Compliance SweepBack to stories →
← Back to stories
AI & digital healthNew in this edition

AB-1018 Automated decision systems

AB 1018 proposed role-specific automated-decision controls with important health-sector boundaries.

Illustrative artwork. Fictional scene, not a photograph of the people or events in this story.

What happened

The August 28 amended Senate AB 1018 would regulate systems that profile people to make or facilitate consequential decisions, including health care, insurance and employment. Its AI/automated-system definition excludes routine tools and does not cover every generative AI use. HIPAA covered entities doing business in California and business associates’ services to them have a stated exclusion, with exceptions for employment, patient financial assistance and the pre-decision notice duty. FDA-regulated devices and specified regulated research, laboratory and production uses have separate exclusions.

For covered uses, developers would provide use, tuning and technical documentation, while deployers would give pre-decision notice and adverse-outcome explanations under the stated emergency and other exceptions. Deployers with more than 25 employees would provide specified correction and appeal opportunities with 30 business-day processes. The proposal retains applicable privacy and discrimination protections and does not authorize otherwise unlawful uses. It therefore calls for use- and role-specific analysis, rather than treating every hospital AI tool as subject to the same proposed obligations.

Scope and timing

Authority status
Proposed
Applicability
Potentially applicable
Audience
Health systems, Provider networks, Health-tech
Jurisdiction
California

Why it matters

The health-sector exclusions and retained notice carveback materially change which systems and workflows require planning.

Sources

Complete edition and supplemental material

This finding in the complete approved report →

Regulatory horizons, CIA trends and implementation trackers remain in the full report.

Read the entire Compliance Sweep report →

← Return to stories

Privacy preferences

Where enabled for this site, Cloudflare Web Analytics can send page-use and performance measurements to Cloudflare. This panel provides information and does not turn analytics on or off.

This panel stores no tracking choice and does not change your tool saves, screening, resets, reports or exports. Other sites have separate settings.

Read Privacy & Cookies