California AB 489 restricts misleading healthcare-professional identity claims in AI advertising and functionality. Review how your product describes itself and represents the source of care, advice, reports, and assessments.
Updated September 11, 2026. This page corrects our earlier description of AB 489 as a broad healthcare AI governance law. It is educational information, not legal advice; have qualified counsel assess your deployment and other applicable laws.
AB 489 added Business and Professions Code sections 4999.8 and 4999.9. It addresses language falsely implying that AI is a licensed healthcare professional or that covered services come from a licensed natural person. It applies to developers and deployers. The appropriate licensing board or enforcement agency can seek injunctive relief; each prohibited use can be a separate violation. Read the official enacted AB 489 text.
The enacted provisions do not establish the six-part governance program, universal seven-year audit retention rule, or blanket $2,500-per-violation penalty previously claimed on this page. They do not make an execution receipt a compliance certificate. Other healthcare, privacy, licensing, and AI rules may impose separate obligations.
The following is a practical review workflow, not a list of additional statutory requirements. Assign a product owner to collect evidence and a legal reviewer to decide what changes are necessary.
Consider a hypothetical clinic assistant whose authorized function is finding appointment availability. Its interface should accurately explain that role. If a user asks it to act as their physician, the response should not invent a professional identity. If it offers a clinician handoff, the application should distinguish a request for review from a completed review.
A useful acceptance test records the prompt, displayed reply, tool calls, template version, and whether any human actually reviewed the interaction. A correct label on the homepage alone does not show that generated replies or exported reports are consistent with that label.
Runtime controls can enforce your chosen operational limits: for example, allow appointment lookup while withholding permission to publish a report under a clinician's identity unless the required review is recorded. These are deployment policies to design and validate; they are not automatic legal conclusions.
ExecLayer focuses on authorization for actions. It does not determine whether every sentence is legally adequate or medically correct. Pair action controls with product-language review, output testing, appropriate professional oversight, and counsel's assessment. An authenticated approval records an authorization event, not proof of clinical quality.
Keep the approved interface wording, test cases, responsible reviewers, release version, and any relevant authorization records. Select retention and access controls according to your actual obligations and privacy requirements; do not collect patient information simply to populate an audit trail.
Explore healthcare workflow controls, runtime policy gating, and the incident response playbook for the engineering side of a governed deployment.
No. This article focuses on misleading professional-identity representations. A broader governance program may be appropriate, but its requirements must be mapped to the laws and risks actually applicable.
No. A receipt can support a review of a specific authorization event. Legal compliance also depends on the product's representations, implementation, and applicable obligations.
Review the assistant's identity, advertising, generated responses, report labels, and clinician handoff language. Confirm that statements about licensed human participation match what actually happens.
How governance fits agent orchestration ยท Discuss your execution boundary