Compliance SweepBack to stories →
← Back to stories

AB-1018 Automated decision systems

AB 1018 remains proposed in the retained official record, with no enacted compliance deadline established here. Its automated-decision framework includes a material HIPAA covered-entity and business-associate exemption, while retaining specified employment, patient-financial-assistance, and notice requirements within the proposal's scope.

What happened

The official AB 1018 history retained for the October 11 edition ends with the August 30 action reading the bill a second time and ordering it to third reading. The displayed text is the August 28 Senate-amended proposal, without an enrollment or chapter action in that history. The proposal would regulate automated systems that profile people to make or facilitate consequential decisions, with health care, health insurance, employment, government benefits, and other listed services within its scope. The definition targets simplified outputs such as scores, classifications, or recommendations that assist or replace human discretion and materially affect people.

The proposal generally exempts HIPAA-regulated covered entities doing business in California and their business associates for services rendered to those entities. That exemption does not cover employment or employment-opportunity decisions, patient eligibility for financial assistance including discounted care, or the requirements of section 22756.2(a), which concern notice before a decision is finalized. Where applicable, developers would supply approved-use instructions and technical information, while deployers would provide notices and adverse-outcome information; deployers with more than 25 employees would provide the specified correction and appeal opportunities. The notice provisions have medical-emergency exceptions. Other exclusions address FDA-overseen devices and research and specified laboratory and manufacturing uses. These are proposed controls and exceptions, and do not displace restrictions under existing laws.

Scope and timing

Authority status
Proposed
Applicability
Potentially applicable
Audience
Health systems, Provider networks, Health-tech
Jurisdiction
California

Why it matters

Organizations outside the proposal's healthcare exemption, and covered entities making employment or patient-financial-assistance decisions, may face notice, explanation, correction, appeal, and documentation duties if it is enacted. The specified predecision notice provision also remains outside that exemption. Final definitions, exclusions, and thresholds would control applicability.

Sources

Complete edition and supplemental material

This finding in the complete approved report →

Regulatory horizons, CIA trends and implementation trackers remain in the full report.

Read the entire Compliance Sweep report →

← Return to stories

Privacy preferences

Where enabled for this site, Cloudflare Web Analytics can send page-use and performance measurements to Cloudflare. This panel provides information and does not turn analytics on or off.

This panel stores no tracking choice and does not change your tool saves, screening, resets, reports or exports. Other sites have separate settings.

Read Privacy & Cookies