California Prior Authorization Regulation: A Novel Model for Gold Carding, and One of the Earliest AI Laws

California has taken a structurally distinct approach to gold carding, one built around plan-level data rather than provider track records, the other side of the coin to Texas’ gold carding bills. Combined with being an early adopter of AI regulation, boasting one of the earliest AI-restriction laws in the country, California, even without a comprehensive decision-timeline overhaul, is one of the most aggressive and exhaustive states for prior authorization.

‍

‍

The Physicians Make Decisions Act (SB 1120)

‍

SB 1120 took effect January 1, 2025, and was written to address the AI-oversight issues that other states have found themselves interested in addressing in the last 24 months. The law prohibits payers from letting AI alone issue a prior authorization denial, requiring that a licensed clinician make any adverse determinations.

‍

This places California among a growing group of states, including Georgia, Maryland, Nebraska, and Texas, that have passed some version of a human-touch or review requirement for adverse determinations. What makes California a pioneer in this category is timing. SB 1120 was one of the earliest of these laws to take effect, ahead of most of the states that have since followed a similar path – allowing states to learn from the requirements set here and the outcomes before enacting their own.

‍

‍

Flipping Gold Carding to the Plan Level (SB 306)

‍

Signed October 6, 2025, SB 306 is the more structurally interesting of California's two recent laws. Rather than placing the burden of qualification on individual providers, SB 306 requires health plans to publicly identify which services they approve 90% of the time or more, and then stop requiring prior authorization for those services altogether. The requirement takes effect no later than January 1, 2028.

‍

This is gold carding built around a plan’s data, and their track record, instead of requiring providers to report, track, and qualify. A provider-level exemption requires an individual practice or group to accumulate its own approval history over a period of time, at the mercy of payer approvals. A plan-level exemption removes prior authorization for a service across the board, regardless of which provider is submitting the request, once the plan's own data shows the review adds little value.

‍

Whether this model scales better than a provider-level approach has yet to be seen, but other states are likely to – and should – be watching closely as California's January 2028 effective date approaches.

‍

The AB 512 Veto: A Reminder That Reform Has Limits

‍

Governor Newsom's veto of AB 512, which would have shortened California's standard turnaround and response times, is notable among the two aggressive reforms that did pass. It's a reminder that California's reform threshold isn’t unlimited. The state's baseline timelines, five business days for standard requests and 72 hours for urgent ones, remain unchanged for now – still shorter than the standard seven days.

‍

California hasn't set the fastest decision timeline in the country. States like Washington and New Jersey have moved further on that specific category. California's distinction lies elsewhere, choosing to speed things up through change to the structure of review entirely.

‍

‍

What This Means Operationally

‍

For providers and payers operating in California, a few things are worth tracking as SB 306 moves toward its 2028 effective date.

‍

The plan-level exemption structure means eligibility won't be something a provider tracks and applies for individually. Instead, it will depend on which services a given plan discloses as meeting the 90% approval threshold, and just as importantly, how transparently the plan data is published in the lead-up to 2028. Organizations should expect plan-by-plan variation in how aggressively insurers identify qualifying services, since the incentive structure differs from a provider-level gold card.

‍

In the meantime, SB 1120's human-review requirement is already in effect, which means any denial issued in California since January 2025 should be traceable to a licensed clinician's judgment rather than an unsupervised algorithmic determination. This should be incorporated into workflows and denial management as soon as possible, if not already there.

‍

‍

Why California Is Worth Watching

‍

California hasn't pursued the timeline aggressiveness of Washington or the outright bans Illinois has enacted for certain care. Instead, California has chosen to test entirely different structures for eliminating unnecessary review, specifically by setting up the gold card program on the payer side, rather than based on provider qualification. If SB 306 proves effective once it takes effect in 2028, it offers other states a new model to draw from for structuring gold carding programs going forward.

‍

Bill numbers, effective dates, and provisions reflect available public reporting as of this writing. Confirm current requirements against the California Department of Managed Health Care or California Legislature before making operational decisions.

‍