What AI Companion Chatbot Laws Regulate
AI companion chatbot laws are state statutes that regulate conversational AI systems designed for ongoing relational or emotional interaction with users. Unlike general-purpose AI disclosure bills, these laws focus specifically on the dynamic created when a user forms a social or emotional relationship with a chatbot, including emotional support applications, companionship platforms, and similar products.
The core regulatory concerns across enacted and proposed laws cluster around three areas:
- Disclosure that the user is interacting with an AI system rather than a human
- Detection of self-harm or suicidal ideation, with referral to crisis resources
- Protections specific to minor users, including periodic reminders and session-length considerations
These obligations are not one-time compliance checkboxes. They require enforcement at the interaction layer, integrated into the conversational pipeline, on a continuous basis.
California SB 243
SB 243, authored by Senator Padilla, was passed by the California Legislature in 2025 and signed into law by Governor Newsom. It applies to operators of companion chatbot platforms and establishes three primary obligations.
AI-Identity Disclosure
Operators must disclose to users that they are interacting with an AI system rather than a human. The disclosure obligation applies at the start of interactions and is not satisfied by terms-of-service language alone.
Crisis Escalation Protocol
Operators must implement protocols to detect user expressions of suicidal ideation or self-harm intent and refer those users to crisis service resources, such as a suicide and crisis lifeline. This requirement implies real-time intent classification integrated into the conversational pipeline, not post-hoc conversation review.
Minor-Specific Safeguards
For minor users, operators must provide periodic reminders that the user is communicating with an AI system, and encourage breaks during extended sessions. The periodic nature of this requirement implies session-state tracking: a single onboarding notice is not sufficient.
Engineering Implication
SB 243's requirements are runtime obligations, not policy documents. Crisis detection requires a classification layer in the inference pipeline. The minor-user reminder requires session-state awareness. Both require logging to demonstrate compliance.
New York's Companion Chatbot Provision
New York enacted its companion chatbot requirements as part of state budget legislation rather than as a standalone bill. This structural difference from California's SB 243 is significant for ongoing compliance tracking.
Substantively, the New York provision overlaps substantially with California's approach: it requires AI disclosure to users and a protocol for detecting and responding to signs of self-harm or suicidal ideation by directing users to crisis services.
Because the requirement is embedded in budget legislation, future amendments or clarifications may appear in subsequent budget cycles rather than through a dedicated rulemaking process. Governance teams should monitor for change through budget-cycle review, not just through standard legislative tracking.
Compliance note: For enterprises operating in both states, disclosure and crisis-escalation logic can likely share a common technical foundation, but the definitional scope of "companion chatbot" and specific enforcement mechanics should be verified independently against each state's current statutory text before finalizing compliance mappings.
Side-by-Side Comparison
| Requirement | California SB 243 | New York Provision |
|---|---|---|
| Legislative vehicle | Standalone bill, signed 2025 | State budget legislation |
| AI-identity disclosure | Required | Required |
| Self-harm / suicidal ideation detection | Required, with crisis-resource referral | Required, with crisis-resource referral |
| Minor-specific safeguards | Required: periodic reminders, break encouragement | Not separately enumerated |
| Session-state tracking implied | Yes (periodic reminders require it) | Not explicitly |
| Enforcement mechanism | Subject to California consumer protection enforcement | Via budget legislation; future amendments through budget cycles |
The Broader State-by-State Pattern
Beyond California and New York, multiple states introduced AI chatbot or AI companion-related legislation during the 2025 legislative session, addressing minor safety, mental health chatbot use, and disclosure obligations, according to tracking by the National Conference of State Legislatures (NCSL).
Illinois
Enacted legislation restricting the use of AI in providing mental health or therapeutic services without licensed professional involvement.
Utah
Enacted legislation addressing AI mental health chatbots, including disclosure and data-handling requirements.
Across these enactments, a common pattern is emerging even where statutory language is not uniform: AI-identity disclosure, restrictions or protocols around mental-health-adjacent use cases, and some form of minor-safety or data-handling obligation.
NCSL identifies AI chatbot and companion AI regulation as an active and expanding legislative category. Enterprises should treat California, New York, Illinois, and Utah as an early set, not a closed list.
Runtime Governance Controls for Multi-State Compliance
Meeting these obligations in practice requires enforcement at the point of interaction, not just at the policy or model-training level. The following controls address the primary requirements across enacted state laws.
Disclosure Enforcement
AI-identity disclosure must be surfaced to users reliably at the start of each interaction. This requires a disclosure layer in the conversational pipeline that cannot be bypassed by prompt manipulation or system configuration. Disclosure events should be logged with timestamps and session identifiers to support audit and enforcement response.
Crisis Detection and Escalation
Self-harm and suicidal ideation detection requires a real-time classification component integrated before or alongside response generation. When the classifier identifies a high-risk expression, the system must surface a crisis resource referral, either within the response or as an interstitial before the next AI output. The escalation event and the resource surfaced should be logged.
Session-State Tracking for Minor Users
Periodic reminders for minor users under SB 243 require the system to track session duration and reminder cadence per user. This is distinct from a one-time onboarding notice. Operators must be able to demonstrate that reminders fired at required intervals and that break-encouragement messages were delivered.
Jurisdiction-Aware Policy Routing
Because statutory requirements differ across states, the control layer must be able to apply state-specific policy based on user jurisdiction. A single global policy will undercomply in stricter jurisdictions and may overcomply in ways that create operational friction in others.
Audit Logging
All disclosure events, crisis escalations, minor-user reminders, and policy routing decisions should be written to an immutable audit log. Logs should capture the applicable policy version, the jurisdiction determination, and the specific action taken, not just that an action occurred.
Frequently Asked Questions
Does SB 243 apply to all AI chatbots, or only companion-specific products?
SB 243 applies to operators of companion chatbot platforms, meaning conversational AI systems designed for ongoing relational or emotional interaction. General-purpose assistants, customer service bots, and enterprise productivity tools are not the primary target, but operators whose products include emotional-support or companionship features should evaluate whether their use case falls within scope. Legal counsel should confirm the applicable statutory definition against the current text of the enrolled bill.
Can a single disclosure notice satisfy both California and New York requirements?
The substantive disclosure obligation, that users must know they are interacting with an AI, is common to both states. A shared technical implementation is likely workable. However, the specific framing, timing, and any associated recordkeeping requirements should be verified against each state's current statutory text independently before finalizing the implementation.
How specific must crisis-resource referrals be under SB 243?
SB 243 requires operators to refer users to crisis service resources such as a suicide and crisis hotline. The statute references the national 988 Suicide and Crisis Lifeline as an example. Operators should ensure that the referral is surfaced within the interaction in a way that a distressed user can act on it immediately, not buried in a help menu or terms page.
How should governance teams monitor New York's provision for future changes?
Because New York's companion chatbot requirement is embedded in budget legislation, amendments are more likely to appear in subsequent annual budget cycles than through a standalone rulemaking or bill process. Governance teams should include New York budget legislation in their annual compliance review calendar and not rely solely on general AI legislative trackers.
What is the enforcement risk if a minor-user reminder fails to fire?
SB 243 establishes an obligation, not just a best practice. A system failure that prevents required minor-user reminders from firing creates a compliance gap. Audit logs demonstrating that reminders fired correctly are the primary mechanism for demonstrating compliance and for identifying failures that require remediation. Operators should implement alerting on reminder-delivery failures rather than relying on periodic log review alone.
Is this guide sufficient for finalizing a compliance position?
This guide is intended to support governance and engineering planning. It maps the primary requirements as enacted and identifies the runtime controls those requirements imply. Legal teams should confirm current statutory text, effective dates, and enforcement mechanisms directly before finalizing compliance positions. Statutory language controls over any secondary source.