California Bans AI Pretending to Be Your Doctor Now

California’s AB 489 draws a hard line between human clinicians and AI-generated medical advice. Signed into law on 11 October 2025, it’s the most significant state-level move yet on this issue. I’ve watched this space for a decade, so that’s not a statement I make lightly.

California isn’t acting alone, though. Texas, New York, and federal agencies are all racing to regulate AI in healthcare at the same time. So AI vendors, hospital systems, and telehealth platforms are staring down a patchwork of rules that gets messier every month. This guide breaks down what AB 489 actually changed, how other states compare, and what compliance looks like in practice, not just in theory.

How AB 489 Bans AI From Pretending to Be a Doctor

AB 489 targets a specific, very human problem. Patients often don’t know whether they’re talking to a person or a machine. That uncertainty has real consequences when the topic is their health.

The problem AB 489 was built to solve

AB 489 extends protected healthcare-title rules to AI developers and deployers. Its focus is misleading professional attribution in advertising or functionality, not a universal disclosure before every patient interaction. The Board of Psychology advisory confirms that the law became operative on 1 January 2026. Legal scope and enforcement corrections below were checked on 16 September 2026.

Picture a common scenario. A patient logs into a telehealth portal after hours, types in some symptoms, and gets a detailed, reassuring reply that reads exactly like something a physician would write. The tone is warm. The phrasing sounds clinical. Nowhere on the screen does it say “AI.” That patient might follow that guidance anyway — adjusting a medication dose, delaying an ER visit, or skipping a follow-up — based on something a licensed human never actually wrote. AB 489 exists precisely to prevent that moment of misplaced trust.

What the law actually requires

• Do not use protected terms to imply an unheld healthcare licence in AI advertising or functionality.
• Do not imply that AI-delivered care, advice, reports or assessments come from an appropriately licensed natural person.
• Review both developers’ and deployers’ responsibilities under the enacted text.
• The appropriate healthcare licensing board or enforcement agency has jurisdiction.
• Assess any separate patient-communication disclosure and human-contact rules under the laws that actually create them; AB 489 alone is not the whole framework.

The law doesn’t ban AI from healthcare, and that distinction matters. It bans deception, not the technology itself. AI tools can still triage patients, suggest diagnoses, and support clinical decisions. They just can’t do it while pretending to be Dr. Smith from internal medicine.

Review live chats, emails, voice calls and other channels for misleading professional attribution. The medium does not remove that risk. A disclosure label alone should not be treated as permission for otherwise prohibited representations.

Enforcement belongs to the appropriate healthcare licensing board or enforcement agency. Boards can pursue injunctions or restraining orders, and existing remedies remain available. Each prohibited use is a separate violation; the statute does not set the fixed-dollar schedule previously stated here.

How Other States Compare to AB 489 on Healthcare AI

Other states use different mechanisms. The comparison below separates enacted duties from proposals; it is not a substitute for checking the rules governing a particular product or professional practice. Related reading: California moved first.

Texas, New York, and the softer-touch states

Texas enacted HB 149, the Texas Responsible Artificial Intelligence Governance Act. Section 552.052(c) requires the specified disclosure when AI is used in relation to health care service or treatment, no later than when that service or treatment is first provided, with an emergency exception. This is not merely a requirement to label a patient record. See the enrolled HB 149 text.

New York proposals must be identified individually. S8484 addresses AI in therapy or psychotherapy and includes informed-consent provisions for the specified supplementary uses. The cited proposal does not establish a universal enacted requirement for third-party bias and accuracy audits of clinical AI. Check its current legislative status before treating a proposal as law.

Colorado’s original SB 24-205 framework was replaced by SB26-189. The Colorado Attorney General identifies 1 January 2027 as the replacement provisions’ start. Healthcare decisions can fall within its scope, but applicability requires checking the current definitions and exemptions.

The scale of the patchwork

California AB 489 concerns misleading representations of licensed healthcare professionals. Texas HB 149 includes a healthcare-related AI disclosure provision. Colorado’s replacement ADMT provisions have a separately stated timetable, and New York proposals have their own scope and legislative status. These provisions should not be collapsed into a single disclosure-plus-audit checklist.

This is exactly why “fifty states, fifty AI laws” isn’t an exaggeration. Vendors building healthcare AI products need state-by-state compliance strategies, because a chatbot that’s perfectly legal in Texas might violate AB 489 without significant changes — and that’s a painful thing to discover after launch.

Where Federal FDA Rules Meet AB 489

While states pass their own rules, the federal government isn’t sitting idle either. The FDA has been expanding its oversight of AI-enabled medical devices for years. But the FDA’s framework and state laws like AB 489 address genuinely different concerns, and understanding that distinction is the real key here.

Two different questions, one compliance burden

The FDA asks whether an AI tool actually works safely and effectively. AB 489 addresses misleading licensed-healthcare representations in AI advertising and functionality. These frameworks don’t conflict. They stack.

An AI diagnostic tool might need FDA clearance as a Software as a Medical Device and also comply with AB 489’s protected-title and misrepresentation prohibitions. It might need to satisfy HIPAA’s data-handling rules on top of that. The compliance burden adds up fast. A mid-sized telehealth company deploying an AI symptom checker could be navigating FDA classification, AB 489 protected-title and misrepresentation prohibitions, HIPAA’s minimum-necessary standard, and CMS billing rules all at once, if any AI-assisted service triggers a reimbursement claim. Each layer has its own paperwork, timeline, and enforcement body.

Federal touchpoints worth knowing include

• FDA premarket review for AI and machine-learning medical devices, with over 950 authorized as of early 2025;
• transparency requirements from the Office of the National Coordinator for certified health IT;
• CMS billing rules for AI-assisted services;
• and FTC enforcement against deceptive AI marketing in healthcare.

Federal preemption doesn’t apply here in most cases. The FDA hasn’t signaled any intent to override state transparency laws, so compliance with AB 489 stays necessary even for FDA-cleared devices. This dual-layer system adds real complexity, but it also creates stronger patient protections, which is ultimately the point. The Biden administration’s October 2023 Executive Order on AI Safety directed HHS to develop healthcare AI safety guidelines, and those guidelines reinforce many of the same transparency principles behind AB 489. For now, at least, the federal and state signals point in the same direction.

A Compliance Checklist for AB 489 and Beyond

Whether you’re building healthcare AI tools or deploying them in a clinical setting, compliance with AB 489 isn’t optional. I’ve talked to enough legal teams at health tech companies to know that “we’ll figure it out later” isn’t a strategy.

What vendors and developers need to do

• Set up clear, upfront AI disclosure in every patient-facing interface
• Add a persistent visual indicator, like a badge or banner, showing AI involvement
• Build a “request human” escalation path into every patient interaction flow
• Document your disclosure mechanism for regulatory review
• Test your disclosure language for readability at a sixth-grade reading level or below
• Maintain audit logs of all AI-patient interactions with timestamps
• Review your product against each state’s specific requirements before launch
• Check the American Medical Association’s AI policy guidance for clinical best practices along the way

For the checklists above, distinguish recommended interface controls from statutory duties. Readability testing, persistent AI indicators and escalation routes may improve usability; the sample wording is not a legal safe harbour. Psychology practitioners should also follow the Board’s guidance on transparent attribution and professional review.

What healthcare providers need to do

• Audit every current AI tool for AB 489 compliance
• Update patient intake forms to include disclosure language
• Train staff on when and how AI tools interact with patients
• Set up a patient complaint process specifically for AI-related concerns
• Review vendor contracts for indemnification clauses covering transparency violations
• Monitor state legislative updates every quarter.

That vendor contract review deserves particular attention. Many health systems are running AI tools under contracts written before AB 489 existed, which means indemnification language almost certainly doesn’t address transparency violations at all. If a vendor’s chatbot generates a non-compliant interaction, you want clarity in writing about who bears the liability before a regulator asks the same question.

Vendors operating across states should map each product feature to the applicable enacted law and professional-board rule, record the effective date, and distinguish that law from pending proposals. California compliance does not automatically establish compliance elsewhere.

Penalties and Enforcement Under AB 489

Laws without teeth don’t change behavior. So does AB 489 have teeth? Mostly, yes.

What the fines actually look like

• AB 489 does not state a standalone $2,500 first-incident penalty.
• It does not state a standalone $7,500 repeat-incident penalty.
• Consult the relevant professional law and regulator for available remedies; AB 489 does not expressly create a new private right of action.

The earlier $375 million illustration relied on an unsupported fine schedule and should not be used. Legal exposure depends on the applicable professional law, facts and available remedies; multiplying every patient interaction by a claimed fixed fine is not a reliable assessment.

Where enforcement stands right now

For California AB 489, refer to the corrected board/agency enforcement explanation above. Do not infer other states’ enforcement arrangements from this statute. The cross-state penalty comparison requires separate verification.

Enforcement risk should be assessed using the applicable professional laws and actual enforcement records. This article does not establish a current count of AB 489 cases or predict when a first major case will occur.

A missing disclosure, misleading attribution and unlawful protected-title use are not interchangeable facts. This article should not characterize AB 489 as imposing automatic strict liability for every accidental nondisclosure; assess the actual representation and applicable professional law.

How AB 489 Fits the Bigger 50-State AI Law Picture

AB 489 is one piece of a much larger regulatory puzzle. States are addressing AI across healthcare, employment, housing, and criminal justice, and healthcare is moving fastest because the stakes are highest.

Three challenges this creates for vendors

• Compliance fragmentation means no single product configuration satisfies every state at once.
• Update velocity means new bills pass monthly, requiring constant monitoring rather than a one-time review.
• And definitional inconsistency means states define “AI,” “healthcare,” and “disclosure” differently from each other.

Definitions still matter. AB 489 incorporates statutory AI and generative-AI definitions. Colorado now uses the replacement ADMT framework. A vendor should check the applicable text instead of assuming the same product classification across jurisdictions.

Building to the strictest standard

Cross-border deployment requires a separate applicability assessment for each jurisdiction. Some medical AI systems can fall within the EU AI Act’s high-risk framework, but scope, exemptions and application dates matter. Compliance with one state’s disclosure or professional-title rules should not be assumed to satisfy another state or the EU.

Some vendors instead geo-fence their products, deploying different configurations based on the user’s state. That works technically, but it creates maintenance headaches and audit complexity that compound over time. It also raises a question nobody’s fully answered yet: if a patient travels across state lines and accesses a telehealth platform configured for their home state, whose rules apply? Regulators haven’t weighed in definitively.

AB 489 has set a template other states are actively following. Treating it as the baseline, not the ceiling, is the smartest compliance strategy available right now.

Frequently Asked Questions About AB 489