California's AI Chatbot Law Is Already in Effect — And Someone Can Sue You for $1,000 Per Violation

---

What California SB 243 Actually Requires

The core requirement is straightforward. If you use a bot to communicate with a California resident, you must disclose — at the start of the conversation, before anything else happens — that they are communicating with a bot and not a human.

That's it. The law doesn't prescribe exact language. It doesn't require you to explain how the AI works, what data it collects, or what vendor powers it. It requires one thing: that the person on the other end knows they're talking to software before the conversation begins.

What doesn't satisfy the law:

• A disclosure buried in your website footer
• A note in your privacy policy that users must navigate to separately
• Language that appears only after the chatbot has already exchanged two or three messages
• A general "this website uses AI" disclaimer that doesn't address the chatbot specifically

The disclosure must be the first thing the chatbot communicates — the opening message of the conversation.

---

Why the Private Right of Action Changes the Risk Calculus

Most compliance obligations work the same way: a government agency receives a complaint, investigates, and may eventually impose a penalty. The process is slow, enforcement is selective, and the risk to any individual firm is relatively low unless the violation is egregious.

California SB 243 does not work that way.

The law creates a private right of action — the legal term for a statute that gives individual citizens the right to sue directly, without needing government involvement. Any California resident who can document that your chatbot communicated with them without disclosing its AI nature can file a lawsuit and recover $1,000 in statutory damages per violation plus attorney fees.

They do not need to prove they were deceived. They do not need to prove they were harmed. The violation itself — the failure to disclose — is sufficient.

For professional services firms, the math is worth doing:

• A firm handling 80 intake inquiries per month via chatbot, 20% from California residents = 16 potentially non-compliant California conversations per month
• Twelve months of non-compliance since January 1, 2026 = roughly 192 conversations
• At $1,000 per violation: $192,000 in potential statutory damages, plus attorney fees

This is not a theoretical exercise. It describes the liability profile of a mid-sized law, accounting, or consulting firm with a busy intake chatbot that added a chat widget to their website in 2025 and hasn't looked at it since.

---

Which Professional Services Firms Are Most Exposed

Law firms. Client intake chatbots are now standard on firm websites. Tools like Lawmatics, Clio Grow, and numerous third-party chat widgets handle initial screening and scheduling. If any of your California prospects have used your chatbot since January 1, 2026, and it didn't open with a disclosure, you are exposed.

Accounting firms. AI-powered scheduling assistants, FAQ tools, and client onboarding chatbots are increasingly embedded in accounting firm websites, especially through platforms like Karbon, Canopy, or third-party chat services. Tax season creates high chatbot traffic. If you had California inquiries during this year's tax filing season through an AI tool — which you almost certainly did if you have any national presence — your exposure window is already open.

Consulting firms. Website contact forms that have been upgraded to AI-powered conversational interfaces. Automated responses to RFP inquiries. Client portal assistants that use AI to route questions. Any of these, communicating with California contacts without disclosure, creates exposure.

Staffing agencies. AI applicant screening tools, chatbots that handle initial candidate questions about job openings, and automated interview scheduling assistants. The employment context is particularly sensitive: California has extensive employee and applicant protections, and an applicant who discovers their "initial screening conversation" was with an AI they weren't informed about has both SB 243 exposure and potential employment law angles to pursue.

---

The 15-Minute Compliance Audit

You don't need outside counsel to run an initial compliance check. This takes 15 minutes.

Step 1: Inventory every client-facing AI tool. Walk through your firm's digital touchpoints from the perspective of a new prospect or current client. Specifically look for:

• Any chat widget on your website (lower right corner of your website is where 90% of these live)
• Any scheduling tool that uses conversational AI (Calendly is not covered; a chatbot that asks qualifying questions before booking is)
• Any client portal messaging feature that generates responses using AI
• Any automated email or text response system that uses AI to draft or route replies

If it looks like a conversation and an AI generates the responses, it's covered.

Step 2: Test the first message. Initiate a conversation with each tool as a new user would. What is the very first thing the tool says? Does it identify itself as AI, as a bot, or as an automated assistant — before asking you anything?

If the first message is "Hi! How can I help you today?" without any AI disclosure: you are out of compliance in California.

Step 3: Add or confirm disclosure language. Every AI-powered conversational tool communicating with clients or prospects needs to open with disclosure. A compliant first message:

"Hi — I'm an AI assistant for [Firm Name]. I'm not a human. I can help with [scheduling, initial questions, etc.]. How can I help you today?"

Or more formally:

"You are communicating with an automated AI assistant, not a member of our team. A team member will follow up with you directly. How can we help?"

Your specific language can be warmer, more on-brand, or more formal — but "automated," "AI," or "bot" must appear before anything else.

Step 4: Document the change. Note the date you added disclosure language and which tools you updated. If you ever face a claim, documentation of good-faith compliance efforts matters.

---

What to Do About Pre-January 1st Chatbot Traffic

If your chatbot has been operating since 2025 or earlier without disclosure, the honest answer is that your historical exposure window already exists. You cannot retroactively fix conversations that happened before today.

What you can do:

1. Comply immediately. The clock stops running on new violations the moment you add proper disclosure. Every day you delay is another day of accumulating exposure.

2. Assess your California traffic. If your firm serves primarily a regional market in, say, the Southeast or Midwest and you have minimal California clients or web traffic, your realistic exposure may be limited. Review your analytics. If California is less than 5% of your web traffic and you have no California client relationships, the practical risk is lower — though not zero, since the law covers any California resident, not just clients.

3. Talk to your insurance carrier. If you carry professional liability insurance, AI-related compliance exposure may or may not be covered. Ask specifically about technology E&O and cyber liability coverage for chatbot-related claims. This is a 15-minute phone call worth making.

---

The Broader Picture: Why California Is Just the Beginning

California SB 243 exists because it was the first state chatbot disclosure law of its generation — signed in 2019, updated and still in force in 2026. It's not the last.

As of April 2026:

• Washington has signed two AI chatbot bills (effective ~June 22, 2026), including SB 3368 with a private right of action
• Oregon SB 1546 is signed, effective January 1, 2027, with a $1,000-per-violation private right of action
• Georgia SB 540 awaits Governor Kemp's signature with a May 12 deadline
• 78 chatbot-related bills are active in 27 states as of April 2026

Every firm that builds compliant disclosure into their chatbot tools now is positioned for the entire wave. Every firm that waits is adding new states to their exposure profile every month.

The professional services firms that will come through this regulatory period without incident are the ones that treated this as a 15-minute task in 2026, not a 6-month compliance project starting the day a lawsuit was filed.

---

The One Thing to Do This Week

Go to your firm's website. Find your chat widget or intake chatbot. Start a conversation as a new user would. Read the first message it sends.

If that message doesn't include the words "AI," "automated," or "bot" — update it today.

That's it. That's the entire task. For most chatbot platforms (Intercom, Drift, Freshdesk, HubSpot Chat, Lawmatics, Clio Grow), the opening message is a field you can edit in your settings in under two minutes.

You cannot undo the conversations that happened before today. You can prevent every conversation that happens after.