The regulatory frameworks ChironAI is engineered around.

AB 489 prohibits an artificial intelligence or generative AI system from holding itself out — explicitly or implicitly — as a licensed health professional. ChironAI is engineered as decision support. Every output passes through a must-review-before-final gate before it becomes part of a clinical chart.

Operationally: the AI is never framed as a credentialed clinician. The persona language across our prompt suite explicitly identifies Chiron as a "Digital Employee, ChironAI" — not a doctor, not an MD, not a radiologist. The forbidden-vocabulary list in our prompt substrate prevents drift, regression-guarded by an automated compliance test. Every AI artifact in the product UI carries the must-review-before-final banner. Every PDF report carries the same disclosure in its footer.

The licensed clinician retains final authority over diagnosis, treatment, and prescribing decisions, at every step.

Substantive clinical, legal, financial, and other professional decisions are made by the licensed human professionals using ChironAI. The product is structured-workflow, not free-form chat, by design — because free-form interfaces are incompatible with the physician-review and auditability requirements of regulated industries.

Every clinical recommendation is structured for clinician review. Evidence presented openly. Reasoning visible at every step. Confidence calibrated. Every source cited. The clinician decides what to act on.

Where any communication ChironAI generates or substantially generates carries clinical content, the AI authorship is disclosed in accordance with applicable law including California AB 3030. The disclosure appears as a non-dismissible banner in the product UI on every AI artifact, and in the footer of every exported PDF.

Disclosure is treated as an architectural invariant, not a UX choice. Removing the disclosure requires a counsel-and-medical-director sign-off documented in the deployment posture.

California consumers have the right under CCPA/CPRA to be informed about automated decision-making technology used in services they interact with, and to opt out of certain ADMT use. ChironAI presents an ADMT notice to users on first AI feature use in the product, and provides opt-out controls accessible from the user-preferences surface.

Implementation: the ADMTNotice component surfaces on first AI interaction; opt-out preferences persist per-user in the AI Preferences settings panel. Both are auditable to the licensed clinician using the product.

When ChironAI handles medical information under CMIA jurisdiction, the data-handling controls documented on the Security and Data Handling pages apply: encryption at rest and in transit, tenant-isolated storage, audit-trailed access, retention policies per data class, and BAA-governed institutional relationships.

ChironAI operates HIPAA-aligned administrative, technical, and physical controls for institutional customers handling Protected Health Information. Key elements: 256-bit encryption at rest and in transit, role-based access control via fine-grained clinical permissions, multi-tenant isolation enforced by tenant ID guards, MFA on staff accounts, tamper-evident audit chain on every clinical action, document signature integrity via SHA-256 hashing, and per-organization Business Associate Agreement scoping.

HIPAA "certification" is not a real regulatory status — we operate HIPAA-aligned controls. BAA template is available on request.

ChironAI is deliberately silent about specific FDA SaMD claims today. We are evaluating the SaMD regulatory pathway with counsel. Until that evaluation completes and counsel approves specific language, we make no claim that ChironAI is an FDA-cleared device or that any specific clinical capability is FDA-regulated decision support.

See the Disclosures page for the full SaMD-posture statement.

Data subjects in the EU and UK retain rights to access, rectify, erase, restrict, port, and object to processing of their personal data, plus rights against solely automated decision-making with legal or similarly significant effects (Article 22 GDPR). The must-review-before-final gate that runs at inference inside ChironAI satisfies the human-oversight requirement.

Our legal bases for processing typically include consent, performance of a contract, legitimate interests (where overridden interests do not apply), and compliance with legal obligations. International data transfers, where required, are subject to Standard Contractual Clauses or equivalent mechanisms in force at the time of transfer.

In every operating region where ChironAI is deployed, we honor the local data-protection statute that governs that region. Our institutional partnerships include data-handling addenda that specify residency, retention, and access-control posture for each jurisdiction.

For specific jurisdictional disclosures, contact our compliance team directly.