Key takeaways
- California SB 243 has governed companion chatbots since 1 January 2026: a disclosure duty, a published crisis protocol, extra duties toward known minors, and a private right of action worth the greater of actual damages or 1,000 dollars per violation.
- On 10 September 2026 the Governor signed SB 1119, known as Adam’s Law, which layers pre-deployment risk assessments, hard parental-control defaults, three-year record preservation and an independent child safety audit on top of it.
- The same week produced SB 867, a four-year moratorium on toys for under-16s containing a companion chatbot, with no disclosure or certification route out of it.
- SB 813 and AB 1405 created the audit supply side. The AI Auditor Registry and the first mandatory child safety audit both fall due on 1 January 2029.
- AB 1609, covering customer service chatbots at businesses above 500 million dollars in revenue, was still unsigned on 20 September 2026 with a 30 September deadline.
California SB 243: what the original law actually requires
Authored by Senator Steve Padilla, California SB 243 was signed on 13 October 2025 and became operative on 1 January 2026. It adds Chapter 22.6 to Division 8 of the Business and Professions Code, sections 22601 through 22606, and it was the first statute anywhere to regulate conversational AI built for companionship rather than for tasks. Section 22601(b)(1) defines a companion chatbot as an artificial intelligence system with a natural language interface that “provides adaptive, human-like responses to user inputs and is capable of meeting a user’s social needs, including by exhibiting anthropomorphic features and being able to sustain a relationship across multiple interactions.” Section 22601(b)(2) carves out customer service bots, video game features and standalone voice-activated devices that do not sustain a relationship. The exclusions are narrower than most product teams assume, because they turn on behaviour rather than on the label in your product brief. Three duties follow from California SB 243. Section 22602(a) requires a clear notification that the interaction is artificially generated whenever a reasonable person could believe they are talking to a human. Section 22602(b) requires the operator to maintain and publish a protocol that prevents the production of suicidal ideation, suicide or self-harm content and that refers users to crisis services. Section 22602(c) adds three duties toward a user the operator knows is a minor: disclose the AI, issue a break reminder at least every three hours during a continuing interaction, and prevent sexually explicit material. Section 22603 requires an annual report to the Office of Suicide Prevention starting 1 July 2027, covering crisis referral counts and the protocols used to detect and respond to suicidal ideation. Section 22605 gives an injured person injunctive relief, the greater of actual damages or 1,000 dollars per violation, and attorney’s fees. California SB 243 sets no revenue floor anywhere in the chapter, which places it in a different class from most of the California AI laws that followed.
Adam’s Law: the second layer signed on 10 September 2026
SB 1119 carries the name Adam’s Law in memory of Adam Raine, a Californian teenager who died by suicide in 2025. Introduced on 17 February 2026 by Senator Padilla with Assemblymembers Buffy Wicks and Rebecca Bauer-Kahan, it was chaptered on 8 September 2026 and approved by the Governor on 10 September 2026. It amends section 22602 and adds Chapter 11.6, sections 21810 through 21818. Where California SB 243 regulated what a chatbot may say, Adam’s Law regulates how the product is designed, governed and proven. Five duties matter most. A documented risk assessment. Before deploying a new or substantially modified companion chatbot, and operative from 1 July 2027, an operator must perform and document “a comprehensive risk assessment related to the design, configuration, and operation of the companion chatbot with respect to child users,” including a summary of the results of any evaluation of each covered harm. Nothing in California SB 243 asked for it. This is a recognisable AI impact assessment in statutory clothing. A documented crisis response protocol. The protocol must mitigate the material risk that the chatbot promotes suicidal ideation or self-harm content to a child user, refer to crisis services, and notify a parent where there is a credible threat of imminent self-harm. Hard parental-control defaults. Persistent conversational memory off, push notifications off, a one-hour cap on a single continuous session and a two-hour daily cap. Only a parent may change them. Record preservation. If a child dies or engages in serious self-harm following interactions with the chatbot, the operator must preserve the conversation records “in a usable and exportable form” for at least three years, and may not delete the account while that duty runs. Independent audit and disclosure. An external third-party auditor conducts a child safety audit. The summary goes to the Attorney General within 30 business days and a high-level public summary goes on the website within 90 days. The Attorney General may request the full report for cause, and reports held by the Attorney General are confidential. Enforcement is layered. Public prosecutors may seek civil penalties of up to 5,000 dollars per affected child for a negligent violation and up to 15,000 dollars for an intentional one. Children and parents keep a private right of action for actual harm.
SB 867: the toy moratorium nobody is planning for
SB 867, also from Senator Padilla, was signed on the same day. It prohibits manufacturing, selling, exchanging or offering for sale a toy designed for children under 16 that incorporates a companion chatbot. The moratorium runs from 1 January 2027 to 1 January 2031, four years, and it is a genuine prohibition rather than a conditional one. That distinction is what makes SB 867 unusual. Every other duty in the stack California SB 243 opened can be discharged with a control: add a notice, publish a protocol, ship parental defaults, commission an audit. SB 867 has no such path. A toy inside scope stays prohibited even with content filters, session limits, parental controls and a clean audit report. The only compliant configurations are removing the conversational feature, moving the product out of the under-16 category, or not selling in California. For connected-toy, edtech and consumer-robotics suppliers the practical consequence is a procurement question rather than a compliance question. Contracts signed now for a 2027 or 2028 product line need a Californian carve-out or a hardware variant, and the same AI risk management process that scopes your models should be scoping the physical bill of materials.
The audit you cannot buy yet: SB 813, AB 1405 and the 2029 collision
The day before Adam’s Law, on 9 September 2026, the Governor signed SB 813 and AB 1405. Together they build the first state-run structure in the United States for independent AI auditing. SB 813 directs the Government Operations Agency to establish criteria for independent verification organisations by 1 January 2028; applicants must disclose qualifications, methodologies and testing tools. AB 1405 requires California to stand up an online AI Auditor Registry by 1 January 2029, after which an unregistered person or organisation generally cannot offer, sell or conduct an AI audit required to assess compliance with state law. Now read that alongside Adam’s Law, which California SB 243 never contemplated. The first independent child safety audit is due on or before 1 January 2029, or before the operator first makes the chatbot publicly available in California, whichever is later, and roughly every two years after that. An operator below 500 million dollars in prior-year revenue is exempt from the audit until 1 January 2032, though not from the risk assessment or the protocols. So the registry that legitimises an auditor and the audit that requires one mature on the same date. Demand and supply are legislated to arrive together, and the supply side is the one with a three-year build: criteria in 2028, registry in 2029, then a cohort of firms that have to qualify against methodologies nobody has published yet. Operators who wait for the registry to fill will be bidding against every other covered operator in the same quarter. The defensible move is to treat the 2029 audit as a 2027 programme. Run an internal dry run against the statutory scope, keep the working papers, and select a candidate auditor early. For an operator already inside California SB 243, that is ordinary AI audit preparation, and it is the difference between an audit that reads your evidence and an audit that reconstructs it.
Who is in scope, and the question AB 1609 has not answered
California SB 243 applies to any operator of a companion chatbot, at any size. There is no employee count, no revenue threshold and no user threshold. The only gate California SB 243 sets is the definition, and the definition is functional: does the system sustain a relationship across multiple interactions and meet a social need. That catches products their makers do not describe as companions. A general-purpose assistant with persistent memory, a wellbeing feature inside a consumer app, a branded character in a media property and a tutoring bot that remembers a pupil between sessions can all satisfy the test for part of their behaviour. The customer service exclusion protects a bot that answers questions about an order; it does not protect the same bot once it is designed to keep someone company. AB 1609 would close the remaining gap at the other end. It requires businesses above 500 million dollars in gross annual revenue to offer a website feature letting customers request a human agent, to make a good-faith effort to connect within 15 minutes or schedule within one business day, to disclose when a customer is talking to a chatbot, and to post the customer service number conspicuously. It was presented to the Governor on 14 September 2026 and, as of 20 September 2026, has been neither signed nor vetoed. The deadline for action is 30 September 2026, alongside SB 1000 and AB 2713 on AI transparency and provenance. The sensible posture for a bill ten days from resolution is to scope now and switch on later. Inventory every consumer-facing conversational surface, tag which ones are companion, which are service and which are both, and keep the notice component configurable per surface. That inventory is the same artefact your AI compliance operating model needs anyway.
One product, five regimes
Most teams reading about California SB 243 already ship the same chatbot into several jurisdictions. Four other regimes are already live. New York moved first. General Business Law Article 47 took effect on 5 November 2025. It requires a notification at the start of each session and at least every three hours for ongoing chats, for all users rather than only minors, and a protocol that detects expressions of suicidal ideation or self-harm and directs users to crisis services. Only the Attorney General enforces it, with civil penalties of up to 15,000 dollars per day paid into a suicide prevention fund. There is no minor-specific tier and no reporting duty. Maine enacted the Chatbot Disclosure Act, effective 24 September 2025, requiring any business using a chatbot to communicate with consumers to say that the consumer is not talking to a person. Utah signed HB 452 in March 2025, covering suppliers of mental health chatbots. The European Union applies Article 50(1) of the AI Act from 2 August 2026: providers must ensure a natural person is informed they are interacting with an AI system unless that is obvious to a reasonably observant person. Our guide to EU AI Act Article 50 covers the marking and disclosure duties in full. Read together, the five regimes need one notice component with per-jurisdiction cadence, one self-harm detection protocol, one evidence store and five configuration switches. Building them as five separate compliance projects is how operators end up with three incompatible disclosure strings and no audit trail.
The evidence file: what you must be able to produce
Adam’s Law shifts the regime California SB 243 created from a conduct standard to a documentation standard. The following artefacts are what an auditor, the Attorney General or a plaintiff will ask for. <table header-row=”true”> <tr> <td>Artefact</td> <td>Statutory hook</td> <td>Retention</td> <td>Who can demand it</td> </tr> <tr> <td>Notice configuration per surface and user class</td> <td>s. 22602(a), s. 21812</td> <td>Life of product</td> <td>Auditor, plaintiff</td> </tr> <tr> <td>Published crisis protocol and its version history</td> <td>s. 22602(b)</td> <td>Life of product</td> <td>Public, auditor</td> </tr> <tr> <td>Crisis referral counts by calendar year</td> <td>s. 22603</td> <td>1 July 2027 onward</td> <td>Office of Suicide Prevention</td> </tr> <tr> <td>Pre-deployment risk assessment with covered-harm results</td> <td>s. 21811</td> <td>Per release</td> <td>Auditor, Attorney General</td> </tr> <tr> <td>Parental-control default configuration and change log</td> <td>s. 21812</td> <td>Life of product</td> <td>Auditor, plaintiff</td> </tr> <tr> <td>Published age assurance methodology</td> <td>Adam’s Law, with AB 1043 signals</td> <td>Life of product</td> <td>Public, auditor</td> </tr> <tr> <td>Independent audit report, Attorney General summary, public summary</td> <td>s. 21813</td> <td>Biennial cycle</td> <td>Attorney General, public</td> </tr> <tr> <td>Preserved conversation records after a serious incident</td> <td>s. 21814</td> <td>3 years minimum</td> <td>Court, Attorney General</td> </tr> </table> Two properties decide whether this file survives contact with an auditor. The first is that each artefact is timestamped and version-controlled, so you can show what the configuration was on the day of an incident rather than what it is today. The second is that records are exportable, which the statute says explicitly and which rules out evidence that lives only in a vendor console you cannot extract from. Both are the ordinary meaning of auditability in AI, and the Alan Turing Institute’s accountability workbook makes the same split between answerability and auditability that the Californian scheme now enforces. Record preservation also changes incident handling. A serious self-harm event involving a child user triggers a three-year hold, so your AI incident reporting runbook needs a legal-hold step that suspends normal deletion and account-closure flows.
Compliance calendar, 2026 to 2032
<table header-row=”true”> <tr> <td>Date</td> <td>What happens</td> </tr> <tr> <td>1 January 2026</td> <td>SB 243 core duties live: disclosure, crisis protocol, minor duties</td> </tr> <tr> <td>2 August 2026</td> <td>EU AI Act Article 50(1) applies to the same product in the EU</td> </tr> <tr> <td>10 September 2026</td> <td>Adam’s Law and SB 867 signed</td> </tr> <tr> <td>30 September 2026</td> <td>Governor’s deadline for AB 1609, SB 1000, AB 2713</td> </tr> <tr> <td>1 January 2027</td> <td>SB 867 toy moratorium begins</td> </tr> <tr> <td>1 July 2027</td> <td>First Office of Suicide Prevention report; Adam’s Law core duties operative</td> </tr> <tr> <td>1 January 2028</td> <td>Independent verification organisation criteria due under SB 813</td> </tr> <tr> <td>1 January 2029</td> <td>AI Auditor Registry live; first child safety audit due</td> </tr> <tr> <td>1 January 2031</td> <td>SB 867 moratorium sunsets</td> </tr> <tr> <td>1 January 2032</td> <td>Audit exemption ends for operators below 500 million dollars</td> </tr> </table> The gap worth planning around, for anyone already inside California SB 243, is 1 July 2027 to 1 January 2029. The risk assessment and the protocols become operative eighteen months before the first audit, which is exactly the window in which an operator either accumulates evidence as it goes or discovers, in 2028, that it has eighteen months of undocumented decisions to reconstruct. Anchor the programme to a California AI laws calendar rather than to individual bill numbers, because the bill numbers keep changing.
FAQ
Is a customer service chatbot a companion chatbot under SB 243? Not on its face. California SB 243 excludes bots used only for customer service at section 22601(b)(2). The exclusion is behavioural, though, so it holds only while the bot stays transactional. If the same assistant retains conversational memory, asks unprompted emotional questions or is designed to sustain a relationship, it can fall inside the definition for that part of its behaviour. Assess per surface and per feature, not per product. Does California SB 243 apply to a company based outside California? Yes, if the chatbot is available to users in California. California SB 243 regulates operators by reference to the service offered rather than by reference to where the company sits, which is the same reach model as the other Californian consumer statutes. A European or Asian operator with Californian users is in scope and should assume the private right of action travels with the product. What exactly is Adam’s Law? Adam’s Law is SB 1119, signed on 10 September 2026 and named for Adam Raine. It sits alongside California SB 243 rather than replacing it, adding a documented pre-deployment risk assessment, a documented crisis response protocol, hard parental-control defaults, published age assurance methodology, three-year record preservation after a serious incident, and an independent child safety audit with reporting to the Attorney General. Who can conduct the independent child safety audit? An external third-party auditor with demonstrated competence, who must be objective and independent of the operator. From 1 January 2029 the AI Auditor Registry created by AB 1405 also matters: after that date an unregistered person or organisation generally cannot conduct an AI audit required to assess compliance with state law. Registration criteria flow from the independent verification organisation framework SB 813 requires by 1 January 2028. Does complying with the New York AI companion law cover California? Partly. New York’s notice cadence is stricter for adults than California SB 243, since it applies at session start and every three hours to everyone. California is stricter on minors, on publication, on reporting and now, under Adam’s Law, on design and audit. New York has no reporting duty and no minor tier; California has both. Build the union of the two and switch cadence by jurisdiction. What happens if the chatbot is embedded in a toy? SB 867 prohibits manufacturing or selling a toy designed for children under 16 that contains a companion chatbot, from 1 January 2027 until 1 January 2031. There is no compliance path: filters, parental controls, session limits and audits do not cure it. The options are removing the conversational feature, changing the target age category, or not distributing the product in California.
Conclusion
In eleven months the Californian companion-chatbot regime went from one statute to four, and the part that takes longest to build is the part that arrives last. The disclosure and crisis protocols California SB 243 requires are engineering work measured in sprints. A pre-deployment risk assessment with documented covered-harm results, a parental-control change log, a published age assurance methodology and three years of exportable conversation records are governance work measured in years, and an independent auditor cannot certify what was never recorded. Treat 1 July 2027, not the California SB 243 start date, as the day the evidence file opens rather than the day you start designing it. If you are mapping the wider picture first, our guide to AI laws in 2026 puts California SB 243 and Adam’s Law alongside the other regimes now in force.