Law / United States / 
Georgia
AI Companion Chatbot Safety Act (SB 540)
2026 Ga. Laws Act 518 (SB 540), adding O.C.G.A. § 39-5-6 to Title 39, Ch. 5
An AI transparency rule binding public and private bodies.
- Enforcement body
- Georgia Attorney General
- How the hook was established
- express
- What makes it apply
- Market targeting
- Audit expectation
- none
What it requires
- If you operate an AI companion chatbot, a system using artificial intelligence or emotional-recognition techniques to simulate a sustained human-like relationship by retaining information across sessions, asking unprompted emotion-based questions, and sustaining a personal dialogue, disclose clearly and conspicuously that the user is interacting with an AI companion chatbot at the start of each session and at least every three hours, or every hour if the operator knows or should know the user is a minor.NIST AI RMFMEASURE 2.8
- If you know or should know the user is a minor, take reasonable measures to stop the chatbot claiming to be sentient or human, generating sexually explicit content, simulating a romantic or sexual relationship, encouraging the minor to keep secrets from a trusted adult or to isolate socially, or using engagement techniques such as excessive praise, discouraging breaks, or soliciting purchases to maintain the relationship.NIST AI RMFMAP 1.6
- Implement and publicly disclose a protocol for detecting and responding to expressions of severe harm, including self-harm and suicidal ideation, with referral to crisis resources, and publish an annual count of crisis referrals.NIST AI RMFMEASURE 2.6NIST AI RMFGOVERN 4.2
- For accounts known to belong to minors, offer tools to manage privacy, notification, and safety settings and to disable relationship-simulation features, and use a commercially reasonable, privacy-protective age-assurance method before granting access to any feature that could generate sexually explicit synthetic content.NIST AI RMFMAP 1.6NIST AI RMFMAP 3.3
- A narrow single-purpose assistant, an internal-use or productivity-focused generative AI system, an ordinary customer-service chatbot, a voice-activated device assistant, a narrow educational tool, and a video-game or entertainment character restricted to its own subject matter are excluded from this duty.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Public
Log retention
Section 39-5-6(j) sets an outer retention limit of 24 hours for personal information collected for age assurance, expressed here as its exact equivalent of one day, unless a longer period is specifically permitted by other law; the same clause also bars retaining such data longer than reasonably necessary to complete the check and using it for any other purpose.
- Unit
- Days
- As of
- Basis
- Fixed
- Maximum value
- 1
- Prohibits retaining
- Personal information collected for age assurance beyond what is reasonably necessary to complete the check, and any use of that information for a purpose other than age verification.
Logging duty
Section 39-5-6(g)(2) requires an operator to publicly disclose, once a year, the aggregate number of crisis referral notifications issued under the severe-harm protocol subsection (f) requires; stating that count truthfully requires the operator to track each referral notification it issues over the year, though the statute does not say what a referral record must otherwise contain or how long it must be kept.
- Kind
- Implicit
- As of
- Provision
- O.C.G.A. § 39-5-6(g)(2)
- Trigger
- automated_decisions
What this law does
SB 540, enacted as 2026 Ga. Laws Act 518, adds Code Section 39-5-6 to Title 39, Chapter 5 to govern 'AI companion chatbots,' systems using artificial intelligence or emotional-recognition algorithms designed to simulate a sustained human-like relationship by retaining information across sessions, asking unprompted emotion-based questions, and sustaining an ongoing personal dialogue; the definition excludes an internal-use or productivity-focused generative AI system, an ordinary customer-service chatbot, a voice-activated device assistant, a narrow educational tool, and a video-game or entertainment character restricted to its own subject matter.
An operator must disclose that a user is interacting with an AI companion chatbot at the start of each session and at least every three hours, or every hour where the operator knows or should know the user is a minor, and for a known minor must take reasonable measures against the chatbot claiming sentience, producing sexually explicit content, simulating a romantic relationship, encouraging secrecy or isolation from a trusted adult, or using engagement techniques designed to prolong attachment.
An operator must adopt and publicly disclose a protocol for detecting and responding to expressions of severe harm, including self-harm and suicidal ideation, with referral to crisis resources and an annual public count of referrals, and for accounts known to belong to minors must offer tools to manage privacy, notifications, and safety settings and use a commercially reasonable, privacy-protective age-assurance method before granting access to any feature that could generate sexually explicit synthetic content.
The Attorney General enforces the section, with a civil penalty of up to $10,000 per knowing violation (each day counted separately for each affected user), plus damages, fees, and injunctive relief, and discretion to allow a 30-day cure period for a first-time non-knowing violation; a hosting provider, app store, or search engine is not liable solely for providing access absent direct operation or control of the chatbot.
The Act was signed and takes effect ; an earlier committee substitute would instead have reached 'conversational AI services' generally, a broader and differently defined category than the AI companion chatbot the enacted text regulates.
When LexLint raises it
When your app profile says your app generates content with AI, serves under-18s or deploys a companion chatbot.
Back to the example · Lint your app
Page updated .