By Sagar Shankaran, Founder of CallSphere
Texas TRAIGA, California AB 3030 and the 2 August EU AI Act deadline, scoped for a dermatology group - plus the six-document file that takes one afternoon.
Key takeaways
When a patient asks your medical assistant whether the chat window that booked her Thursday skin check was a person or a machine, what is the answer, and where is it written down? Most dermatology owners can answer the first half. The disclosure sits somewhere in a vendor's terms page, nobody at the front desk has read it, and no document in the building says which tools were switched on, when, or who approved them.
If that describes the practice, there is a 2026 problem here — not a hypothetical one. Two state laws that took effect on 1 January 2026 changed what a US medical practice has to tell patients about AI, and a third deadline lands on 2 August 2026 that most dermatology groups will find, after an afternoon of reading, does not apply to them at all. Knowing which is which is worth that afternoon.
For a specialty clinic, AI compliance in 2026 is almost entirely about three things: telling the patient plainly when a machine is involved in their care or their message, keeping a written record of which tools were switched on and who could use them, and being able to show that a licensed clinician reviewed anything clinical before it went out. Everything else on the vendor's compliance page is somebody else's obligation.
Owners underestimate their exposure because they think of "AI" as something they would have purchased. In a typical group running general derm, a Mohs surgeon two days a week and a cosmetic side, it is already in four places:
Note what is not on that list: the payer's utilization-review software deciding whether your biopsy was medically necessary. That is real AI and it costs you real money, but it is regulated at the payer, not at you.
1 January 2026 — Texas. The Texas Responsible Artificial Intelligence Governance Act took effect. Its healthcare provision is the one that matters to a clinic: a provider using AI in a patient's care has to disclose that fact to the patient. Not buried in a portal terms page — disclosed, at or before the point of service.
Hear it before you finish reading
Talk to a live CallSphere AI voice agent for healthcare in your browser — 60 seconds, no signup.
1 January 2026 — California. SB 53 took effect the same day, aimed at the companies building the largest AI models, not the practices using them. Californian clinics do have a live obligation, but it comes from AB 3030: generative-AI-written clinical messages to patients need a disclaimer and a plain way to reach a human clinician instead.
2 August 2026 — the European Union. The EU AI Act's high-risk and transparency obligations carry this compliance date and reach US companies whose systems affect people in the EU. Most independent specialty clinics are not touched by it. A few are, and the test is narrow enough to settle in one meeting.
And the rest of the map. Colorado, New York, Utah, Nevada, Maine and Illinois all have their own AI statutes, with different triggers. Utah requires licensed professions to say so when a patient is dealing with a generative tool rather than a person. Illinois restricts AI in mental-health treatment and separately has strict biometric-data rules — worth raising with counsel if you run facial photography through any analysis tool at an Illinois location. Federal preemption is unsettled as of July 2026, so the state law where your offices sit still binds you.
flowchart LR
A{"Do you treat or advise patients physically located in the EU?"} -->|No| B["EU AI Act: out of scope, memo it and move on"]
A -->|Yes| C["Narrow scoping memo, reviewed by counsel before 2 August"]
B --> D["Texas and California obligations still apply to your offices"]
C --> D
D --> E["Disclosure on the phone greeting and the chat header"]
E --> F["Clinician attestation line on every AI-drafted note or message"]
F --> G["Access log plus signed business associate agreement in the binder"]
Here is the part nobody sells you: you are the practice using the tool, not the company that built it, and almost every obligation that sounds terrifying in a webinar attaches to the builder. California SB 53 governs frontier model developers. Unless your group is training its own large models between Mohs cases, it is not about you. The EU AI Act reaches you only if your system's output affects people in the EU — which for a dermatology group means one of three things: you see or advise patients who are physically in Europe, you are a trial site for a European sponsor and AI-derived output flows into that study, or you have put a symptom-checker on a public website open to European users. If none of the three is true, write a one-page memo saying so, date it, have counsel glance at it, and file it. That memo is your compliance for 2 August.
What you cannot dismiss is disclosure. A patient in Texas is entitled to know that AI touched their care. A patient in California is entitled to a disclaimer on a machine-drafted clinical message and a route to a human. Both are cheap to satisfy and expensive to have ignored for eighteen months.
Here is the whole file. It fits in one folder, and it is what you hand over if anyone asks.
| Document | Who builds it | Hours |
|---|---|---|
| Signed business associate agreement with every AI vendor touching patient data | Practice administrator | 1.5 |
| Written disclosure text: phone greeting, chat header, portal message disclaimer | Administrator, counsel review | 2.0 |
| Access log: which tool, switched on what date, which staff have it, who approved | Administrator | 2.5 |
| Clinician attestation wording added to AI-drafted notes and messages | Medical director | 1.0 |
| EU scope memo (usually one page saying "not in scope, here is why") | Counsel | 2.0 |
| Updated Notice of Privacy Practices and staff acknowledgement sheet | Administrator | 2.5 |
Assumptions, illustrative: 9.5 of those hours are administrator time at a fully loaded $58 an hour, 2 hours are outside counsel at $450. That is $551 plus $900 — $1,451 in total, once — plus an hour each January to review the file when the plan year and the statute book both turn over.
Now the comparison. Suppose a complaint or a payer audit arrives in 2027 and you have to reconstruct, after the fact, which tools were running in March 2026, who had access, and whether the message the patient received carried a disclaimer. Assume 20 hours of counsel at $450 and 15 administrator hours digging through vendor invoices and staff memories: roughly $9,870, before any finding is made. The file is not insurance against a bad outcome — it is the difference between answering a question in an afternoon and reconstructing a year.
Still reading? Stop comparing — try CallSphere live.
See the healthcare AI agent handle a real call — complete, industry-specific, and live in your browser. No signup.
No statute lets a drafted note become a signed note by itself. The physician or physician assistant attests, and the attestation should say something truthful — that the note was drafted with AI assistance from the visit and reviewed and edited by the clinician before signing. Vague attestation wording written by a vendor is worse than none, because it is a written statement you did not verify.
Keep a clinician in the loop on anything that decides urgency. Booking a routine full-body skin check on Thursday is one thing. A patient describing a rapidly changing pigmented lesion, a red streak spreading from a surgical site, or bleeding that will not stop after a shave biopsy needs a person, and that escalation path should be written down and tested rather than assumed. The same goes for cosmetic work that touches medical judgment — a laser consult for a patient on isotretinoin is not a scheduling question.
And be honest about the limit of disclosure itself. Telling a patient a machine is involved is not consent, does not transfer liability, and does not make a wrong answer acceptable. It is the floor. Everything above it is still practicing medicine.
Generally the law of the state where care is delivered governs — but if one phone system, one website and one chat agent serve both offices, you are applying the strictest rule to everyone anyway. Most multi-state groups write one disclosure that satisfies the toughest state they operate in, because two greetings on one phone tree fail the first time somebody edits it.
In Texas, yes, and it is good practice everywhere: a line in the check-in paperwork and a sentence the clinician says at the start of the visit. Most groups add it to the intake form patients already complete on the tablet and let the medical assistant mention it while rooming. Patients rarely object to the tool; they object to finding out later.
Put this to counsel rather than to a blog: the answer turns on whether you are offering the service into the EU or continuing care for someone who happens to be travelling. Write down the facts — how many patients, from where, whether you advertise there — and buy one paragraph of written advice.
Start with the access log, the one document you cannot recreate later. One sheet: tool name, date switched on, which staff or clinicians have it, who approved it, where the signed agreement is filed. Give it to the practice administrator with a two-week deadline.
When you write the disclosure text, remember where patients meet the practice after hours: the phone greeting and the chat window. CallSphere builds the AI voice and chat agents that answer those lines, book appointments and capture new patients around the clock — and the practical compliance point is that the disclosure sentence, the route to a human and the record of what was said belong to the conversation itself, not to a policy nobody reads.
Written by
Sagar Shankaran· Founder, CallSphere
LinkedInSagar Shankaran is the founder of CallSphere, where he builds production AI voice and chat agents deployed across healthcare, hospitality, real estate, and home services. He writes about agentic AI, LLM engineering, and shipping voice agents that handle real calls in production.
See how AI voice agents work for your industry. Live demo available -- no signup required.
EU AI Act, Texas TRAIGA, Colorado and Illinois: what a US child care center must disclose, log and keep when AI touches hiring, waitlists or the tour line.
EU AI Act August 2, TRAIGA and SB 53 in plain terms for a 22-person consulting firm: the six documents to hold, and what is genuinely out of scope for you.
What a US HVAC contractor must document in 2026 — hiring screeners, after-hours booking agents — and which AI laws genuinely don't apply to a six-van shop.
Sports physical therapy and student health clinics in Pullman, Washington lose patients to missed calls every semester surge. How to answer every single one.
Bilingual family medicine clinics in Yakima, Washington field English and Spanish calls from harvest crews at all hours. An AI receptionist answers them all.
Optometry practices in Newport, Oregon serve retirees, tourists, and the fishing fleet. An AI answering service books exams and triages urgent eye calls 24/7.
© 2026 CallSphere Inc. All rights reserved.
Made within San Francisco
Watch how CallSphere handles real customer calls, schedules appointments, and processes payments — live.
Try Live DemoBook a DemoCalculate Your ROI