AB 3030 Does Not Cover Your AI Scribe (Probably)

Vendor sales pitches have been intense since AB 3030 took effect on January 1, 2025. Every digital health company with an LLM somewhere in its product has produced a one-pager about its “AB 3030 compliance posture.” Many of these one-pagers are answering a question the statute does not ask.

AB 3030 governs the use of generative artificial intelligence to generate written or verbal communications to a patient about the patient’s clinical information. Two conditions must hold. The communication has to be generated by GenAI. The communication has to go to the patient. If either fails, AB 3030 does not apply.

The ambient scribe sitting in the exam room recording the visit and producing a draft note is not, on the most natural reading, covered. The note goes into the chart. The patient does not receive it. The draft after-visit summary auto-populated by the EHR’s GenAI feature and reviewed by the clinician before sending — that one is closer to the line, and the closer it gets to “the patient sees what the model wrote,” the more AB 3030 attaches. The portal message drafted by a model and sent under a clinician’s name without human review — that is the case the statute was written for, and no one should be doing it.

This matters because the compliance work the vendors are pushing — disclosure language, watermarks, audit logs — is not where the actual exposure sits. The actual exposure sits in the vendor BAA, which is often quietly thin on training data. It sits in downstream use of model output that ends up in the chart as if a human wrote it. And it sits in the cases where a model has hallucinated a clinical fact a note now asserts. The Medical Board does not need AB 3030 to discipline that. It already has the tools.

We will write up a clean read of the statute and the vendor contracts in a future issue. The contracts are where the work is.