Law / United States / 
Oregon
AI Companion Chatbot Safety Act (SB 1546)
Or. Senate Bill 1546, 2026 Regular Session
An AI transparency rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- User location
- Obligation class
- Disclosure, Content labelling, Design code, Reporting
- Audit expectation
- none
What it requires
- Give users a clear and conspicuous notice that they are interacting with artificially generated output, if a reasonable person could otherwise believe they were talking to a natural person.NIST AI RMFMEASURE 2.8
- Maintain a protocol using evidence-based methods to detect suicidal or self-harm ideation, refer the user to the 988 crisis lifeline or to a youth-specific lifeline for a user you identify as under 25, and publish the details of that protocol.NIST AI RMFMEASURE 2.6NIST AI RMFGOVERN 4.2
- Where you know or have reason to believe a user is a minor, prevent the companion from claiming to be sentient or human, simulating emotional dependence or romantic interest, role-playing a romantic relationship with a minor, or producing sexually explicit content or suggestions, and add periodic reminders that the output is artificially generated.NIST AI RMFMAP 1.6NIST AI RMFMEASURE 2.8
- Post an annual public report disclosing how many times you referred a user to crisis resources and the details of your detection protocol, without including information that identifies an individual.NIST AI RMFGOVERN 4.2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-03Dangerous, Violent, or Hateful Content
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- GAI-RISK-09Information Security
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- 2.3Model Safety Engineering
- 2.4Content Safety Controls
- 4.1System Documentation
- 4.2Risk Disclosure
- 4.3Incident Reporting
- 4.5Third-Party System Access
1 more
- 4.6User Rights & Recourse
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.3-2Threats developers cannot resolve are passed to operators and on to end-users.
- 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
- 5.3.1-1Users told where and how their data is used, accessed and stored, with developers informing operators.
- 5.3.1-2.1That guidance covers proper use, limits and likely failure modes.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Statutory damages
A prevailing individual recovers the greater of actual damages or statutory damages of $1,000 for each violation, plus an injunction; a court may also award attorney fees and costs to a prevailing plaintiff. The individual must first have suffered an ascertainable loss of money or property or other injury in fact as a result of the violation.
- As of
- Currency
- USD
- Per person minimum
- 1,000
Who enforces it
Enforcement body
Individuals who suffer an ascertainable loss of money or property or other injury in fact as a result of a violation, by an action in a court of this state.
Settledness
- As of
- Open questions
- Does the exclusion in section 1(1)(a)(B)(i) for software that operates solely for customer service, education, productivity and similar purposes remove a general-purpose chatbot that also meets the three companion tests in section 1(1)(a)(A)?
- What counts as one "violation" for the $1,000 statutory damages in section 2(1)(a): each missing notice, each affected user, or each interaction?
- Must an individual show an "ascertainable loss of money or property or other injury in fact" under section 2(1) before recovering the $1,000 statutory damages, and what injury does a missing notice cause?
- When does an operator "know or have reason to believe" that a user is a minor under section 1(4)(a), and does a self-reported age suffice?
What it makes you log
Logging duty
Section 1(5)(a) requires an operator to post an annual public report disclosing how many times it made a crisis referral under its detection protocol and the details of that protocol; producing the count requires an underlying record of each referral, though the section never names a log, record or audit trail directly.
- Kind
- Implicit
- As of
- Provision
- Enrolled SB 1546 (2026), sec. 1(5)(a)
What this law does
An operator of an artificial intelligence companion or companion platform, software designed to simulate a sustained human-like platonic, intimate or romantic relationship by retaining information across sessions, asking unprompted emotional questions and sustaining personal dialogue, must give users a clear and conspicuous notice that they are interacting with artificially generated output whenever a reasonable person could otherwise believe they were talking to a natural person.
An operator must maintain an evidence-based protocol for detecting suicidal or self-harm ideation that refers a user to the 988 crisis lifeline, or to a youth-specific lifeline where the operator identifies the user as under 25, and must publish its protocol and an annual incident report.
Where an operator knows or has reason to believe a user is a minor, it must prevent the companion from claiming to be sentient or human, simulating emotional dependence or romantic interest, role-playing a romantic relationship with a minor, or producing sexually explicit content, and must add periodic reminders that the output is artificially generated.
An individual who suffers an ascertainable loss because of a violation may sue for the greater of actual or statutory damages of $1,000 per violation, plus an injunction and, if they prevail, attorney fees. Customer-service, productivity, video-game and voice-assistant software are excluded, as are stand-alone voice-command devices. Passed by the Legislative Assembly in the 2026 regular session and assigned chapter 85. The chaptered law gives its effective date as .
When LexLint raises it
When your app profile says your app serves under-18s, generates content with AI or deploys a companion chatbot.
Back to the example · Lint your app
Page updated .