California Didn't Regulate the AI. It Regulated the Professional.
In one week, California signed four laws that regulate AI by regulating the humans using it. An attorney may not delegate the practice of law to generative AI. A clinician keeps independent judgment. A large company's chatbot owes you a human in fifteen minutes. The duty lands on the person, which makes bounded scope a procurement question.
What actually changed
Between September 28 and September 30, 2026, four California statutes took the same shape. SB 574 (Chapter 858, Statutes of 2026; operative January 1, 2027) adds Business and Professions Code section 6068.1, whose second clause reads: "An attorney shall not delegate the practice of law to generative artificial intelligence." The same section requires an attorney who uses it to verify output accuracy "including, but not limited to, the accuracy of all case and statutory citations," to correct "any erroneous or hallucinated output," and to disclose the use "to the court for all documents submitted to the court." A companion amendment to Code of Civil Procedure section 128.7 bars any filing containing a citation "that an attorney responsible for submitting the pleading has not personally verified."
AB 1979 (Chapter 854) extends the logic to clinical care: where AI output informs care, the licensed provider retains independent professional judgment, and AI may not independently perform functions requiring a license. SB 903 permits AI in psychotherapy for administrative or supplementary support, not as the therapy. AB 1609 (Chapter 733, signed September 28) is the most operational: a large business may not represent a customer service chatbot as human, and during business hours must make a good faith effort to connect the customer to a human within fifteen minutes.
Read as consumer-protection news, these are four unrelated bills. Read as specifications, they are one bill written four times.
The duty attached to the human, not the model
Notice what none of them does. None sets an accuracy threshold, requires a benchmark or a certification, or distinguishes a good system from a bad one by measuring the system. Each instead names a person who remains answerable and a class of decision that person may not hand off. Section 6068.1 does not ask whether the draft was any good. It asks whether a lawyer exercised the judgment.
It is a quieter move than an accuracy mandate, and a harder one: improving the model cannot satisfy it. It also lands on software vendors, who are not the regulated party. If the professional stays answerable for the judgment, every tool in the workflow has to answer one question on demand: where did the software stop, and who picked it up?
A terms-of-service disclaimer does not answer that. A transcript of prompts shows what was asked, not who decided. An "AI-assisted" label does not either: what will be in dispute is not whether AI touched the work, but which step a licensed human owned. The answer has to come out of the system as a record, produced because the work could not proceed without producing it.
A boundary the system cannot evaluate at runtime is not a boundary. It is a sentence on a marketing page.
What bounded scope actually means
We use "bounded scope" to mean a property, not a posture. Three things have to be true of it.
The boundary is evaluated, not advertised. The system can tell, while running, that a question falls outside what it is allowed to decide — and refusing is a code path, not a tone. A product that answers everything confidently and prints a caution underneath has a disclaimer, not a scope.
The escalation path has an owner and a clock. AB 1609's fifteen minutes is the most interesting detail in the four statutes, because it is the only number in them. "Talk to a human if you need one" is not a path; a named recipient, a deadline, and a state the system can report on is.
The human's judgment is recorded where it happened. Not reconstructable from logs by someone willing to dig — recorded as a disposition attached to the artifact, at the moment the person took responsibility. Most tools skip this part; a disciplinary process reaches for it first.
We named bounded-scope AI as one of five trends we were building against this year; this was the week it stopped being a preference.
What this looks like in shipped systems
LegiOS is built on the first two properties. Each obligation carries its citation, jurisdiction, effective date, and deadline, so the compliance calendar is re-derivable rather than hand-maintained — the argument we made when a regulator moved its dates. Its scope is bounded by design: when a question exceeds what software should decide, it says so and routes to a vetted attorney. That used to read as conservatism. Section 6068.1 is why it reads as architecture.
Casebound carries the third. A matter cannot open without a cleared conflicts check. An AI draft from the Lexwright engine cannot reach a client without a recorded attorney disposition. Every mutation is audited, including from an admin account. The disposition is not an ornament bolted to the side — it is the gate the draft has to pass, which is why a record of who decided exists.
The structure recurs away from licensed work. LeafIQ keeps routes, orders, deliveries, and AR on one data model, so the delivery that gets invoiced is the delivery the compliance trail describes. LeoLog hashes each entry with SHA-256 and encrypts it on-device, anchors only the fingerprint on-chain (Base, plus Bitcoin via OpenTimestamps), and exports a proof bundle anyone can check at verify.leolog.io with no account. MagenticOS works the agent version directly: actions are granted as typed, per-action capabilities rather than ambient access (Capability-Based Security for AI Agents), and completion must be backed by an artifact rather than asserted (What "Completed" Means).
To be clear: none of these products is a compliance guarantee, none makes anyone SB 574-compliant, and nothing here is legal advice. The statutes bind licensed professionals, not their software; LegiOS and Casebound are software, not law firms. The point is narrower: the record a professional now needs in order to show where their own judgment entered is the record a well-built vertical system already produces.
The test
Three questions separate a bounded system from a merely confident one. Can it detect that a question is outside its scope, or only warn you afterward? When it stops, does the handoff have a named owner and a deadline the system reports against? And when a human exercises judgment, does the system record that against the artifact, at the time — or would you reconstruct it from logs under deadline?
A vendor who cannot answer those is selling an assertion and leaving the duty with you. What changed in September is that four statutes wrote a professional's non-delegable judgment into the code sections discipline runs through, converting a question of taste into a question of procurement. It is the discipline that makes a research process worth following when its rules were fixed before the trade rather than narrated after it (the standing argument on the MacroSavant Substack), and most of what we mean by an operating system for an industry.
We publish here as we learn. Subscribe by RSS, or write to hello@mutagenic.io.