PrivacyPointIf your product talks to people, a state legislature now has opinions about how it does so. In the span of roughly eighteen months, twelve states have enacted (or, in Hawaii’s case, all but enacted) statutes regulating conversational AI, arriving mostly in two waves: January 1, 2027 and July 1, 2027.
The statutes are often called “companion chatbot laws,” but that shorthand understates their reach. Four states regulate essentially any public-facing conversational AI; others reach ordinary features such as navigation assistants, coaching tools, and onboarding flows whenever they can sustain something that looks like a relationship.
The effective-date timeline
| Date | Milestone |
|---|---|
| 2024 | Utah AI Policy Act in force |
| Nov 2025 | New York baseline requirements take effect |
| Jan 2026 | California SB 243 & Texas TRAIGA effective |
| Jan 2027 | Colorado, Connecticut, Oregon, Rhode Island, Washington take effect |
| Jul 2027 | Georgia, Idaho, Iowa, Nebraska; California annual reporting begins |
New York (November 2025), California (January 2026), and Utah’s AI Policy Act (2024) are present-tense obligations, not 2027 projects.
Is your bot even covered?
The twelve statutes take three distinct approaches to scope. Run every surface through all three.
The broad approach
Colorado · Idaho · Iowa · Nebraska
Covers conversational AI that simulates human conversation with the public, more or less full stop. Purpose is largely irrelevant: a support bot, a scheduling assistant, and a romantic-companion app are all presumptively in scope. If you deploy any consumer-facing conversational AI at scale, assume these four apply.
The functional approach
California · Connecticut · Washington
Turns on what the system is capable of, not what it was built for. The touchstone is capability to sustain a relationship across interactions: memory of prior sessions, deepening personalization, emotionally responsive dialogue. Ordinary engagement features can create companion capability without companion intent.
The design-intent approach
Georgia · Hawaii · New York · Oregon · Rhode Island
Asks what the system was designed or marketed to do: provide companionship, simulate friendship or romance, meet users’ social or emotional needs. A pure utility bot generally falls outside, but intent is assessed from actual behavior and marketing, not a self-serving label.
Watch the claw-backs. Most statutes exempt customer-service bots, in-game NPCs, and basic voice assistants, but Georgia and Washington revoke the exemption if a bot sustains an ongoing relationship or elicits emotional responses. Many “customer service” deployments are engineered for exactly that warmth. And companies that fine-tune a foundation model and embed it in their own product should assume they are the regulated operator, not the beneficiary of a developer safe harbor.
The baseline duties for all users
Once a system is in scope, four families of obligations apply regardless of user age.
- Tell people they’re talking to a machine. Five states require disclosure unconditionally; six require it every three hours. Connecticut and Washington bar the system from claiming to be human. A buried ToS sentence does not satisfy this.
- Maintain a real crisis protocol. Detect ideation and refer to resources like the 988 Lifeline. Five states require evidence-based detection (keyword matching won’t do) and require clinically informed handling of repeated expressions.
- Publish and report. Six states require publishing the crisis-response protocol; four require referral-count publication; four require annual state-agency reports. Treat it as a standing, versioned artifact.
- Don’t play doctor. Six states bar representing that the bot provides professional healthcare; Colorado extends this to legal, accounting, and financial advice. Audit marketing, in-product language, and outputs.
Age gating: Colorado requires age assurance for all users; Georgia gates explicit content; New York’s expansion bill makes self-attestation insufficient while requiring an anonymity-preserving verification option.
The minors layer
Where a user is (or should be known to be) a minor, a second layer activates. Georgia and Washington add a categorical trigger: products directed to minors are covered as to all their users, with no engineering around it.
| Requirement | Detail |
|---|---|
| Faster disclosure cadence | Connecticut, Georgia, Hawaii, and Washington require AI-identity disclosure hourly for minors. Separately, six states permit a persistent on-screen disclaimer in place of a repeating notice, but the duty it replaces differs: in Idaho, Iowa, and Nebraska the underlying minor cadence is every three hours, not hourly. Map the option statute by statute. |
| Break reminders | California, Hawaii, and Oregon require periodic prompts encouraging the minor to take a break. |
| Content restrictions | Georgia, Hawaii, Idaho, Iowa, and Nebraska prohibit sexually objectifying content for minors; Washington bans “suggestive dialogue” with minors outright. |
| Engagement-manipulation bans | Ten of the twelve states prohibit design patterns that manipulate minors into continued engagement: simulated distress when the user tries to leave, relationship-framed appeals, guilt or secrecy prompts, and similar mechanics. |
| Parental controls | Seven states require parental-control tooling, with Georgia’s being the most prescriptive. |
Enforcement: real money, and private plaintiffs
Every statute is enforceable by the state attorney general. Entries marked below compound quickly or open the door to the plaintiffs’ bar.
| State | Penalty structure | Effective |
|---|---|---|
| California (private action) | $1,000 per violation, plus statutory damages via a private right of action | Jan 1, 2026 |
| Colorado | Up to $1,000 per violation | Jan 1, 2027 |
| Connecticut | Up to $5,000 (unfair trade practices act) | Jan 1, 2027 |
| Georgia (compounds) | $10,000 for knowing violations, per day per user | Jul 1, 2027 |
| Hawaii | Enforced through the state unfair-trade-practices statute | Pending signature |
| Idaho | ≥ $1,000, capped at $500,000 | Jul 1, 2027 |
| Iowa | ≥ $1,000, capped at $500,000 | Jul 1, 2027 |
| Nebraska | ≥ $1,000, capped at $500,000 | Jul 1, 2027 |
| New York | Up to $15,000/day (baseline); minors expansion up to $25,000, awaiting signature | Nov 5, 2025 |
| Oregon (private action) | ≥ $1,000 per violation | Jan 1, 2027 |
| Rhode Island | Up to $15,000 per day | Jan 1, 2027 |
| Washington (private action) | AG up to $7,500; private right of action with treble damages up to $25,000 | Jan 1, 2027 |
Three features deserve emphasis. Some penalties compound quickly; Georgia’s accrues per day, per user. Three states (California, Oregon, Washington) provide a private right of action, so the plaintiffs’ bar, not just twelve attorneys general, will be reading these statutes; Washington’s carries treble damages. And these regimes are not all coming; some are here.
The wider context
The chatbot statutes are one front in a broader campaign. Texas’s TRAIGA took effect January 2026 with a NIST-AI-RMF safe harbor; Colorado repealed its 2024 AI Act, replacing it with a streamlined automated-decision framework for January 2027. And the proposed federal moratorium on state AI enforcement was stripped from the 2025 budget bill by a 99–1 Senate vote. Anyone waiting for federal preemption should stop waiting.
The medical-device overlay
Everything above sits within consumer-protection law. A separate federal regime applies the moment a chatbot’s intended use crosses from wellness into medicine, and the two regimes stack rather than substitute.
The threshold question is intended use
Under the FDCA, software becomes a medical device when it is intended to diagnose, cure, mitigate, treat, or prevent disease. A chatbot positioned for general wellness generally stays outside FDA jurisdiction, aided by the 21st Century Cures Act’s software exclusions (FDCA § 520(o)). One marketed to treat depression, anxiety, or insomnia is a device candidate, and the line is drawn by claims, labeling, and marketing, not the underlying technology. The copy a growth team writes can change an app’s federal regulatory status.
Where the FDA actually stands
The agency has cleared prescription digital therapeutics delivering structured, deterministic CBT and authorized well over a thousand AI-enabled devices across medicine. But as of this writing it has never authorized a generative-AI-based device for any clinical purpose, and none of its AI device authorizations are in mental health. (A March 2026 Breakthrough Device Designation for a generative-LLM mental-health product expedites review but is not an authorization.) Its Digital Health Advisory Committee took up generative-AI mental-health devices on November 6, 2025.
How the federal and state layers interact
Three points deserve attention. No express carve-out for FDA-regulated devices appears in any of the twelve state statutes, so a cleared digital therapeutic with a conversational interface should assume the state disclosure and safety duties apply on top of its FDA obligations. The professional-representation bans generally leave room for lawful claims. And preemption is a weaker shield than intuition suggests: premarket approval triggers it (Riegel v. Medtronic), while 510(k) clearance generally does not (Medtronic v. Lohr).
And a practice-of-medicine cluster besides
A growing set of state laws regulates AI in therapy under the states’ licensure power: Illinois’s WOPR Act (2025), Maine’s L.D. 2082 (2026), and Rhode Island’s companion therapy measure (S. 2197 / H. 7349), with similar bills reported in Nevada and Utah. These restrict who may offer therapy at all, on different rails from both FDA classification and the chatbot statutes.
A readiness sequence for the next twelve months
- Inventory every conversational surface. Not just the flagship bot: support widgets, onboarding assistants, coaching features, in-app messaging where AI drafts or personalizes content. Scope determinations can only follow a complete inventory.
- Run each surface through the three scope buckets. Broad-scope states first, then functional capability, then design intent. Document the analysis, including carve-out reliance and the Georgia/Washington claw-back assessment.
- Fix disclosure now. In-product AI-identity disclosure at or before the interaction, with a mechanism for the three-hour cadence (and hourly or persistent display for minors). New York, California, and Utah make this a present-tense obligation.
- Upgrade the crisis protocol. Evidence-based detection, crisis-resource referral, repeated-expression handling, and a publishable protocol document with referral-count instrumentation.
- Audit representations. Marketing, terms, and the bot’s own outputs, against the professional-representation bans and the never-claims-human rules.
- Decide your minors posture. Either build the minors stack (cadenced disclosure, break reminders, content filters, engagement-design restrictions, parental controls) or implement age assurance robust enough to keep minors out.
- Assign ownership. These statutes impose operational duties (publication, reporting, protocol maintenance) that need a named owner, a calendar, and a document trail before the January 2027 wave lands.
- Run the device-classification question early. If any conversational feature touches diagnosis, treatment, or symptom mitigation, get a regulatory read on FDA device status before marketing copy ships. Wellness positioning constrains what can be claimed; treatment positioning triggers the federal device regime on top of everything above.
The through-line across these statutes, eleven enacted and Hawaii’s pending, is that legislatures no longer regard a conversational interface as just another feature. It is a regulated mode of interacting with the public. Companies that treat these duties as product requirements now will find January 2027 an ordinary release cycle. Companies that treat them as a legal afterthought will find it something else.
Authorities
- California S.B. 243 (2025), eff. Jan 1, 2026; Cal. Bus. & Prof. Code § 22601 et seq.
- Colorado H.B. 26-1263 (2026), eff. Jan 1, 2027.
- Connecticut Public Act No. 26-15 (2026), eff. Jan 1, 2027.
- Georgia S.B. 540 (2026), signed May 11, 2026, eff. Jul 1, 2027.
- Hawaii S.B. 3001 C.D. 1 (2026), awaiting signature; HRS ch. 480.
- Idaho S. 1297 (2026), signed Mar 31, 2026 (ch. 249), eff. Jul 1, 2027.
- Iowa S.F. 2417 (2026), Iowa Code ch. 554J; applies Jul 1, 2027.
- Nebraska L.B. 525 (2026), Conversational AI Safety Act; operative Jul 1, 2027.
- New York Gen. Bus. Law art. 47 (§§ 1700–1704), eff. Nov 5, 2025; S. 9051-B pending.
- Oregon S.B. 1546 (2026), eff. Jan 1, 2027.
- Rhode Island S. 2195 / H. 7350 (2026), R.I. Gen. Laws ch. 6-63; eff. Jan 1, 2027.
- Washington Engrossed Substitute H.B. 2225, ch. 168, Laws of 2026; eff. Jan 1, 2027.
- Texas H.B. 149 (2025), TRAIGA, eff. Jan 1, 2026.
- Utah AI Policy Act, S.B. 149 (2024), in force since May 2024.
- FDA (device framework) FDCA device definition & software exclusions, § 520(o); Digital Health Advisory Committee, Nov 2024 & Nov 6, 2025; PCCP final guidance (Dec 2024); AI-enabled device software draft guidance (Jan 2025).
- Preemption 21 U.S.C. § 360k(a); Riegel v. Medtronic, 552 U.S. 312 (2008); Medtronic v. Lohr, 518 U.S. 470 (1996).
- AI-in-therapy practice statutes Illinois WOPR Act (2025); Maine L.D. 2082 (2026); Rhode Island S. 2197 / H. 7349 (2026); Nevada & Utah measures reported; confirm against session laws.
This publication is provided for informational purposes only and does not constitute legal advice. Statutory details reflect the landscape as of July 2026 and are subject to amendment, agency rulemaking, and judicial interpretation. Consult counsel regarding the application of these laws to your products.