Skip to content
AI Policy Generator

ESWhat applies

Diagnosis, triage or clinical support in United States (federal): related rules

AI that helps diagnose, prioritize patients, recommend treatments, read medical images or draft clinical notes. Errors affect health, so clinical validation, medical oversight, patient transparency and, if it is a medical device, sanitary registration are required.

Risk classification

JurisdictionLevelDateNote
United States (federal)Sector rules—FDA for AI-enabled device software; Section 1557 (45 CFR 92.210): identify and mitigate discrimination risk in clinical decision support tools since May 1, 2025.
TexasTransparencyJanuary 1, 2026TRAIGA: healthcare providers must disclose AI use in patient care.
CaliforniaTransparencyJanuary 1, 2025AB 3030: disclaimer on AI-generated clinical communications to patients unless reviewed by a clinician.
ColoradoConsequential decisionJanuary 1, 2027SB 26-189: health care is a consequential decision.

Obligations related to this use case

Risk assessment before using ADMT or other high-risk processing

CCPA ADMT and risk assessments11 CCR §§ 7150, 7151, 7152, 7155In force

Applies from January 1, 2026

When it relates
Applies to CCPA-covered businesses (revenue threshold, 100,000 residents or 50% of revenue from selling data) that use ADMT for significant decisions, infer traits of employees, applicants or students through systematic observation, process sensitive data, or train ADMT or facial recognition. Training models on your own data is not enough by itself. For processing that began before 2026 the deadline is December 31, 2027.
What the rule provides
  • Conduct and document the assessment before starting the processing.
  • Describe the specific purpose, data, concrete benefits, negative impacts and safeguards; involve the staff who take part.
  • Have it approved by a person with authority over the processing.
  • Review it at least every three years and update it within 45 days of a material change.
  • Keep it while the processing continues or for five years after completion, whichever is later.
  • For processing that already existed before January 1, 2026, the deadline is December 31, 2027.
Typical evidence
  • Signed, versioned risk assessment
  • List of contributors and approver
Verification
Verified in the official source on November 2, 2026Checked against the approved text published by CalPrivacy (§§ 7150 and 7155).

Submit assessment information to the agency with a signed attestation

CCPA ADMT and risk assessments11 CCR § 7157Adopted, applies later

Applies from April 1, 2028

When it relates
Applies to businesses that conducted risk assessments in 2026 or 2027.
What the rule provides
  • Submit the required information on 2026 and 2027 assessments by April 1, 2028, and every April 1 after that.
  • Include an attestation signed by an executive under penalty of perjury.
  • Provide the full assessment within 30 days if the agency or Attorney General requests it.
Typical evidence
  • Submitted form and confirmation
  • Signed attestation
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§ 7157(a)(1)).

Pre-use notice for ADMT

CCPA ADMT and risk assessments11 CCR §§ 7200(b), 7220Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions on lending, housing, education, employment or health care.
What the rule provides
  • Before using ADMT, explain the specific purpose, the right to opt out or appeal, the right of access, and how the ADMT works.
  • Explain in plain language which data affect the output and how the decision would be made if the person opts out.
  • Uses that began before 2027 must comply by January 1, 2027; new uses from first use.
Typical evidence
  • Published or delivered pre-use notice
Verification
Verified in the official source on November 2, 2026Date checked against the approved text (§ 7200(b)); notice content per § 7220.

Offer an ADMT opt-out or a human appeal

CCPA ADMT and risk assessments11 CCR § 7221Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions.
What the rule provides
  • Offer at least two ways to opt out, without requiring an account.
  • Or, instead, offer an appeal reviewed by a person with authority to change the decision, if the exception's conditions are met.
  • State in the notice which exception you rely on.
Typical evidence
  • Opt-out or appeal form and request log
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§§ 7220 and 7221).

Respond to ADMT access requests

CCPA ADMT and risk assessments11 CCR § 7222Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions.
What the rule provides
  • Explain the specific (not generic) purpose for which ADMT was used about that person.
  • Explain the ADMT's logic, the output produced and how it was used in the decision.
Typical evidence
  • Access response template and response log
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§ 7222).

Proactive disclosure in regulated occupations

Utah AI Policy ActUtah Code § 13-75-103 (según reforma SB 226)In force

Already applicable

When it relates
Applies to Utah-licensed professionals using generative AI in high-risk client interactions.
What the rule provides
  • Disclose before the interaction when AI collects sensitive data or gives personalized financial, legal, medical or mental health advice.
Typical evidence
  • Notice at the start of the interaction
Verification
Pending confirmation in the official source (last checked: November 4, 2026)le.utah.gov refused the connection on Nov 4, 2026, so the official text is still unchecked. The wording after SB 226 still has to be confirmed in Utah Code § 13-75-103, and § 63I-2-213 has to show whether the Jul 1, 2027 repeal also covers what SB 226 added. Content per FPF and Perkins Coie.

Clear consumer notice of ADMT use

Colorado SB 26-189SB 26-189 (C.R.S. 6-1-17xx), obligaciones del deployerAdopted, applies later

Applies from January 1, 2027

When it relates
Applies if you use ADMT that materially influences decisions on employment, housing, health care, education, lending or insurance for Colorado consumers.
What the rule provides
  • Give a clear and conspicuous notice at the point of interaction that ADMT is used.
Typical evidence
  • Published notice and screenshots of interaction points
Verification
Verified in the official source on November 2, 2026Signing, dates and obligations checked on leg.colorado.gov on Nov 2, 2026. Exact content will depend on the Attorney General's rules, still pending.

Explanation within 30 days after an adverse decision

Colorado SB 26-189SB 26-189, obligaciones del deployerAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to ADMT deployers in consequential decisions about Colorado consumers.
What the rule provides
  • Within 30 days of an adverse outcome, explain in plain language the decision and the role of ADMT.
  • Explain how to request information about the system, its data and the rights of correction and review.
Typical evidence
  • Explanation template and delivery log
Verification
Verified in the official source on November 2, 202630-day period checked on leg.colorado.gov; details subject to Attorney General rules.

Data correction and human review

Colorado SB 26-189SB 26-189, derechos del consumidorAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to ADMT deployers in consequential decisions about Colorado consumers.
What the rule provides
  • Let consumers access their personal data and correct inaccurate data.
  • Offer meaningful human review and reconsideration after an adverse outcome, by a trained person with authority to change it.
Typical evidence
  • Review procedure and log of requests and outcomes
Verification
Verified in the official source on November 2, 2026Checked on leg.colorado.gov.

Developer technical documentation for deployers

Colorado SB 26-189SB 26-189, obligaciones del desarrolladorAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to those who develop or sell ADMT used in consequential decisions about Colorado consumers. Selling an AI product is not enough: in the assessment, select the type of decision your product supports.
What the rule provides
  • Give each deployer documentation on intended uses, training data categories, known limitations and instructions for use and human review.
  • Notify deployers of material updates.
Typical evidence
  • Delivered technical documentation and version log
Related base documents
Verification
Verified in the official source on November 2, 2026Checked on leg.colorado.gov.

Keep compliance records for three years

Colorado SB 26-189SB 26-189, conservación de registrosAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to developers and deployers covered by the law.
What the rule provides
  • Keep records showing compliance for at least three years, with version identifiers.
Typical evidence
  • Decision log and system version log
Related base documents
Verification
Verified in the official source on November 2, 2026Three-year period checked on leg.colorado.gov.

Related base documents

Related kits

Includes 5 documents

Healthcare Kit

Technical and clinical validation, DPIA for health data, clinician oversight, in-use monitoring and a model card for clinical AI tools.

USD 139USD 215

Complete kit · available to buy

Find out what applies to you (free)United States (federal)