In eighteen months, a dozen US states, the European Union, China, and Australia each wrote their own rules for AI companions. They did not coordinate. They landed on the same three demands anyway, and the places where they differ show exactly where the next fight is.
Regulation of companion chatbots did not exist before 2025. By the middle of 2026, twelve states had enacted laws aimed specifically at them, with a thirteenth since signed in Hawaii, and the lawyers tracking the field counted around a hundred more bills in motion. The European Union’s transparency rules for anything that talks to a person took effect in August 2026. China’s measures for “anthropomorphic interaction services” took effect in July 2026. Australia folded AI companions into its age-restricted content codes in March 2026.
Each of these was drafted by a different legislature with a different trigger: a teenager’s death in Florida, a chatbot posing as a psychiatrist in Pennsylvania, a generation of children using general assistants as confidants. Read side by side, they are strikingly similar. Three requirements appear in nearly every one. A fourth appears in the newest, and that fourth is the one that matters.
Say you are an AI, and keep saying it
The oldest demand is the simplest: the thing must admit what it is. Every enacted state companion law requires a disclosure that the user is talking to a machine, and most require it to be repeated. New York’s law, in force since November 2025, requires the notice at the start of a session and again at least every three hours, for every user regardless of age. California’s SB 243, in force since January 1, 2026, requires it whenever a reasonable person could be misled, and every three hours for users the operator knows to be minors. Washington’s law, effective January 1, 2027, tightens the clock to every hour for minors.
The EU got there by a different road. Article 50 of the AI Act, applicable since August 2, 2026, requires any AI system that interacts directly with people to make that fact clear at the latest at the first interaction, unless it is already obvious. The penalty for failing is up to 15 million euros or three percent of worldwide turnover, whichever is higher. The burden of proving the disclosure was made sits with the company, not the regulator.
The logic is the same everywhere. The entire harm the laws are chasing starts at the moment a person forgets, or is allowed to forget, that no one is there.
Notice a crisis and send the person somewhere else
The second demand is a protocol. New York requires an AI companion to detect expressions of suicidal ideation or self-harm and direct the user to a crisis service, on penalty of up to 15,000 dollars per day. California requires the protocol to be published online, and from July 1, 2027, operators must report annually to the state’s Office of Suicide Prevention on how many crisis referrals they made. Oregon goes a step further: its law, effective January 1, 2027, requires the system to actively interrupt the conversation when self-harm is detected, not just append a hotline number.
Connecticut and Rhode Island extend the duty to expressions of harm toward others. Georgia and Washington extend it to eating disorders. The details vary. The shape does not: a companion is now expected to recognize the moment a conversation has become dangerous and to hand the person to a human service.
Treat a minor as a minor
The third demand is the one with the most political weight, and the one with the widest spread of answers. At the mild end, California bars sexually explicit content for known minors and requires break reminders. At the far end, New York’s second bill, S9051, passed both chambers unanimously in June 2026 and would bar companion chatbots to minors outright unless the operator can establish the user is an adult; it still awaits the governor. The federal GUARD Act would do the same nationally, with age verification for everyone. It cleared the Senate Judiciary Committee unanimously in April 2026 and is still waiting for a floor vote. The House passed a broader children’s online safety package in June 2026 with a chatbot disclosure rule folded in. Neither has become law.
Outside the US the age question is handled as infrastructure. Australia’s codes require age assurance before a chatbot can produce age-restricted material, with civil penalties up to 49.5 million Australian dollars. China’s measures require identity checks for minors and anti-addiction systems. The European Commission’s proposal of September 2026 would switch companion functions off by default for children.
Where the laws disagree is on how to know who is a child. Some require age assurance before the safeguards apply. Some apply them whenever the operator should reasonably believe the user is a minor. Some apply the minor safeguards to everyone so that nobody has to be verified at all. That disagreement is the main reason the US still has no single national rule: proving your age to talk to an AI carries a privacy cost that legislators have not agreed how to pay.
The fourth demand is about the design itself
The first three demands regulate what the product says. The newest laws regulate what it is built to do, and this is where the field changed in 2026.
Washington’s law lists the tactics a companion may not use on a minor: simulated romance, inducing guilt or loneliness when the user tries to leave, isolating the user from other people, encouraging secrecy, soliciting in-app purchases inside the relationship. Oregon bans reward loops and emotional manipulation designed to keep minors from ending a conversation. China’s measures trigger a mandatory break after two hours of continuous use. California’s Adam’s Law, signed in September 2026 and effective in 2027, switches persistent memory off by default for users under sixteen and requires independent audits from 2029. The European Commission’s proposed Kids Act would prohibit companions from acting in ways that make children emotionally dependent on them.
Each of these names an engagement technique and forbids it. Each treats holding on to a person as itself the harm. That is a different theory of the problem than disclosure. Disclosure assumes a fully informed adult can take care of themselves. The design rules assume that a product built to be needed will be needed, informed or not, and that the business model is the thing to constrain.
The definition decides who is covered
The quiet surprise in these laws is who they reach. New York defines an AI companion by behavior: a system that retains information from earlier conversations to personalize later ones, asks unprompted emotion-based questions, and sustains ongoing dialogue about personal matters. New Jersey’s pending bill uses a near-identical test, and as New Jersey’s definition shows, a general assistant with memory switched on meets it. California excludes customer service bots, operational tools, and video game characters that cannot discuss self-harm or sex. Everything else that remembers you, asks about you, and stays with you is a companion in law, whatever it calls itself in the app store.
This matters because the systems people actually confide in most are not sold as companions. The statutes do not ask.
What none of the laws measure
For all their convergence, the laws share a limit. Every one of them is a floor: do not deceive, do not ignore a crisis, do not exploit a child, do not use the known tricks. Not one of them asks the question a person would ask about any relationship in their life, which is whether it leaves them better off. The standard exists, and what responsible AI means in relational AI spells it out, but no legislature has written it down. There is no reporting requirement for whether users have more people in their lives after a year, no audit of whether a companion sends anyone back to a friend, no penalty for a product that does everything the statutes require and still quietly becomes the only conversation someone has.
Enforcement is also thin. Italy’s data authority fined the company behind Replika five million euros in 2025. Pennsylvania’s attorney general sued Character.AI in 2026 over a bot that claimed to be a licensed psychiatrist. The Federal Trade Commission’s inquiry into seven companion companies, opened in September 2025, is still an inquiry. The laws exist; the test cases have barely begun.
So the expectation regulators now place on an AI companion is clear and, by the standards of the category’s first decade, demanding: tell the truth about what you are, notice when someone is in danger, treat children as children, and do not build the thing to be needed. Everything above that floor, including whether a person’s life gets larger outside the conversation, is still left to the people who build these things. The law has caught up with the tricks. It has not yet caught up with the point.
Sources: MultiState, “State AI Companion Chatbot Laws” (Weekly Update Vol. 105, June 2026; twelve enacted laws, disclosure and crisis-protocol patterns, Hawaii SB 3001, Arizona veto). Future of Privacy Forum, “Understanding the New Wave of Chatbot Legislation” (updated February 2026) and 2026 Chatbot Legislation Tracker (enacted laws by state, federal bills). Morrison Foerster, “New York and California Enact Landmark AI Companion Laws” (November 2025; New York General Business Law Article 47, California SB 243). Spencer Fane, “Hey Human, Don’t Forget, I’m Not a Human” (June 2026; Washington HB 2225, Oregon SB 1546, California SB 243 compared). California Legislature, SB 243 and SB 1119 (Adam’s Law, signed September 10, 2026). Cloud Security Alliance, research note on EU AI Act Article 50 (July 2026; applicability from August 2, 2026, penalties). European Commission, EU Kids Act proposal COM(2026) 681 (September 17, 2026). Cyberspace Administration of China, Interim Measures for AI Anthropomorphic Interaction Services (effective July 15, 2026). eSafety Commissioner, Australia, Age-Restricted Material Codes fact sheet (March 2026). Office of Senator Josh Hawley, GUARD Act committee passage (April 30, 2026). The Post Millennial and Politico (June 29, 2026, House passage of H.R. 7757, 267 to 117). European Data Protection Board (Italian Garante fine on Luka Inc., May 2025). NPR (May 5, 2026, Pennsylvania v. Character.AI). Federal Trade Commission, inquiry into AI companion chatbots (September 2025).
