BuildNot yet confirmed elsewhere1 publisher2 min readPublished
AB 1609 sets a $500M revenue floor on its chatbot disclosure and handoff rules
California's AB 1609 fines chatbot operators $5,000 for a first violation and $10,000 for each after, according to a dev.to guide. It limits the law to businesses with $500M or more in revenue, while EU Article 50 has no floor, so mixed traffic needs disclosure logic that branches.
The Engineer · Build desk
Key figures: ten AB 1609 violations total $95,000, one at $5,000 plus nine at $10,000. AB 1609 fines $10,000 for each violation after the first. EU AI Act Article 50 penalties run up to EUR 15M, or 3% of global turnover.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Ten AB 1609 violations: one at $5,000, nine at $10,000 | $95,000 total | 6 | |
| AB 1609, each later breach | $10,000 | 8 | |
| EU Article 50 penalty, up to | €15,000,000 | or 3% of global turnover | 14 |
What happened
- AB 1609, signed Sept. 28, 2026, sets three tripwires: in-the-moment AI disclosure, a human handoff within 15 minutes or an appointment within one business day, and a conspicuous service phone number.
- EU AI Act Article 50 has applied since August 2026, carries penalties up to EUR 15M or 3% of global turnover, and has no revenue threshold.
- The post attributes its penalty figures to CX Network, Oct. 11-12, 2026.
Why it matters
- constraint A bot that runs around the clock cannot meet the handoff rule with a business-hours button, so overnight traffic needs staffed coverage or a booking path.
- exposure A company under $500M in revenue sits outside AB 1609 as the post describes it, but any company with EU users is inside Article 50, so revenue alone does not say which rules apply.
- decision Disclosure logic has to branch by user location: reminders during the conversation for California and Washington traffic, and a single disclosure for the other ten states.
The post reduces every bot setup to four booleans: in_moment_disclosure, policy_disclosure, human_handoff_sla and conspicuous_phone [2]. The last one is the AB 1609 phone requirement, a conspicuous service number on the site [13]. The first is the flag both regimes touch. AB 1609 wants disclosure to be "clear and conspicuous" wherever a reasonable person could be misled, and a human-name avatar with no AI mention is the violation [10]. Article 50 adds the second flag, because every person must know they are talking to AI, both in the moment and in the operator's policy [15].
The post cites "the guidance" without naming the document, and quotes it on how far a footer notice goes: "Generic declarations of AI use will not suffice." [16]
Handoff is where one boolean hides a branch. The scorer's code comment defines human_handoff_sla as "human in 15 min OR appt in 1 business day" [3]. A team with a live agent and a team with a booking form both set the flag to true, and the flag does not record which path is live. In our view the appointment path is the likelier fix for overnight traffic, because a scheduler and a next-business-day follow-up cost less than a night shift.
The cadence branch is simpler. Twelve states are on the post's list [17], and only California and Washington mandate frequent reminders [18]. Ten accept a one-time disclosure [19]. The widget needs the user's state at session start to choose a path.
The penalty math is easy to run and hard to interpret. At $5,000 for the first violation and $10,000 for each after [8], ten violations come to $95,000 [6]. The post does not say what counts as one violation.
It also sorts the fix-first list by penalty exposure: Article 50, then AB 1609, then state cadence [5]. The two penalties use different units. Article 50 is quoted as a ceiling tied to global turnover [14], and AB 1609 as a flat rate per violation [8].
The 49-point cap in the scorer is the author's design. Missing in-moment disclosure while serving EU users caps the score at 49, and the post justifies that by calling Article 50 non-negotiable [4].
What to watch
- Whether California publishes enforcement guidance that defines a single AB 1609 violation, per conversation, per day or per page.
- Whether more states adopt frequent-reminder mandates beyond California and Washington, which would add branches to the cadence logic.
- Whether the Article 50 guidance quoted by the post is published in a form teams can check the 'generic declarations' line against.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence40
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The post attributes its penalty figures to CX Network, Oct 11-12, 2026.
- [2]
The post's roughly 80-line Python scorer reduces every bot setup to four booleans (in_moment_disclosure, policy_disclosure, human_handoff_sla, conspicuous_phone) plus a cadence question.
- [3]
In the scorer's code, human_handoff_sla is a single boolean with the comment 'human in 15 min OR appt in 1 business day'.
- [4]
In the scorer, missing in-moment disclosure while serving EU users hard-caps the score at 49, because the post says Article 50 makes it non-negotiable.
- [5]
The scorer sorts gaps by penalty exposure: EU Article 50 first, then AB 1609, then state-cadence gaps.
- [6]
Ten AB 1609 violations total $95,000: one at $5,000 plus nine at $10,000.
- [7]
AB 1609, signed Sept 28, 2026, sets three tripwires: in-the-moment AI disclosure, a human handoff within 15 minutes or an appointment within one business day, and a conspicuous service phone number on the site.
- [8]
AB 1609 penalties are $5,000 for the first violation and $10,000 for each subsequent one.
- [9]
AB 1609 binds large private businesses with $500M or more in annual revenue that serve California consumers.
- [10]
Under AB 1609, disclosure must be 'clear and conspicuous' wherever a reasonable person could be misled, the bot may not be represented as human, and a human-name avatar with no AI mention is the violation.
- [11]
AB 1609 requires a human agent within 15 minutes, or an appointment within one business day.
- [12]
A handoff button that only works 9-5 while the bot runs 24/7 fails the AB 1609 handoff requirement.
- [13]
AB 1609 also requires a conspicuous service phone number on the site.
- [14]
EU AI Act Article 50 has been in effect since August 2026, carries penalties up to EUR 15M or 3% of global turnover, and has no revenue threshold.
- [15]
Under Article 50, every person must know they are talking to AI, both in the moment and in the operator's policy.
- [16]
The post quotes unnamed 'guidance' on Article 50: 'Generic declarations of AI use will not suffice.'
- [17]
As of Oct 2026, 12 US states regulate chatbot disclosure: CA, CO, CT, GA, HI, ID, IA, NE, NY, OR, RI and WA.
- [18]
Of those 12 states, only CA and WA mandate frequent reminders; the rest accept a one-time disclosure.
- [19]
Ten of the 12 listed states accept a one-time disclosure.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toYour chatbot is now a regulated surface: AB 1609 + EU AI Act Article 50 compliance in code
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- AI compliance engineeringFollow
- AI Chatbot RegulationFollow
- Consumer disclosure lawFollow