Law / United States / 
Idaho
Conversational AI Safety Act
Idaho Code sections 48-2201 to 48-2205
An AI transparency rule binding public and private bodies.
- Enforcement body
- Idaho Attorney General
- Obligation class
- Content labelling, Design code
- Audit expectation
- none
What it requires
- If you operate a conversational AI service (an application, web interface, or program accessible to the public that primarily simulates human conversation through text, visual, or aural communication) and a reasonable person could be misled into believing they are interacting with a human, clearly and conspicuously disclose that the service is artificial intelligence.NIST AI RMFMEASURE 2.8
- Adopt a protocol for the service to respond to user prompts about suicidal ideation, including reasonable efforts to refer users to crisis services such as a suicide hotline or crisis text line, and do not cause the service to represent that it provides professional mental or behavioral health care.NIST AI RMFMEASURE 2.6NIST AI RMFMAP 3.3
- For a minor account holder, disclose the AI's non-human status either as a persistent visible disclaimer or at the start of each session and at least every three hours; do not use unpredictable reward mechanics to increase engagement; take reasonable measures against sexually explicit content directed at the minor and against statements suggesting the AI is sentient, human, romantically or sexually interested, or emotionally dependent; and offer account and privacy management tools to minors and to the parents or guardians of those under thirteen.NIST AI RMFMEASURE 2.8NIST AI RMFMAP 1.6
- If you develop an AI model that a third-party operator makes available to the public as a conversational AI service, you are not liable under this chapter for that operator's violation of it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-03Dangerous, Violent, or Hateful Content
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
The operator is liable for whichever is greater: the per-violation civil penalty, capped in the aggregate at $500,000 per operator, or actual damages. The chapter takes effect .
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 500,000
- Per violation unit
- Violation
- Per violation amount
- 1,000
What it makes you log
Logging duty
Sections 48-2203 through 48-2205 require the human-interaction disclosure, the suicidal-ideation response protocol, the minor protections and account tools, and the Attorney General's civil-penalty enforcement; none of them states a duty to create or keep a record of a conversation or of the disclosures given.
- Kind
- None
- As of
What this law does
An operator, a person who makes a conversational AI service (an artificial intelligence application, web interface, or program accessible to the general public that primarily simulates human conversation through text, visual, or aural communication, with exceptions for developer or research tools, features that are not themselves a conversational AI service, business-internal or business-to-business tools, voice assistants for consumer electronics, and enterprise-only platforms) available to the public, must clearly and conspicuously disclose that the service is artificial intelligence if a reasonable person could otherwise be misled into believing they are interacting with a human.
An operator must adopt a protocol for responding to user prompts about suicidal ideation, including referring users to crisis services, and may not cause the service to represent that it provides professional mental or behavioral health care.
For a minor account holder, an operator must give a persistent visible disclaimer, or disclose at the start of each session and at least every three hours, must not use unpredictable reward mechanics to increase engagement, must take reasonable measures against sexually explicit content and against statements suggesting the AI is sentient, human, romantically or sexually interested, or emotionally dependent, and must offer account and privacy management tools to minors and to the parents or guardians of those under thirteen.
A violation is subject to an injunction and a civil penalty of $1,000 per violation up to $500,000 per operator, or actual damages, whichever is greater, sought exclusively by the Attorney General; the Act creates no private right of action and does not make an AI model's developer liable for a third-party operator's violation. Enacted in 2026 as Senate Bill 1297 (Session Law Chapter 249), signed , and effective .
Title 48 Chapter 21 had already been claimed the same session by the Stop Harms from Addictive Social Media Act, so the live Idaho Statutes site carries this Act as Chapter 21 [22] and numbers its own sections 48-2201 to 48-2205, superseding the 48-2101 to 48-2105 numbering in the enacting bill's own text. A narrower 2025 predecessor limited to chatbot disclosure, House Bill 127, died in the House Business Committee.
When LexLint raises it
When your app profile says your app deploys a chatbot, generates content with AI, processes voice recordings or serves under-18s.
Back to the example · Lint your app
Page updated .