Chatbots have revolutionized customer service, driving efficiency through automation and helping organizations support customers at scale.
But customers and regulators have long called for guardrails on how chatbots operate, from data collection, to their application in sensitive or high-risk journeys, and preventing digital dead ends.
As the technology that bots are built on has evolved from rules-based to truly conversational interfaces powered by generative AI and agentic AI, several jurisdictions have made moves to ensure that chatbots are developed with transparency, safeguards and humans in the loop.
As California's AB 1609 takes effect, CX Network looks into:
- How AI regulations – from California to Europe – are changing customer service and chatbots
- The financial penalties can organizations now face under the EU AI Act Article 50 and California's AB 1609 law
- What developments mean for those who develop and deploy chatbots for customer service
What is California's AB 1609 law for customer service chatbots?
California's new law prohibits large, private businesses from representing a customer service chatbot as a human. It means large businesses must provide "certain disclosures" if the experience is convincing enough that a reasonable person would be misled into believing they are interacting with a human.
With generative and agentic bots and voice AI agents now available, the risk of a person confusing a bot with a human is higher than ever.
California's rules apply to businesses with a gross annual revenue of US$500 million or more, that provide goods and services to consumers in California. If chatbots are so good that "a reasonable person would be misled into believing the chatbot is human", the business must provide "a clear and conspicuous disclosure to users indicating that the chatbot is AI".
The new regulations come at a time when developers are racing to build bots that respond quickly and are intelligent enough to be as helpful as a human agent.
But California says that for consumers residing in the state, large businesses must provide a feature that allows customers to request to be connected to a human service agent within 15 minutes or schedule an appointment with a human agent within one business day of the contact.
Furthermore, the customer service phone number to reach a human agent must be included "clearly and conspicuously" on the company website.
AB 1609 was signed into law on September 28, 2026 and is one of more than two dozen AI laws enacted by California this year, regulating AI transparency, chatbot safety, automated decision-making, and other domains. In addition to customer service, the law covers chatbot-equipped toys, employment, intellectual property, data privacy, healthcare, elections and antitrust.
California has long been a leader on AI regulations, and its new rules address the regulatory gaps that have emerged as a result of the continued development of conversational technologies.
The penalty for failure to adhere to AB 1609 is a fine of up to US$5,000 for an initial violation, and a $10,000 fine for each subsequent violation.
How does California's new bill compare to the EU AI Act?
In August 2026, the EU's chatbot transparency rules under the far-reaching EU AI Act took effect.
Under the transparency rules, all humans must be "informed that they are interacting with an AI system", unless it is obvious to a "reasonably well-informed, observant and circumspect [person], taking into account the circumstances and the context of use".
Disclosure must appear both "in the moment" and in company policy. The Act states "generic declarations of AI use will not suffice".
The rules around disclosure don't just apply to chatbots in service but to decision-making algorithms behind the scenes, which are classed – and regulated – according to "risk". AI systems used in credit scoring or employment screening are considered high-risk because they directly affect individuals' livelihoods. Their requirements are not yet fully in force.
AI-driven chatbots or recommendation engines are considered to pose limited risk under European rules, but still require careful oversight to ensure they do not inadvertently harm consumers or violate ethical AI standards.
Under the EU's rules, customers must also be given the option to bypass AI if they wish, but they do not have an automatic right to interact with a human, as they would under California's rules.
Penalties for transparency breaches are lower than the general penalties but still costly. They can reach up to €15 million or three percent of a company's worldwide annual turnover, whichever is higher. For context, violations of the EU's GDPR are capped at €20 million, or up to four percent of global turnover.
Which other US states have chatbot regulations?
As of October 2026, more than 12 US states currently regulate or have regulations pending in relation to customer-facing conversational AI bots. Each regulation has been developed to cover consumers based in these states and does not apply for consumers outside of these states.
In addition to California, the list includes but is not limited to:
- Colorado
- Connecticut
- Georgia
- Hawaii
- Idaho
- Iowa
- Nebraska
- New York
- Oregon
- Rhode Island
- Washington (state)
All the listed states mandate that organizations be transparent when allowing a chatbot to handle customer interactions, particularly if using a human name, however, most of these regulations stipulate a one-time disclosure.
At present, only Washington and California mandate that customers are frequently reminded they are not talking to a human.
Disclosure obligations also exist under Section 5 of the Federal Trade Commission (FTC) Act, which prohibits unfair or deceptive practices, but the lack of comprehensive federal regulation has created a patchwork of state rules and a complex regulatory landscape. Consumers may not always be aware of their rights and corporations must abide by different rules across jurisdictions.
To find out more about AI regulation and governance, explore CX Network's resources:
- The CX Network guide to AI regulation for CX
- The EU AI Act compliance checklist for customer service teams
- AI governance series: Part 1 responsible AI vs. AI governance
- A guide to procuring trustworthy AI solutions
- How to use agentic AI in line with the EU AI Act