California AI laws and runtime guardrails for user-facing systems

TL;DR: California’s new AI laws take effect on January 1, 2026 and require companion and healthcare-focused systems to prevent self-harm content, avoid misleading medical authority claims, and intervene in live conversations, according to Lakera. The shift is from policy intent to runtime control, where governance must hold up under user interaction, not just documentation.

NHIMG editorial — based on content published by Lakera: California’s AI Laws Are About to Meet Reality

Questions worth separating out

Q: How should security teams govern user-facing AI that can change tone in live conversations?

A: They should treat the conversation itself as a governed control surface.

Q: Why do companion chatbots create compliance risk even when they do not claim to be human?

A: Because users respond to tone, persistence, and conversational memory, not just explicit identity claims.

Q: What do security teams get wrong about AI systems that sound like clinicians?

A: They focus on whether the system explicitly says it is a doctor, but that is only part of the problem.

Practitioner guidance

• Define runtime response controls Map every user-facing AI flow to a response policy that can block, rewrite, or route outputs before they are delivered.
• Log intervention events Record when a guardrail fires, what condition triggered it, and what response the system took.
• Review implied-authority language Audit prompts, templates, and user interface copy for phrases, titles, or visual cues that could make AI outputs feel clinician-guided or human-authored.

What's in the full article

Lakera's full article covers the operational detail this post intentionally leaves for the source:

• The specific behaviour rules Lakera describes for self-harm prevention and companion chatbot disclosure.
• The practical enforcement model for stopping misleading medical-style outputs at runtime.
• The legal and operational implications of California’s January 1, 2026 timeline for teams serving California users.
• The executive-order context and why it does not change the immediate state-law implementation window.

👉 Read Lakera’s analysis of California’s AI laws and runtime guardrails →

California AI laws and runtime guardrails for user-facing systems?

Explore further

View Full Forum →  |  NHI Foundation Course →