Chatbot Laws · verified Oct. 21, 2026
A business that offers a 'health care chatbot' to a consumer to manage the consumer's information, or to diagnose, treat or manage a medical condition, is treated as a provider of health care under the Confidentiality of Medical Information Act. It must keep medical information confidential like a provider and faces that Act's penalties for improper use or disclosure.
Who must comply
Businesses offering a health care chatbot to consumers: a generative AI system with a natural language interface that gives adaptive, human-like replies, is marketed as supporting health services, and uses health information the consumer provides or the chatbot collects, generates or infers. The deemed-provider status applies only under the Confidentiality of Medical Information Act, not other laws.
What it requires
| Therapy and licensed titles | Businesses offering a health care chatbot for managing a consumer's information, or for diagnosis, treatment or management of a medical condition, are deemed a provider of health care under the Confidentiality of Medical Information Act, but not for any other law.Civ. Code § 56.06(f); definition at § 56.05(i) |
|---|---|
| Data limits | Those businesses must maintain the same confidentiality standards a provider of health care must for medical information disclosed to them, and are subject to the Act's penalties for improper use or disclosure of medical information.Civ. Code § 56.06(g)-(h) |
Enforcement
| Enforced by | Patients or individuals (private suits under the Confidentiality of Medical Information Act) and Public prosecutors, licensing agencies and the Department of Public Health (fines and civil penalties under that Act)Civ. Code § 56.06(h); §§ 56.35, 56.36 |
|---|---|
| Private lawsuits | Yes |
| Penalties | The Act's existing remedies apply. A person whose information is negligently released may recover $1,000 in nominal damages plus actual damages; negligent disclosure carries a fine or civil penalty up to $2,500 per violation, and knowing and willful misuse up to $25,000 (up to $250,000 for financial gain). A patient with economic loss or personal injury may also recover punitive damages up to $3,000 and attorney's fees up to $1,000; violations causing such harm are misdemeanors. |
Key dates
- The law takes effect
Related laws
- California AB 489AI posing as a licensed health professionalIn effect since Jan. 1, 2026
Sources
- Governor's Sept 30, 2026 signing announcement Supports: AB 1979 (Bonta), Health care services: artificial intelligence, listed as signed Sept 30, 2026.
- Assembly Daily Summary, Sept 30, 2026 Supports: Lists vetoed bills (e.g., AB 2575) and does not list AB 1979, consistent with approval.
- AB 1979 (status), California Legislative Information Supports: Vote counts; approval and Chapter 854 on Sept 30, 2026.
- AB 1979 (text), California Legislative Information Supports: Civil Code 56.05 and 56.06 amendments.
- 2026 legislative calendar, California State Senate (official) Supports: Non-urgency statutes take effect Jan. 1 (Cal. Const. art. IV, sec. 8(c)); Aug 31, 2026 last day to pass bills; Sept 30 signing deadline.
- Civil Code 56.36, California Legislative Information Supports: CMIA nominal damages, fines and civil penalties, misdemeanor.
- Civil Code 56.35, California Legislative Information Supports: CMIA private action for economic loss or personal injury.