There's a headline going around that California now requires businesses to get their AI audited. It's made a lot of practice owners nervous, and it's mostly a misread. The reality is narrower and more useful than the panic, so let me lay out what actually applies to a practice, and what doesn't.
Start with what doesn't. The bills people point to when they say "AI audit law," California's move to license and register the people who perform AI audits, are setting up who is allowed to run those audits once some other law requires one, with the registries phasing in around 2028 and 2029. If you're using ChatGPT or a scheduling tool built on top of it, those bills almost certainly don't require you to do anything directly right now.
What does reach a practice is the transparency and decision-making side. California is tightening the rules on using automated systems to make or heavily influence significant decisions, and it specifically names healthcare and employment among the high-stakes categories. In plain terms: if you're using AI to help decide something consequential about a patient or a staff member, the direction of the law is clear. You need to disclose that AI is involved, be able to explain how the decision is reached, and keep records showing you did. Several of these obligations are phasing in through 2026 and into 2027.
For most aesthetic practices, that lands in two places. Anything where AI touches a patient-facing decision, and hiring, where AI screening tools are common and squarely in scope. The practical response isn't complicated, and it's worth doing before you're asked to prove it: inventory every place AI touches a consequential decision, add plain-language disclosure where it does, document how those systems work, and keep the records. Regulators are increasingly treating the absence of documentation as a problem on its own.
I want to be careful here, because this is exactly the kind of thing where general information stops and legal advice begins, and I don't cross that line. The laws are moving, the details depend on your size and how you use these tools, and the penalties are real. This is where you want a healthcare attorney who understands the AI nuances, not a general practitioner guessing. If you'd like names, I keep a short list of attorneys I trust in this space. Email me at audrey@theaudreyaesthetic.com and I'll send them over.
Frequently asked questions
Does California require aesthetic practices to get their AI audited?
Not directly, for most. The AI auditor-registration laws are setting up who can perform audits that other rules may require later, phasing in around 2028 to 2029. The rules that reach practices now are about disclosure and documentation, not mandatory audits.
What should a practice do to prepare for California's AI rules?
Inventory where AI touches consequential patient or staffing decisions, disclose that AI is involved, document how the systems work, and keep records. Then confirm specifics with a healthcare attorney who understands AI.
The Audrey Aesthetic | theaudreyaesthetic.com
© Audrey Campbell 2026