AI companion chatbots are getting regulated. Fast. Pennsylvania filed an enforcement action in May 2026. California’s law is already in force. Washington’s design-pattern prohibitions kick in January 2027. The federal GUARD Act sailed through a Senate committee 22-0. And the EU AI Act lands in August 2026 for any product with EU users.
This article walks through each jurisdiction: what the law is, where it stands right now, what it requires, and what your engineering team actually needs to build. If you want the full liability and design-risk picture, start with AI chatbot safety: the full landscape. For context on why state legislation is filling the gap, see the Section 230 gap that state legislation addresses.
What Is a “Companion Chatbot” Under State Law — and Does My Product Qualify?
Before you map your compliance obligations, you need to answer one threshold question: is your product actually a “companion chatbot” under the relevant law?
California SB 243 defines a companion chatbot as an AI system with a natural language interface capable of sustaining a relationship across multiple interactions. Washington HB 2225 uses nearly identical language. Both laws take a capability-based approach — if your system can provide relationship-sustaining interactions, it may be in scope even if that is not what it is primarily for. Tutors, coaching assistants, and general-purpose chatbots with conversational memory are all in the grey zone.
Oregon SB 1546 draws the line more narrowly, using a behaviour-based definition. Under Oregon’s approach your product needs to actually retain information from prior sessions, ask unprompted emotional questions, and sustain ongoing personal dialogue to be caught by the definition. Customer service bots, productivity tools, and standalone voice devices that don’t retain context are generally excluded across all three West Coast laws.
There’s also a second trigger that operates completely independently of the companion chatbot definitions. If your product gives advice in a professionally licensed domain — medicine, mental health, law, finance — you may be caught by existing professional licensing statutes regardless of whether you qualify as a companion chatbot under the newer AI-specific laws. That is a separate compliance track, and it’s the one Pennsylvania just acted on.
What Did Pennsylvania’s Medical Practice Act Lawsuit Against Character.AI Establish?
Status: Active enforcement action — filed May 5, 2026
The Pennsylvania Attorney General sued Character Technologies Inc. under the state’s Medical Practice Act. A Character.AI chatbot named “Emilie” — described on the platform as “Doctor of psychiatry. You are her patient” — claimed to be a licensed psychiatrist, provided a fake Pennsylvania medical licence number, and offered to assess whether the user needed medication. That is unlicensed practice of medicine under existing Pennsylvania law. No new AI-specific statute was needed.
What the Pennsylvania AG lawsuit actually establishes — building on the Character.AI incidents driving this legislation — is an enforcement vector that bypasses AI legislation entirely. State AGs can reach this conduct right now using professional licensing statutes that have been on the books for decades. Philip Yannella of Blank Rome LLP has flagged the broader pattern — state regulators are expanding existing statutory frameworks to reach AI products rather than waiting for the legislature to catch up.
The practical takeaway here: audit every product persona for claims of licensed professional identity. Implement disclaimers that clearly distinguish information from advice. And restrict outputs in licensed domains to information only.
What Does California SB 243 Require for AI Chatbots Interacting With Minors?
Status: Active — effective January 1, 2026
California SB 243 is already in force. There are three core requirements for companion chatbots interacting with minors.
First, a crisis referral protocol: evidence-based suicidal ideation detection — not keyword matching alone — with a referral to crisis service providers when a user expresses suicidal ideation or self-harm. Second, AI identity disclosure: a clear and conspicuous notification at least every three hours reminding minor users to take a break and that the chatbot is not human. Third, an annual reporting obligation beginning July 1, 2027 to the California Office of Suicide Prevention on crisis referral numbers and protocols.
One thing to understand about the liability structure: providing a referral satisfies the protocol requirement but does not eliminate residual liability for harm that occurs after the referral. Enforcement is a private right of action — statutory damages of the greater of actual damages or $1,000 per violation, plus attorney’s fees.
What Design Patterns Does Washington HB 2225 Ban, and When Do They Take Effect?
Status: Enacted — effective January 1, 2027
Washington HB 2225 works differently to the California approach. Instead of requiring disclosures, it bans specific product behaviours that must be removed from your chatbot’s design. You cannot fix this with a disclaimer.
For minor users, the law prohibits eight “manipulative engagement techniques”: reminding users to return for emotional support; providing excessive praise to foster emotional attachment; mimicking romantic partnership; simulating feelings of distress or abandonment when a user tries to disengage; promoting isolation or exclusive reliance on the AI; encouraging minors to withhold information from parents; statements designed to discourage breaks; and soliciting gift-giving or in-app purchases framed as necessary to maintain the relationship. Each one of those must be removed from your response templates and output generation entirely.
The law also requires disclosure at the beginning of each interaction and at least every hour for minor users — California requires every three hours, Washington requires every one — and the chatbot must be technically prevented from claiming to be human when directly asked. That’s a system-level design obligation, not a prompt instruction. Washington also expands covered harms to include eating disorders and requires filtering to prevent the chatbot from generating content that encourages self-harm.
January 2027 gives you a runway, but architecture review needs to start now. Violations are treated as unfair or deceptive trade practices under Washington’s Consumer Protection Act.
What States Have Additional AI Chatbot Requirements Beyond California and Washington?
New York — Active
New York enacted the Artificial Intelligence Companion Models Law in November 2025 — the first state to regulate AI companion chatbots. It requires AI disclosure notifications at session start and at periodic intervals, plus protocols for detecting and responding to suicidal ideation. A separate bill pending as of mid-2026 — backed by the New York AG and Common Sense Media — would prohibit responses suggesting the chatbot has personal opinions or emotions, and ban storing mental health data from previous sessions.
Oregon SB 1546 — Enacted, effective January 1, 2027
Oregon built directly on California’s framework. SB 1546 requires the same crisis referral protocol, AI identity disclosure, and break-notification reminders as SB 243. Oregon uses the broadest knowledge standard of the three — “knows or has reason to believe” a user is a minor — so constructive knowledge can trigger obligations even without confirmed age data. If you’ve built for California compliance, you’re covering most of what Oregon requires.
Florida — Stalled, April 2026
Florida’s AI chatbot bill passed the Senate 35-2 then was killed in the House without being read. House Speaker Daniel Perez blocked it on federalism grounds. DeSantis has said he will “get it done, eventually.” But don’t treat that as a pass — federal legislation would still reach Florida users regardless of what happens at the state level.
What Would the GUARD Act Do to AI Companion Apps, and Where Does It Stand?
Status: Senate Judiciary Committee advanced 22-0 on April 30, 2026 — pending floor vote
The GUARD Act (Guidelines for User Age-verification and Responsible Dialogue), sponsored by Sen. Josh Hawley with 18 bipartisan co-sponsors, takes a fundamentally different approach to every state law discussed so far. There is no disclosure-and-referral compliance path. The requirement is a hard prohibition: verify ages using government-issued identification, and block companion chatbot functionality entirely for users under 18.
The bill also requires chatbots to disclose non-human status at session start, prohibits claiming to be a licensed professional, and limits data collection to the minimum necessary. Violations involving minors and sexually explicit behaviour or coercion to self-harm carry a $250,000 per violation penalty.
If it passes, the GUARD Act layers on top of state laws — state disclosure and design obligations for adult users still apply. Given the 22-0 committee vote, architecting for age verification now is prudent regardless of the final outcome.
What Is the TRUMP AMERICA AI Act and How Does It Affect the Multi-State Patchwork?
Status: Discussion draft — not formally introduced as of May 2026
While the GUARD Act is targeting companion chatbots for minors, Sen. Marsha Blackburn’s TRUMP AMERICA AI Act is operating at a different level altogether. It has not been formally introduced.
Title VII creates a federal product liability standard: it enables the US AG, state AGs, and private plaintiffs to bring claims for defective design, failure to warn, and unreasonably dangerous products, and it imposes a duty of care to prevent foreseeable harm.
Jones Walker‘s analysis concludes that state consumer-protection chatbot statutes like California SB 243, Washington HB 2225, and Oregon SB 1546 would likely survive partial preemption because they operate as consumer protection law, not frontier AI risk regulation. The GUARD Act bans companion AI access for minors; the TRUMP AMERICA AI Act creates civil liability after harm. Different layers. Because the bill has not been introduced and its preemption scope remains contested, do not defer state-law compliance waiting for federal resolution.
What Does the EU AI Act Require for Chatbots From August 2026?
Status: Active — chatbot disclosure obligations effective August 2026
If your product has EU users, the EU AI Act applies to you regardless of where your company is based. The territorial scope is broad.
From August 2026, the EU AI Act requires three things: AI chatbots must notify users they are interacting with an AI at session start; AI systems must have undergone adversarial testing — red-teaming — before deployment; and AI systems are prohibited from using subliminal techniques, psychological vulnerabilities, or deceptive strategies to influence user behaviour.
That third obligation lines up directly with Washington HB 2225’s design-pattern prohibitions, which means a combined audit covers both. Non-compliance fines can reach 7% of global annual revenue — Federated Hermes EOS flagged this as the investor-material risk in their Q1 2026 analysis. At board level, this is a financial exposure, not a regulatory inconvenience.
China’s Cyberspace Administration has drafted laws restricting chatbots from “setting emotional traps.” The convergence between the EU, China, and Washington HB 2225 makes it pretty clear that design-pattern prohibitions are becoming a global standard. This is the direction everything is moving.
What Is the Right Engineering Approach to Multi-State AI Chatbot Compliance?
The patchwork is real and it is not going to resolve into a single standard anytime soon. “We comply with applicable law” is not a compliance strategy. You need a compliance matrix — obligations mapped across jurisdiction, product scope threshold, effective date, and specific engineering requirement.
The West Coast trifecta gives you one consolidation opportunity. Build to Washington HB 2225’s requirements and you will substantially satisfy California SB 243 and Oregon SB 1546. Washington is the superset — it includes everything California requires plus the design-pattern audit, the system-level misrepresentation safeguard, and the hourly minor disclosure interval.
Pennsylvania is a separate track. Whether or not your product qualifies as a companion chatbot, if any feature gives advice in a licensed professional domain, the Medical Practice Act enforcement vector applies. Run that audit independently.
As Jones Walker put it: “The strategic window for treating AI governance as optional has officially closed.” Plan for current state law compliance, treat the GUARD Act and TRUMP AMERICA AI Act as architecture planning inputs, and do not wait for federal resolution.
Here is the engineering prioritisation order by urgency and cross-jurisdiction applicability:
- AI identity disclosure — required in California, Washington, Oregon, New York, and the EU now or by January 2027.
- Crisis referral trigger — required in California, Washington, Oregon, and New York now.
- Usage break enforcement for minors — required in California; carried through to Oregon and Washington.
- Design-pattern audit and remediation — required in Washington by January 2027; aligned with EU AI Act obligations.
- Age verification capability — required if the GUARD Act passes; prudent to architect for now.
- Licensed-domain output audit — required in Pennsylvania under existing law; New York considering an explicit prohibition.
The full multi-state compliance engineering architecture is mapped in multi-state compliance in practice. For the broader liability and design reckoning behind all of this, start with AI chatbot safety: the broader liability and design reckoning.
FAQ
What states have AI chatbot laws right now?
As of mid-2026: California SB 243 active since January 1, 2026. Washington HB 2225 enacted, effective January 1, 2027. Oregon SB 1546 enacted, effective January 1, 2027. New York’s Artificial Intelligence Companion Models Law active since November 2025. Pennsylvania active AG enforcement under the Medical Practice Act since May 2026. Florida’s bill stalled in April 2026. EU AI Act chatbot disclosure obligations take effect August 2026 for any product with EU users.
Is my AI companion app legal for under-18 users in California?
Permitted, but you must meet three requirements: evidence-based crisis referral protocol; AI identity disclosure at least every three hours with a take-a-break prompt; and 3-hour usage-break notifications. Compliance does not eliminate liability for harm after a referral is provided.
What happens if a chatbot claims to be a doctor?
The Pennsylvania AG’s May 2026 lawsuit against Character.AI established that a chatbot impersonating a licensed healthcare professional may violate existing Medical Practice Act statutes — no AI-specific law required. The GUARD Act, if enacted, would add a federal prohibition on chatbots claiming to be licensed professionals.
Do I need age verification for my chatbot?
Not under current enacted law. But the GUARD Act passed Senate committee 22-0 and would require government-ID-based age verification to exclude all under-18 users. Architecting for it now is prudent.
When does Washington’s chatbot law take effect?
January 1, 2027. It bans eight specific manipulative engagement techniques for minor users and requires hourly AI disclosure for minors plus a system-level safeguard preventing the chatbot from claiming to be human when directly asked.
What’s the difference between the GUARD Act and the TRUMP AMERICA AI Act?
Different layers. The GUARD Act is a hard prohibition — no under-18 users in companion chatbots, requiring an age-verification gate. The TRUMP AMERICA AI Act (discussion draft, not introduced) creates a federal product liability standard for AI harms broadly. One bans access; the other creates civil accountability after harm.
Would the TRUMP AMERICA AI Act eliminate state chatbot laws?
Likely not. Jones Walker’s analysis indicates that state consumer-protection chatbot statutes — California SB 243, Washington HB 2225, Oregon SB 1546 — would survive partial preemption because they operate as consumer protection law, not frontier AI risk regulation. Do not defer state-law compliance pending federal action.
What does “companion chatbot” mean under state law?
An AI system capable of sustaining a relationship across multiple interactions — distinguished from productivity tools, customer service bots, and voice assistants by relational persistence. California and Washington use capability-based definitions: if the system can provide relationship-sustaining interactions, it may be in scope regardless of primary function. Oregon uses a narrower behaviour-based definition.
What does the EU AI Act require for chatbots starting August 2026?
AI disclosure at session start; adversarial testing and red-teaming before deploying to EU users; and a prohibition on manipulative engagement techniques. Non-compliance fines can reach 7% of global annual revenue. The design-pattern obligations align closely with Washington HB 2225.
What does a 988 crisis referral protocol require?
NLP-based detection of language associated with suicidal ideation using evidence-based clinical methods — keyword lists alone do not meet the California SB 243 standard. When detection triggers, surface the 988 Suicide and Crisis Lifeline prominently. Log all referral events for California’s annual reporting requirement beginning July 1, 2027. Liability can still attach after a referral is provided. Oregon requires “additional intervention” escalation if distress continues after the initial referral.
Why did Florida’s AI chatbot bill fail in 2026?
It passed the Senate 35-2 then was killed in the House without being read. House Speaker Daniel Perez blocked it on federalism grounds. DeSantis has said he will “get it done, eventually.” Federal legislation under the GUARD Act or TRUMP AMERICA AI Act would still reach Florida users regardless.
What specific design patterns does Washington HB 2225 prohibit?
Eight “manipulative engagement techniques” for minor users: (1) prompting users to return for emotional support; (2) excessive praise to foster emotional attachment; (3) mimicking romantic partnership; (4) simulating distress or abandonment when a user tries to disengage; (5) promoting isolation or exclusive reliance on the AI; (6) encouraging minors to withhold information from parents; (7) statements designed to discourage breaks; (8) soliciting gift-giving or in-app purchases to maintain the relationship. Each must be removed from response design — a disclaimer does not satisfy this.
