Please Hold (For No Longer Than Fifteen Minutes): New Customer Service Requirements for AI Chatbots

Newsletter

Fifteen minutes to connect with a human being. That is what California will require of large health care entities whose customers ask to stop talking to a chatbot about a refill, transfer, denied claim, prior authorization, or specialist referral—and while hospitals won a broad carve-out, health plans, payers, managed care organizations, PBMs, and pharmacies did not.

This is the fifth installment in our series on California’s 2026 health care AI legislation. Each installment covers a single bill; this one addresses AB 1609, requires large businesses to disclose chatbot use and provide customers with the right to request a human customer service agent, with an interesting hospital-specific carve-out. Organizations outside California should note that consumer-facing chatbot transparency requirements are among the fastest-moving areas of state AI legislation.

This installment examines AB 1609’s disclosure, human-access, and hold-time requirements, the revenue threshold that determines coverage, and the practical reach of the hospital exemption — which, read against the bill’s licensure-specific definition, leaves much of the health care industry subject to obligations that layer on top of the Health Insurance Portability and Accountability Act (HIPAA), the California Confidentiality of Medical Information Act (CMIA), and the California Consumer Privacy Act (CCPA).

In This Series
Part Five: The Right to Human Customer Service Act (AB 1609)

What it does: AB 1609 creates new customer service obligations for large private businesses that deploy chatbots in California. The bill defines “customer service chatbot” broadly as any AI system with a “natural language interface” that provides adaptive, human-like responses and is used for direct customer service or support relating to the sale or delivery of goods or services.  Notably, the definition does not expressly include or exclude any specific medium (voice, SMS, email, etc.).

The bill prohibits a covered business from representing that a customer service chatbot is a human and requires a clear and conspicuous disclosure when a reasonable person interacting with the chatbot would be misled into believing they are communicating with a human. AB 1609 also requires covered businesses to give customers a simple way to request a live customer service agent during regular business hours, through “commonly understood commands, prompts, menu selections, or verbal requests” and make a “good faith effort” to timely connect the customer to an agent and ensure holds do not exceed the cap. A good faith effort is defined according to a safe harbor: commercially reasonable and practical standards that are designed and intended to achieve compliance.

The bill applies broadly to any “large private business,” defined as a business with more than $500 million in gross annual revenue nationally that provides goods and services to customers and makes a customer service chatbot available to a person in California. With a limited exemption outlined below, this revenue-based threshold means that AB 1609 may capture a wide swath of qualifying entities.

Key compliance obligations:

  • Covered businesses must not represent that a customer service chatbot is a human and must affirmatively disclose when AI is being used if a reasonable person would be misled.
  • During regular business hours, covered businesses must provide a clear and conspicuous feature enabling customers to request a human customer service agent. The business must make a good faith effort to connect the customer to a human agent within 15 minutes of the request, or offer a specific appointment time within one business day.
  • For telephonic customer service platforms, the business must ensure that calls are answered promptly, that a customer is not placed on hold for more than 15 minutes at any point after the call is answered, and that cumulative hold times do not exceed an hour total.

Exceptions:

  • No requirement to add new channels. The bill does not require a business to offer customer service through any communication platform it has not already made available to customers as of January 1, 2027. Businesses that do not currently offer telephonic customer service are not required to start, so long as they offer alternative methods to promptly connect customers with a live agent.
  • Emails, web forms, and voicemail are carved out. The 15-minute connection window does not apply to requests made via email, web-based contact forms, or voicemail.
  • Hospitals are expressly exempted, when a hospital’s chatbot communications “relate to the provision, coordination, management, administration, payment, or operation of health care services.” The bill enumerates a non-exhaustive list of covered functions that generally fall under HIPAA’s treatment, payment, and health care operations definitions, including patient care, clinical services, appointment scheduling, intake and registration, referrals, care coordination, patient navigation, emergency services, utilization management, prior authorization, discharge planning, follow-up care, billing, insurance, patient financial services, or other administrative or operational functions directly related to the delivery, payment, or coordination of health care services.

AB 1609’s hospital exemption is among the broadest health care carve-outs in recent California AI legislation, reflecting legislative recognition that hospital chatbot communications are intertwined with clinical care and patient safety.

However, the exemption’s specificity to hospitals means that a substantial segment of the health care industry remains covered. For example, a national pharmacy chain, hub, payer, PBM, or health care-adjacent business with over $500 million in gross annual revenue that deploys a customer service chatbot to California residents are likely to be covered by AB 1609.

Effective date: Awaiting the Governor’s signature; standard California effective date would be January 1, 2027.

Analysis: While the broad drafting of the hospital exemption gets the headlines, the takeaway should be the breadth of entities subject to these requirements. If the bill becomes law, it would impose a This is a particularly significant compliance consideration given the high volume of consumer interactions that non-hospital licensed health care entities handle through automated channels.

Chatbot use cases at a pharmacy, hub, payer, PBM, or health care-adjacent business that could be subject to AB 1609’s requirements include, for example:

  • Prescription refill inquiries and order status tracking
  • Insurance verification and formulary coverage questions
  • Prior authorization status and appeals assistance
  • Pharmacy benefit questions, copay inquiries, and cost-estimator tools
  • Prescription transfer requests and pharmacy location services
  • Mail-order pharmacy enrollment and delivery tracking
  • Eligibility and benefit verification
  • Claim status and explanation of benefits questions
  • Network and provider directory searches
  • Premium billing inquiries
  • Grievance or appeal intake
  • Prior authorization submission and status checks
  • Step therapy and formulary exception requests
  • Copay assistance enrollment
  • Patient portal account support
  • Remote monitoring alert triage

Importantly, civil penalties are capped at $5,000 per initial violation and $10,000 per subsequent violation, and the bill’s obligations are AB 1609’s duties are expressly cumulative—they do not displace existing obligations under other laws. A covered entity deploying a customer-facing chatbot must therefore layer AB 1609’s transparency and human-access requirements on top of HIPAA’s minimum necessary standard (for any PHI exchanged during the chatbot interaction), CMIA’s restrictions on disclosure of medical information, and CCPA/CPRA’s consumer rights framework (for non-PHI personal data exchanged during the chatbot interaction). This multi-layered compliance obligation will require careful design of chatbot systems to ensure that AI disclosures, data minimization, and consumer access rights are all addressed simultaneously across all applicable frameworks.

Practical takeaways:
  • Audit your chatbots. If your business exceeds $500 million in annual revenue and serves California consumers, inventory your AI-powered customer service tools to determine whether it qualifies as a “customer service chatbot” under the bill’s broad definition.
  • Check your carve-outs. If the organization operates through hospital-licensed facilities, confirm and document which chatbot communications fall within the hospital exemption and which do not, recognizing that non-hospital affiliates, retail pharmacy operations, and health plan functions may remain covered even where the parent organization includes licensed hospitals.
  • Update disclosures. Review customer-facing chatbot interaction to ensure you are providing a clear, conspicuous, same-medium disclosure of AI where a reasonable person could be misled.
  • Build the off-ramp. Design and implement a frictionless mechanism for patients and members to request a human agent via commonly understood commands or prompts.
  • Staff to the clock. The 15-minute connection window and one-hour cumulative hold cap will require workforce planning. Model peak-volume scenarios and ensure adequate staffing during regular business hours (10 hours/day over 5 days or 8 hours/day over 7 days).
  • Document “good faith.” Use the safe harbor; invest in commercially reasonable systems and record your compliance efforts.

While the bill’s revenue threshold narrows its immediate reach, its influence will almost certainly extend further—both as a model for other states and as a benchmark that will shape consumer expectations industry-wide. The technical compliance lift is manageable for businesses that act now, but if the bill becomes law, the January 1, 2027, effective date leaves little runway.

Together with the other bills covered in this series, AB 1609 sends a clear signal: California expects large businesses to treat AI tools as a supplement to the humans providing health care services, not a replacement. Having addressed each bill in turn, the series concludes with the enterprise-level action items that cut across all five measures.

For any questions on development or deployment of AI in the health care setting contact your Quarles attorney or:

Follow Quarles

Subscribe Media Contact
Back to Main Content

We use cookies to provide you with the best user experience on our website and to analyze statistics related to our website. To understand more about how we use cookies, or for instructions to change your preference and browser settings, please see our Privacy Notice. Please note that if you choose to reject cookies, doing so may impair some of our website's functionality.