California's AB 1609 imposes a 15-minute human handoff requirement on large businesses deploying customer service chatbots, creating immediate compliance obligations for health plans, pharmacies, and PBMs whilst granting hospitals a broad exemption. The legislation, effective January 1, 2027, defines covered entities as those with over $500 million in annual revenue and mandates clear AI disclosure, frictionless escalation mechanisms, and strict hold-time caps—15 minutes maximum per hold, one hour cumulative. The hospital carve-out is notably expansive, covering communications related to treatment, payment, and health care operations, but this leaves the broader health care ecosystem exposed. Pharmacy chains, PBMs, managed care organisations, and health plan operators face the full weight of these requirements, particularly for high-volume use cases like prior authorisation status checks, prescription refills, formulary coverage inquiries, and claim status requests. This creates a critical question for CX leaders: how do you reconcile the operational efficiency gains from AI-driven triage and routing with statutory obligations that effectively cap automation's reach in regulated verticals?
The compliance architecture layered onto these organisations is substantial. AB 1609's transparency and human-access duties sit atop existing HIPAA minimum necessary standards, California's Confidentiality of Medical Information Act, and CCPA/CPRA consumer rights frameworks. For teams already managing Zendesk or Salesforce implementations in health care, this means chatbot interactions must simultaneously satisfy data minimisation requirements, consumer access rights, and now statutory escalation timelines—without requiring new communication channels. The practical lift centres on workforce planning: organisations must model peak-volume scenarios and staff to meet the 15-minute connection window during regular business hours, whilst documenting "good faith" compliance efforts through commercially reasonable systems. Civil penalties of $5,000 per initial violation and $10,000 per subsequent violation are modest relative to operational disruption, but the January 2027 effective date leaves minimal runway for system redesign and staffing adjustments.
The legislation signals a fundamental shift in how regulators view AI in customer-facing health care operations: as a supplement to human agents, not a replacement. For CX professionals managing contact centres in non-hospital health care settings, this means reassessing automation strategies that prioritise deflection over escalation. The 15-minute cap is achievable for well-staffed operations but becomes a constraint on chatbot complexity and scope—particularly for multi-step processes like prior authorisation or appeals that historically benefited from extended automation. Organisations should immediately audit their chatbot inventory against the $500 million revenue threshold, map which communications fall outside the hospital exemption, and begin workforce modelling. The broader implication extends beyond California: as other states adopt similar transparency and human-access requirements, the 15-minute standard will likely become an industry benchmark, reshaping how vendors design escalation workflows and how teams budget for agent capacity.
Zendesk will perform scheduled database maintenance between October 13 and Oct 20, 2026 as part of a critical version upgrade to the “AWS Aurora” software. This will affect database clusters in all Zendesk regions and Advanced Action Flows, Analytics, Chat, Contact Center, Sales, Support, and Sunshi
Please Hold (For No Longer Than Fifteen Minutes): New Customer Service Requirements for AI Chatbots Quarles