California decided four artificial intelligence bills in three days. Two are written for large companies and licensed facilities. One would have covered everybody, and it was vetoed. The fourth asks only what your tool is advertised to do and what it knows about the person using it. That is the one that reaches a practice of one.
Signal 1
California signed a law that treats a wellness chatbot as a health care provider
On September 30 the Governor of California signed AB 1979. It is now Chapter 854. Part of it changes the Confidentiality of Medical Information Act. That is the state law controlling what a health care provider may do with a person's medical information. Under the change, a business that offers a health care chatbot to a consumer is treated as a provider of health care under that law. It applies when the chatbot is offered for the diagnosis, treatment or management of a medical condition, or to let the person manage their own health information. The law then says what a health care chatbot is. It is an artificial intelligence system with a natural language interface, meaning a person talks or types to it in ordinary words. It gives adaptive, human-like responses. It is marketed as facilitating or supporting health services to a consumer. And it uses information about that consumer's physical or mental health or wellness, whether the person types it in, allows access to it, or the system works it out on its own. Breaking the law in a way that causes economic loss or personal injury is a misdemeanor. A separate part of the same bill applies only to health facilities, clinics and physician offices.
Sources: AB 1979, Chapter 854, chaptered text, California Legislative Information, September 30, 2026 | Healthcare IT News, Andrea Fox, October 1, 2026
What this means for you
Look at what each half of this law asks about. The half written for clinics asks who holds a license, and what a licensed person is allowed to hand to a machine. The chatbot half asks two different questions. How is the tool advertised, and what does it learn about the person using it. The word wellness sits inside that second question. Nothing in it asks what the business is called, what the owner studied, or whether any board has ever heard of the practice. So in California two ordinary things now decide whether you are treated as a health care provider. The sentence on your website that says what your tool does, and the information that tool collects. A quiz that answers back. An intake form that asks follow-up questions. An assistant you built on your own materials. If it is described as supporting health, and it holds what a client tells it, that information is medical information under a law carrying a misdemeanor. California bills passed this year normally take effect on January 1, 2027.
Signal 2
The bill that would have limited AI in therapy was vetoed the same day
The same day, the Governor vetoed SB 903. That bill did two separate things. It would have banned companion chatbots from providing psychotherapy. A companion chatbot is a system built to hold an ongoing, personal conversation with someone. The bill also would have limited how licensed professionals use artificial intelligence when they provide psychotherapy. The veto message gives three reasons. The bill is overly broad. It would drastically limit a clinician's use of tools that help care today, including by requiring routine screening decisions to receive direct approval. And the definition of psychotherapy services is poorly crafted, because it would capture general-purpose AI systems that were never built or deployed to deliver that care. He asked the author and other interested parties to return to the question next year. The same day he vetoed AB 2575, which would have stopped AI developers and health providers from arguing in court that a clinician failed to override what the AI said.
Sources: Veto message, Senate Bill 903, Office of the Governor of California, September 30, 2026 | Legislative update, Office of the Governor of California, September 30, 2026
What this means for you
Read who the argument was about. The bill had two halves and only one of them was discussed. The veto message talks about clinicians throughout: their tools, their screening decisions, their professional judgment, their capacity to see more patients. The half that would have reached a person with no license, running a chatbot that talks to people about their mental health, is never mentioned. It was not argued over and defeated. Nobody in the room was arguing about it. That leaves California in an odd position. There is now a signed rule about who is responsible for the data a mental wellness chatbot collects. There is no rule about what that chatbot is allowed to say. A coach running one sits inside the privacy law and outside every limit on the conversation itself. The Governor said the question comes back next year.
Signal 3
A chatbot honesty rule arrived, and it covers only very large companies
On September 28 the Governor signed AB 1609, now Chapter 733. A large private business may not represent that a customer service chatbot is a human. If a reasonable person would be misled into thinking they are talking to a person, the business has to say clearly and conspicuously that the chatbot is artificially generated. The same law requires a way to reach a human agent during business hours, with a good faith effort to connect within fifteen minutes or to book a specific time within one business day. A public prosecutor can enforce it. Penalties run up to five thousand dollars for a first violation and ten thousand for each one after. The law defines a large private business as one with more than five hundred million dollars in gross annual revenue nationally. Hospital communications are exempt, as are internal business lines and consumer reporting agencies. Almost no health practice in the country is covered.
Sources: AB 1609, Chapter 733, chaptered text, California Legislative Information, September 28, 2026 | Healthcare IT News, Andrea Fox, October 1, 2026
What this means for you
This is an enterprise rule and it is still worth reading, because of the definition it uses. A customer service chatbot is an artificial intelligence system with a natural language interface that gives adaptive, human-like responses. That is word for word how AB 1979 opens its definition of a health care chatbot. California has settled on one description of what a chatbot is and is reusing it across different laws. What changes between the laws is the test for who gets caught. A revenue number in one. A marketing claim in the other. A revenue threshold is the part of a law most likely to move later. Once a duty is written for companies above five hundred million dollars, the principle has been accepted and the only argument left is where the line goes. There is also a nearer effect that does not require any change in the law. This rule teaches people in California that a business is supposed to tell them when they are talking to a machine, and that they are entitled to reach a human being. Clients bring that expectation to small practices too.
Signal 4
Vendors of clinical AI now have to hand over a document describing how it was built
The Governor signed SB 503 the same day, now Chapter 857. It covers clinical decision support systems. That is the law's term for an AI system producing a prediction, classification, recommendation, evaluation or analysis that helps decide the timing of care, a diagnosis or a treatment. Appointment booking, reminders and payment processing are excluded. The duties fall on two parties. Developers, meaning whoever builds or substantially modifies the system. And deployers, which the law defines as a health facility, clinic, physician's office or office of a group practice that uses one. Developers have to make reasonable efforts to find and reduce the risk of biased impacts, meaning harm to someone because of a protected characteristic. Developers also have to give deployers a written package. It covers what kind of data the system was trained on and how representative that data was, how the system was tested for performance and limits, the intended benefits and expected outputs, the known risks, and recommendations for how to use and monitor it. The package has to be available on request or at the time of sale, whichever comes first, and again when the system materially changes. Deployers have to monitor the system and take proportionate steps when they find a problem.
Sources: SB 503, Chapter 857, chaptered text, California Legislative Information, September 30, 2026 | Healthcare IT News, Andrea Fox, October 1, 2026
What this means for you
You are not a deployer under this law. The definition stops at facilities, clinics and physician offices. The useful part is not who it binds, it is what it creates. Until now, if you asked a vendor what their AI was trained on and how it was tested, there was no document the answer had to live in. Now there is one, and California has listed what belongs in it. So a document that did not exist in September exists in California now, and a solo practice is not on the list of people entitled to receive it. The information is written down. The right to be handed it went to organizations that have compliance staff. That is the difference between being governed and being left out of the paperwork, and it is worth knowing which one you are.
The Pattern
California made four decisions about AI in health in three days. Look at how each one decides who it covers. AB 1609 uses a revenue number. SB 503 uses a list of facility types. SB 903 would have covered everyone and was vetoed after an argument about clinicians. AB 1979 uses neither a size nor a license. It asks what the tool is sold as, and what it knows. That is the one that reaches a practice of one. The lesson is not that California is coming for health coaches. It is that the rules which land on practitioners nobody regulates do not arrive through a practice act, because there is no practice act to amend. They arrive through privacy law, consumer protection and the rules about how you advertise. Nobody will write to tell you, because no board holds your address. The obligation starts the moment you put a tool in front of a person and describe it as helping with their health.
What To Watch
SB 903 comes back. The veto message asks the author and other interested parties to return to the question next year, and the argument will be about the definition of psychotherapy services, which is what decides whether a wellness chatbot discussing somebody's mood sits inside the rule or outside it. California wording gets copied by other states, so the sentence written in Sacramento in 2027 is likely to be the sentence that reaches you wherever you practice. Source: veto message, Senate Bill 903, Office of the Governor of California, September 30, 2026, https://www.gov.ca.gov/wp-content/uploads/2026/09/VETO-msg-SB-903.pdf. HTI-5 is still unpublished. The federal rule known as HTI-5, RIN 0955-AA09, was proposed on December 29, 2025 with comments closing February 27, 2026, and it would remove more than half of the certification requirements that certified health records software has to meet, including transparency about AI features; checked again this week, the final rule has not appeared. If it lands as proposed, the standard vendor disclosure in American health technology gets smaller in the same season California wrote a new one, which means documentation duties in this field are not moving in a single direction. Source: Federal Register, December 29, 2025, https://www.federalregister.gov/documents/2025/12/29/2025-23896/health-data-technology-and-interoperability-astponc-deregulatory-actions-to-unleash-prosperity.
One Thing You Can Do This Week
Pick the one AI tool that touches the most client information in your practice, and email the vendor asking for their documentation. Use plain words. Ask what data the system was trained on, how it was tested, what it is not meant to be used for, and what problems they already know about. California now requires that exact package to exist for clinical tools, so for a lot of vendors the document is already written and sitting with their sales team. You are not legally entitled to it. Ask anyway, and write down what comes back, including silence. A vendor who sends it in a week and a vendor who cannot answer in a month are telling you two different things, and you can act on that long before any rule reaches you.