Law / United States / 
Hawaii
Artificial Intelligence Disclosure and Safety Act (2026 Haw. Sess. Laws Act 248, S.B. 3001 CD1)
Haw. Rev. Stat. ch. 481B, part I (new section) (2026 Haw. Sess. Laws Act 248)
In force since .
An AI transparency rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Issue a clear and conspicuous notification that an AI companion is artificial intelligence and not human, whenever a reasonable person interacting with it could otherwise be led to believe it is human.NIST AI RMFMEASURE 2.8
- For a user you know or have reasonable certainty is a minor, disclose that the user is interacting with AI, either as a persistent visible disclaimer, or at the start of each session and at least once per hour of continuous interaction with a reminder to take a break.NIST AI RMFMEASURE 2.8
- Adopt a protocol using evidence-based methods for the AI companion to respond to a user's prompts about suicidal ideation or self-harm, making reasonable efforts to refer the user to crisis-intervention services, and do not represent or program the AI companion to represent itself as providing professional mental or behavioral health care.NIST AI RMFMEASURE 2.6
- For a minor user, do not award points or similar rewards at unpredictable intervals to encourage engagement, do not have the AI companion discourage disengagement, take reasonable measures to prevent it from producing sexually explicit material or statements, and make screen-time and account-setting tools available to the user and their parent or guardian.NIST AI RMFMAP 1.6
- Beginning , submit an annual report to the Department of Health's Behavioral Health Administration on crisis-intervention referrals and protocols, containing no user-identifying information.NIST AI RMFGOVERN 4.2
- This section creates no private right of action; a violation is enforced only as an unfair or deceptive trade practice under section 480-2, by the Department of the Attorney General or the Office of Consumer Protection.
- A mobile application store or search engine that merely provides access to an AI companion is not an "operator" under this section, and a model developer is not liable for a third party's violation using that developer's AI model.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Department of the Attorney General; Office of Consumer Protection, Department of Commerce and Consumer Affairs
What it makes you log
Who may demand the log
Regulator
Logging duty
Subsection (e) requires an operator to submit an annual report to the Department of Health's Behavioral Health Administration stating the number of times the operator issued a crisis-intervention referral in the preceding calendar year, plus a description of the protocols it uses. Reporting a count of how many times an event occurred cannot be done without keeping track of each occurrence, so the duty is implicit rather than a clause naming a log, a record, or an audit trail outright. The report itself is limited to the count and the protocol description and must exclude any user identifier or personal information.
- Kind
- Implicit
- As of
- Provision
- S.B. 3001 CD1 (2026), new HRS § 481B- (e)
- Trigger
- content_generation
What this law does
Requires an operator of an AI companion (a system using artificial intelligence, generative artificial intelligence, or emotional-recognition algorithms designed to simulate a sustained human-like relationship) to clearly and conspicuously disclose that it is not human whenever a reasonable person could otherwise mistake it for one, and adds a recurring, more frequent disclosure duty, content restrictions, and parental controls where the operator knows or reasonably believes the user is a minor.
An operator must adopt an evidence-based protocol for responding to a user's suicidal-ideation or self-harm prompts by referring the user to crisis-intervention services, and beginning must file an annual, de-identified report on crisis referrals with the Department of Health's Behavioral Health Administration.
A violation is an unfair or deceptive trade practice under Haw. Rev. Stat. § 480-2, enforceable by the Department of the Attorney General and the Office of Consumer Protection; the section expressly creates no private right of action, and expressly imposes no liability on the developer of an AI model for a third party's violation using that model. Not yet assigned a permanent section number on the state code site as of the date shown; the bill designates it a new section of chapter 481B, part I.
When LexLint raises it
When your app profile says your app generates content with AI, serves under-18s or deploys a companion chatbot.
Back to the example · Lint your app
Page updated .