes effect on July 1, 2027.

Sources and References