What does AB 1609 say about AI in banking?

What are the key points of AB 1609?

• Applies only to "large private businesses" — more than $500,000,000 in gross annual revenue nationally — so it reaches large banks and card issuers but not community banks or credit unions
• Prohibits representing a customer service chatbot as a human, and requires a clear, conspicuous AI disclosure in the same medium as the interaction whenever a reasonable person could be misled
• Requires a simple way for a customer to request a human agent on every customer-service channel (chat or telephonic) during regular business hours
• Good-faith effort to connect to a human agent within 15 minutes of the request, or schedule an appointment within one business day; hold/wait time after connection capped at 15 minutes per instance and one hour cumulative
• Enforced only by a public prosecutor — the statute expressly creates no private right of action — with penalties of $5,000 for an initial violation and $10,000 for each subsequent violation
• Exempts exclusive business-to-business lines, hospitals' health-care communications, consumer reporting agencies, and businesses that comply with specified Public Utilities Commission rules; excuses noncompliance caused by unforeseen circumstances or emergencies
• A business need not offer telephonic customer service if it did not already do so as of January 1, 2027, provided customers can still promptly reach a human through another channel

What did AB 1609 change for banks?

California becomes the first state to regulate bank-facing customer-service chatbots directly, rather than through its general privacy or employment statutes. For large banks it adds a disclosure-and-human-escalation duty layered on top of (not a substitute for) the CPPA's ADMT rules and the Colorado Chatbot Safety Act obligations that already reach customer-facing AI.