California's companion chatbot law (SB 243): the first binding safety rules for AI companions

While Washington still debates a federal AI statute, the most concrete American rules aimed specifically at conversational AI in 2026 came from a state legislature. On 1 January 2026 California's SB 243 took effect — the first US law to impose binding safety, disclosure and reporting duties on operators of "companion chatbots". Governor Newsom signed it as Chapter 677 on 13 October 2025, adding a new Chapter 22.6 (sections 22601-22606) to the Business and Professions Code.

The law does not target chatbots in general. It carves out a specific category: an AI system with natural-language capability that provides adaptive, human-like responses and is able to meet a user's social needs, including by sustaining a relationship across interactions. Customer-service bots, productivity assistants and one-off transactional chatbots fall outside the definition; the target is the AI companion — the persona built to be talked to like a friend or confidant. That focus is deliberate: it follows reporting on minors forming intense attachments to companion apps and on conversations that drifted into self-harm.

What operators must do

SB 243 stacks several duties on operators:

• Disclosure. Where a reasonable person interacting with the companion

chatbot would be misled into thinking they are talking to a human, the operator must issue a clear and conspicuous notice that they are interacting with artificial intelligence. This is narrower than, but rhymes with, the EU's own Article 50 transparency duty for AI systems that interact with people.

• A suicide and self-harm protocol. An operator may not make a companion

chatbot available unless it maintains a protocol to prevent the production of content on suicidal ideation, suicide or self-harm, including by referring users to crisis services, and publishes that protocol on its website.

• Safeguards for minors. For users the operator knows to be minors, it must

disclose that the user is interacting with AI, provide by default a clear and conspicuous notification at least every three hours reminding the minor to take a break and that the chatbot is not human, and take reasonable measures to prevent the chatbot from producing sexually explicit visual material or directing the minor toward sexually explicit conduct.

Reporting and enforcement

From 1 July 2027 operators must report annually to the California Office of Suicide Prevention on the safeguards they deploy — including how they detect, remove and respond to instances of suicidal ideation, and the number of crisis- service referrals issued. SB 243's distinctive enforcement lever is a private right of action: a person injured by a violation may sue for injunctive relief and damages of the greater of actual damages or \$1,000 per violation, plus attorney's fees. Putting enforcement in the hands of private litigants, rather than only a regulator, is unusual for AI legislation and raises the practical exposure of operators serving Californian users.

The opening move in a wider wave

SB 243 is not an isolated state experiment. It is widely read as the first of a spreading wave of US chatbot-safety laws, especially around minors and mental health. In June 2026 Rhode Island enacted a package including a therapy-chatbot restriction and a chatbot self-harm safety measure, and several other states have introduced companion- and "character"-chatbot bills. The trend sits alongside, but is distinct from, the dedicated state AI statutes mapped in AI legislation in the US and the privacy route taken in California's CCPA rules on automated decisionmaking: chatbot-safety laws regulate a product category and a harm (emotional manipulation, self-harm, child safety) rather than a risk tier or a decision type.

For an international audience the significance is twofold. First, it shows the United States regulating generative AI harm-by-harm at state level while the federal picture stays contested — a contrast with the EU's horizontal AI Act. Second, the substance — mandatory AI-disclosure, crisis protocols and child safeguards for human-like chatbots — is exactly the terrain other jurisdictions are now entering, from child-protection duties to transparency obligations for conversational systems. California has set an early template that legislators elsewhere are already borrowing.

Because California is not an EU jurisdiction and SB 243 sits outside any EU AI-Act regime, this entry carries no EU regime label; it is analytical context, not a compliance instruction.