SB 503 adds clinical decision-support bias duties
Oct 4, 2026 edition · GC-2026-0216 · Published 2026-10-04 · Version 2 · Final
California enacted separate developer and healthcare deployer duties for clinical decision support systems with known or reasonably foreseeable bias risks. The final law links vendor documentation to continuing monitoring and mitigation, while defining excluded administrative functions and a narrow internal-use documentation exception.
What happened
California enacted SB 503 on September 30, adding Business and Professions Code section 22758 for artificial intelligence systems that aid clinical decisions about timing of care, diagnosis or treatment. Developers and deployers must make reasonable efforts to identify covered systems with known or reasonably foreseeable risks of biased impacts in health programs or activities. Developers must make reasonable efforts to mitigate those risks and give deployers intended-use and risk statements, high-level descriptions of training data and demographic representativeness when available, performance and bias evaluations, data-governance information, expected outputs, and recommendations for use, monitoring and mitigation. The required documentation must be available on request or at initial sale, whichever comes first, and as applicable with material updates. The enactment is the event reported here; the applicable commencement of these provisions must be confirmed separately.
The law assigns deployers a continuing duty to monitor identified systems regularly and take reasonable and proportionate mitigation steps. A health facility, clinic, physician office or group-practice office using a covered system is a deployer, and an organization can be both developer and deployer. An internally developed and deployed system qualifies for the documentation exception only when information consistent with the specified documentation requirements is readily available to that deployer; the exception does not remove the monitoring duty. The definition excludes listed administrative functions, including appointment management, patient education and payment processing, to the extent their independent performance does not require a professional license. Biased impact includes adverse effects on access, care quality or outcomes based on protected characteristics, and compliance is not a defense to unlawful discrimination.
Scope and timing
- Authority status
- Final
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
Why it matters
The law connects procurement evidence with the way a clinical tool performs after deployment. A vendor statement alone does not address the deployer’s regular monitoring duty, and an internal build is not automatically exempt. Clinical governance, procurement and technology teams need a shared view of which tools affect care and who can investigate unequal effects on patients.
Recommended action
Confirm the applicable commencement before treating the new provisions as current duties. Prepare the following for implementation at that commencement: Inventory tools that influence timing of care, diagnosis or treatment and document the basis for exclusions. Obtain the required developer material, including update notices, and assign an owner for regular bias monitoring and proportionate mitigation. For internal tools, record where equivalent documentation is readily available; review other applicable discrimination and AI duties separately.
Sources
- SB503 enacted final textOfficial · California Legislature · 2026-09-30 · Source review 2026-10-05
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →