What the law actually requires
AB 2013 lives in the Business and Professions Code at section 22757. It requires any developer that makes a generative AI system or service publicly available to Californians to publish a high-level summary of the data the model was trained on. The summary goes on the developer's public website. It has to cover an enumerated list of items: the sources or owners of the training data, whether the data was purchased or licensed, whether it includes personal information, whether it includes copyrighted material, the time periods of collection, and the cleaning and processing steps that were applied.
The law applies to any GenAI system or service made available to Californians on or after January 1, 2022, and the disclosure has to be in place when the system goes out. The California Attorney General enforces. Civil penalties apply.
Who is on the hook, and who is not
AB 2013 regulates AI developers. Not facilities. Your direct compliance obligation under AB 2013 is exactly zero. But the disclosures it forces into the open are exactly the information you need to evaluate any AI vendor that touches clinical data, family communications, or hiring decisions in your building.
Six questions to ask every AI vendor
Put these on your procurement checklist for any AI-touching system. EHR add-ons, ambient scribes, family-portal chatbots, applicant-tracking tools, scheduling optimizers.
- Please share the AB 2013 training-data summary required under California Business and Professions Code section 22757.
- Does the training data include patient health information from any source? If so, what is the consent and de-identification basis?
- Does the training data include copyrighted clinical content, textbooks, or licensed databases? Which?
- When was the training data collected, and when was the model last retrained or fine-tuned?
- What cleaning and bias-mitigation steps were applied to the training data?
- How is your AB 2013 disclosure updated when the model is retrained?
If a vendor cannot answer the first question, they are non-compliant with California law and the conversation is over. If they struggle with the second or third, they are a HIPAA risk you do not need.
Where this connects back to HIPAA
AB 2013 is a California consumer-disclosure law. The information it surfaces, though, feeds your HIPAA Business Associate Agreement diligence directly. If a vendor's training-data summary shows the model was trained on patient health information without a clear consent or de-identification basis, that is a question for your privacy officer before any BAA is signed. The vendors who can show a clean training-data lineage are easier to defend in an audit, easier to defend after a complaint, and easier to renew without redoing diligence each year.
How vendors have responded
Five months in, the large general-purpose providers have all posted AB 2013 disclosures on their developer pages. OpenAI, Anthropic, Google, Microsoft. The healthcare-specific vendors have been slower. Some boutique tools still do not have a published summary as of May 2026. That gap is itself useful information. A vendor that has not figured out AB 2013 six months after the deadline has not figured out California compliance generally, and is not the vendor you want sitting in front of your residents' charts.
Sources
- AB-2013 bill text. Primary statute on leginfo.
- Goodwin: AB 2013 takes effect. Post-effective-date guide.
- Crowell and Moring: pre-effective compliance roadmap.
- Mayer Brown: scope and exemption analysis.
- Baker Botts: practical compliance for developers.
Not legal advice. Verify applicability and current obligations with counsel before adjusting procurement policy.
Want an AI-vendor procurement checklist tailored to skilled nursing?
Talk to us