Compliance SweepBack to stories →
← Back to stories

SB 503 adds clinical decision-support bias duties

SB 503 assigns reasonable bias-identification and mitigation duties to developers and users of covered clinical decision support. Developers must provide usable risk and performance information, and deployers must monitor; the conditional internal-use documentation exception preserves those other responsibilities.

What happened

California enacted SB 503 on September 30 as Chapter 857. Business and Professions Code section 22758 requires developers and deployers to make reasonable efforts to identify covered clinical decision support with known or reasonably foreseeable biased-impact risk. Developers must make reasonable mitigation efforts and provide an intended-use and risk statement plus documentation addressing training data, available demographic representativeness, performance evaluation, limitations, data governance, outputs, and monitoring recommendations. The information is due on request or initial sale, whichever is earlier, and as applicable with material updates.

Deployers must regularly monitor identified systems and take reasonable, proportionate mitigation steps. An entity serving both roles need not generate the specified documentation for internal use when consistent information is readily available, but that exception does not erase the statement, monitoring, or mitigation duties. Covered tools aid clinical timing, diagnosis, or treatment; specified scheduling, education, preparation, and payment activities are excluded to the extent their independent performance requires no professional license. Compliance supplements other AI laws and is expressly unavailable as a defense to unlawful-discrimination claims.

Scope and timing

Authority status
Final
Applicability
Potentially applicable
Audience
Health systems, Provider networks, Health-tech
Jurisdiction
California
Recorded date
2027-01-01
Date type
effective

Why it matters

Deployment teams need usable vendor evidence and monitoring controls.

Sources

Complete edition and supplemental material

This finding in the complete approved report →

Regulatory horizons, CIA trends and implementation trackers remain in the full report.

Read the entire Compliance Sweep report →

← Return to stories

Privacy preferences

Where enabled for this site, Cloudflare Web Analytics can send page-use and performance measurements to Cloudflare. This panel provides information and does not turn analytics on or off.

This panel stores no tracking choice and does not change your tool saves, screening, resets, reports or exports. Other sites have separate settings.

Read Privacy & Cookies