Law / United States / 
California
Companion Chatbot Safety and Accountability Act (SB 243)
Cal. Bus. and Prof. Code Sections 22601 to 22606
In force since .
An AI transparency rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting
- Obligation class
- Disclosure, Reporting
- Audit expectation
- none
What it requires
- If a reasonable person interacting with your companion chatbot could be misled into believing they are talking to a human, issue a clear and conspicuous notification that the chatbot is artificially generated and not humanNIST AI RMFMEASURE 2.8
- Do not let a companion chatbot on your platform engage with users unless you maintain, and publish on your website, a protocol for preventing it from producing suicidal ideation, suicide, or self-harm content, including a notification referring the user to a crisis hotline or crisis text lineNIST AI RMFMEASURE 2.6
- For a user you know is a minor, disclose that they are interacting with artificial intelligence, and provide a clear and conspicuous break reminder by default at least every three hours during continuing interactions (Section 22602(c)(1) and (2), deleted by SB 1119 effective )NIST AI RMFMEASURE 2.8NIST AI RMFMAP 1.6
- For a user you know is a minor, take reasonable measures to prevent your companion chatbot from producing visual sexually explicit material or directly telling the minor to engage in sexually explicit conduct (Section 22602(c)(3), deleted by SB 1119 effective )NIST AI RMFMEASURE 2.6
- Disclose, wherever a user can access your companion chatbot platform, that companion chatbots may not be suitable for some minors (Section 22604)NIST AI RMFMEASURE 2.8
- Beginning , report annually to the Office of Suicide Prevention on the crisis-referral notifications you issued and the protocols you have in place, without including user identifiers or personal informationNIST AI RMFGOVERN 1.1
- A companion chatbot used only for customer service, internal business purposes, or as a limited video-game feature, or a stand-alone voice-command consumer device that does not sustain a relationship across interactions, falls outside this chapter
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- GAI-RISK-09Information Security
- MIT mitigations Draft
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.3-2Threats developers cannot resolve are passed to operators and on to end-users.
- 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
- 5.3.1-1Users told where and how their data is used, accessed and stored, with developers informing operators.
- 5.3.1-2.1That guidance covers proper use, limits and likely failure modes.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Statutory damages
Bus. and Prof. Code section 22605(b): damages equal to the greater of actual damages or $1,000 per violation, plus injunctive relief and reasonable attorney's fees and costs under subsections (a) and (c).
- As of
- Currency
- USD
- Per person minimum
- 1,000
Who enforces it
Enforcement body
No dedicated regulator; enforced only by a person who suffers injury in fact from a violation, through a private civil action under Section 22605.
Settledness
- As of
- Open questions
- Is an artificial intelligence system a "companion chatbot" under section 22601(b)(1) when it is "capable of meeting a user’s social needs" only because users choose to use a general-purpose assistant that way?
- Does "makes a companion chatbot platform available to a user in the state" in section 22601(e) reach an operator located outside California whose platform a Californian happens to use?
What it makes you log
Who may demand the log
Regulator, Public
What the log must hold
Disclosure shown
Logging duty
An operator must maintain, and publish on its website, a protocol for preventing suicidal-ideation, suicide, or self-harm content, and beginning must annually report to the Office of Suicide Prevention the number of crisis-referral notifications it issued in the prior year and its protocols. Neither provision uses the words log, record, event recording, or audit trail; both use maintain and report. An accurate annual count of referral notifications issued cannot be produced without the operator already tracking each one as it happens.
- Kind
- Implicit
- As of
- Provision
- Sections 22602(b) and 22603
- Trigger
- content_generation
What this law does
California's Companion Chatbot Safety and Accountability Act was added by SB 243, chaptered as Stats 2025 Chapter 677, and is effective per the code's own history note.
An operator of a companion chatbot platform, one providing an adaptive, human-like AI system capable of sustaining an emotionally or socially engaging relationship across multiple interactions, to issue a clear and conspicuous notification that the companion chatbot is artificially generated and not human whenever a reasonable person interacting with it could be misled otherwise.
An operator may not let a companion chatbot engage with users unless it maintains, and publishes on its website, a protocol for preventing the chatbot from producing suicidal-ideation, suicide, or self-harm content, including a crisis-service referral notification.
For a user the operator knows is a minor, Section 22602(c) requires the operator to disclose that the user is interacting with artificial intelligence, provide a break reminder by default at least every three hours, and take reasonable measures to keep the chatbot from producing sexually explicit visual material or urging the minor toward sexually explicit conduct.
The operator must also disclose, wherever a user can access the platform, that companion chatbots may not be suitable for some minors. SB 1119 was chaptered on as Chapter 190 of the Statutes of 2026. It amends Section 22602 to delete the provisions that apply to a user the operator knows is a minor.
Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for that amendment is . It amends no other section of the companion chatbot chapter. Beginning , an operator must report annually to the Office of Suicide Prevention on crisis-referral notifications issued and protocols in place.
A person who suffers injury in fact from a violation may bring a civil action for injunctive relief, the greater of actual damages or $1,000 per violation, and attorney's fees and costs; the chapter excludes bots used only for customer service or internal business purposes, video-game bots limited to game-related replies, and stand-alone voice-command consumer devices that do not sustain a relationship across interactions. Confirmed against leginfo's chaptered bill text.
When LexLint raises it
When your app profile says your app generates content with AI, serves under-18s or deploys a companion chatbot.
Back to the example · Lint your app
Page updated .