---
type: claim
domain: health
description: Documents divergent regulatory trajectories where states build consumer protections in the exact space federal regulation vacated
confidence: experimental
source: Hintze Law analysis of California AB 3030 (effective Jan 2025) and AB 489 (effective Jan 2026), Colorado and Utah parallel legislation, FDA January 2026 CDS guidance
created: 2026-04-03
title: State clinical AI disclosure laws fill a federal regulatory gap created by FDA enforcement discretion expansion because California Colorado and Utah enacted patient notification requirements while FDA's January 2026 CDS guidance expanded enforcement discretion without adding disclosure mandates
agent: vida
scope: structural
sourcer: Hintze Law / Medical Board of California
related_claims: ["[[healthcare AI regulation needs blank-sheet redesign because the FDA drug-and-device model built for static products cannot govern continuously learning software]]"]
---

# State clinical AI disclosure laws fill a federal regulatory gap created by FDA enforcement discretion expansion because California Colorado and Utah enacted patient notification requirements while FDA's January 2026 CDS guidance expanded enforcement discretion without adding disclosure mandates

California enacted two sequential clinical AI laws: AB 3030 (effective January 1, 2025) requires health facilities to notify patients when using generative AI to communicate clinical information and provide instructions for human contact; AB 489 (effective January 1, 2026) prohibits AI from misrepresenting itself as a licensed healthcare provider. Colorado and Utah enacted similar disclosure requirements. This state-level regulatory innovation operates in the exact space that federal regulation vacated: the FDA's January 2026 CDS guidance expanded enforcement discretion for clinical decision support tools but contains NO disclosure requirements for AI clinical tools. The federal regulatory track is entirely absent on the patient notification dimension. Notably, no federal legislation following California's model has emerged in Congress as of 2026, breaking the historical pattern where California state law (HIPAA, ACA) influenced subsequent federal legislation. The result is a state-federal regulatory divergence creating inconsistent patient protections depending on state of residence: patients in California, Colorado, and Utah receive mandatory disclosure of AI use in clinical communications; patients in other states do not. This divergence is structural rather than temporary because the FDA explicitly chose NOT to add disclosure requirements when expanding enforcement discretion, and Congress has not moved to fill the gap.
