AB-1018 Automated decision systems
Sep 27, 2026 edition · GC-2026-0059 · Published 2026-09-27 · Version 2 · Proposed
AB 1018 remained a proposal to regulate consequential automated decisions, with distinct developer and deployer duties.
What happened
AB 1018’s retained proposal would regulate covered automated decision systems that profile people to make or facilitate consequential decisions. Its definition reaches machine learning, statistical modeling, data analytics, or AI that produces a score, classification, recommendation, or similar simplified output with a material effect on people. Consequential decisions include health care and health insurance, alongside employment, education, housing, financial services and other listed areas. The text excludes routine tools such as spam filters, firewalls, calculators and databases, and does not make every generative AI application a covered profiling system. The exclusion for HIPAA covered entities doing business in California and business associates’ services to those entities retains exceptions for employment, patient financial assistance and the pre-decision notice requirement. FDA-regulated devices and specified regulated research, laboratory and production uses have separate exclusions.
Developers would supply use instructions, fine-tuning information and technical documentation to deployers, with a specified financial-services exception. Deployers would provide notice before finalizing a decision, subject to the medical-emergency exception, and a written explanation within 30 days after an adverse outcome, with emergency and specified résumé-sorting exceptions. For deployers with more than 25 employees, the proposal provides correction and appeal opportunities within 30 business days, followed by specified review and response procedures. Implementation of these proposed controls would depend on enactment and the applicable commencement provisions.
Scope and timing
- Authority status
- Proposed
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
Why it matters
The profiling definition, health-sector exclusions, retained notice requirement and role-specific duties determine applicability; a generic inventory of every AI tool would overstate the proposal’s reach.
Recommended action
Monitor the legislative record and any final enactment. Inventory consequential profiling uses, distinguish developer from deployer roles, and assess notice and appeal workflows against the final applicable text before implementing new duties.
Sources
- AB-1018 Automated decision systems, bill historyOfficial · California Legislature · 2026-08-30 · Source review 2026-09-10
- AB-1018 Automated decision systems, current bill text (08/28/26 - Amended Senate)Official · California Legislature · 2026-08-28 · Source review 2026-09-10
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →