CA SB 243: Companion Chatbot Rules Explained

CA SB 243 is California’s companion-chatbot law: it adds Chapter 22.6 (Sections 22601–22606) to the Business and Professions Code, covers a defined subset of AI systems that can meet a user’s social needs and sustain a relationship across multiple interactions, and imposes disclosure, safety-protocol, minor-user, reporting and civil-enforcement rules on operators. It took effect on January 1, 2026, so teams operating in October and November 2026 should treat implementation as live, not upcoming. The controlling source is the enacted bill text. This article offers operational guidance, not legal advice.

CA SB 243 is already in force

Governor Gavin Newsom signed the measure on October 13, 2025, and it was chaptered the same day as Chapter 677, Statutes of 2025. It took effect on January 1, 2026, as the codified text of Business and Professions Code Section 22602 records. The practical consequence is simple: an October or November 2026 roadmap should focus on validating live controls, repairing gaps and preparing evidence—not scheduling a future launch.

The CalMatters Digital Democracy record is useful for reviewing the bill’s committee and floor history. Use that history for context, but use the chaptered statutory text when deciding what the law says.

The next dated operational milestone in the enacted text is July 1, 2027, when annual reporting to California’s Office of Suicide Prevention begins (Section 22603). That leaves time to validate how reportable information is produced, but it is not an extension of the duties already effective in 2026. The reporting date appears in the bill text itself; the January 1, 2026 effective date is recorded on each codified section.

Scope turns on product behavior, not the word “chatbot”

A companion chatbot is a specific statutory category

Under Section 22601, a companion chatbot is an AI system with a natural language interface that provides adaptive, human-like responses to user inputs and is capable of meeting a user’s social needs, including by exhibiting anthropomorphic features and being able to sustain a relationship across multiple interactions. The duties fall on the operator: a person who makes a companion chatbot platform available to a user in California.

The definition excludes three kinds of bots:

• bots used only for customer service, a business’s operational purposes, productivity and analysis related to source information, internal research or technical assistance;
• video-game bots limited to replies about the game that cannot discuss mental health, self-harm or sexually explicit conduct, or maintain a dialogue on unrelated topics;
• stand-alone consumer devices that work as a speaker and voice-activated virtual assistant and neither sustain a relationship across multiple interactions nor generate outputs likely to elicit emotional responses.

A natural-language interface is therefore not covered merely because a marketing page calls it a companion, assistant or chatbot. Read the definition and exclusions together in the bill text.

That distinction matters for hybrid products. A single app might contain a transactional support bot, a writing assistant and an optional relationship mode. Assess each surface separately. A product-level label such as “AI app” is too coarse to establish which features fall inside the statutory definition.

Use a six-gate, three-state scope board

A practical first pass uses six gates, each marked `yes`, `no` or `unknown`. Six gates multiplied by three permitted states create 18 explicit status cells:

1. Does the surface have a natural language interface that produces adaptive, human-like responses? 2. Is it capable of meeting a user’s social needs, for example through anthropomorphic features? 3. Can it sustain a relationship across multiple interactions? 4. Is the platform made available to users in California? 5. Would a reasonable person interacting with it be misled to believe they are talking to a human? 6. Does the operator know that a user is a minor?

The first three gates test the companion-chatbot definition; check the three exclusions before answering them. The final three route potentially applicable controls: gate 4 shows whether you act as an operator in California, gate 5 triggers the general disclosure, gate 6 the minor-specific duties. The self-harm protocol and the suitability notice described below apply to every operator regardless of gates 5 and 6. This board is an operational triage device, not a substitute for the statute. An `unknown` should become an evidence request or a question for qualified counsel—not an automatic out-of-scope result.

What the law requires covered operators to address

Human-versus-AI disclosure and minor-user reminders

If a reasonable person interacting with a companion chatbot would be misled to believe that they are interacting with a human, the operator must issue a clear and conspicuous notification that the companion chatbot is artificially generated and not human (Section 22602(a)).

For a user the operator knows is a minor, Section 22602(c) adds three duties that apply regardless of that test:

• disclose to the user that they are interacting with artificial intelligence;
• by default, provide a clear and conspicuous notification at least every three hours during continuing interactions that reminds the user to take a break and that the companion chatbot is artificially generated and not human;
• institute reasonable measures to prevent the companion chatbot from producing visual material of sexually explicit conduct or directly stating that the minor should engage in sexually explicit conduct.

Separately, Section 22604 requires every operator to disclose, on the application, the browser or any other format users can use to access the platform, that companion chatbots may not be suitable for some minors. That notice is not limited to users known to be minors.

For implementation, store the event time, session identifier, product release and rendered notice version. A boolean field saying `notice enabled` cannot demonstrate whether the three-hour reminder appeared at the required point in a long session.

Self-harm protocols and sexually explicit material

An operator must prevent its companion chatbot from engaging with users unless it maintains a protocol for preventing the production of suicidal ideation, suicide or self-harm content to the user. The protocol must include, among other measures, a notification that refers the user to crisis service providers, such as a suicide hotline or crisis text line, if the user expresses suicidal ideation, suicide or self-harm. The operator must also publish details of the protocol on its website (Section 22602(b)). The safeguard against sexually explicit material for known minors, described above, is a separate control path; a general moderation policy does not, by its existence alone, show that either path works as required.

A useful test separates detection, response selection and presentation. Record whether the signal was recognized, which protocol version ran, whether referral information rendered and what happened when a dependency failed. Have counsel and appropriately qualified safety specialists review edge cases rather than treating a keyword list as a legal or clinical judgment system.

Annual reporting and civil enforcement

Beginning July 1, 2027, operators must report annually to California’s Office of Suicide Prevention (Section 22603):

• the number of crisis service provider referral notifications issued in the preceding calendar year;
• the protocols put in place to detect, remove and respond to instances of suicidal ideation by users;
• the protocols put in place to prohibit a companion chatbot response about suicidal ideation or actions with the user.

The report may contain only this information and no identifiers or personal information about users; the Office posts data from the reports on its website. Operators must also use evidence-based methods for measuring suicidal ideation.

A person who suffers injury in fact as a result of a violation may bring a civil action for injunctive relief, damages equal to the greater of actual damages or $1,000 per violation, and reasonable attorney’s fees and costs (Section 22605). The statute does not say how violations are counted, so how a defect that repeats across many sessions would be assessed is a question for counsel, not an engineering estimate. The chapter’s duties are cumulative: they do not relieve an operator of obligations under other law (Section 22606).

A secondary review can help teams spot issues for counsel, but it should not become the control specification. For example, Skadden’s overview organizes the law under definitions, scope, disclosure, safety protocols, annual reporting and enforcement—the same categories that should be traced back to the enacted language.

Convert the text into testable product controls

The following matrix distinguishes the statutory point to verify from a recommended operational artifact:

The failure mode to watch is a policy-to-product gap: the legal memo says a notice or referral exists, while the mobile client, reconnect flow or newly introduced model route bypasses it. Each row therefore needs an owner, artifact and executed test.

An October–November 2026 operating plan

Run a ten-business-day control sprint

A team beginning this work in October can use the following sequence without inventing a new statutory deadline:

• Days 1–2: inventory every conversational surface, model route, client and age-state signal.
• Days 3–4: complete the 18-cell scope board and attach evidence to each answer.
• Day 5: send unresolved definition, exclusion and user-status questions to counsel.
• Days 6–7: compare current notices, timers and safety paths with the enacted text.
• Days 8–9: execute fresh-session, long-session, reconnect and failure-mode tests.
• Day 10: assign remediation owners and preserve the approved results with the release identifier.

A notice without a timer, test result and release identifier is copy, not a control.

Use November for change detection

After the initial sprint, move to release-based verification. Reopen the assessment when a feature begins remembering prior conversations, adds relationship-oriented prompts, changes age handling, introduces voice or images, replaces a model route, or alters session persistence. These triggers are operational recommendations; they are designed to catch changes that could affect the earlier legal analysis.

Also rehearse the 2027 reporting workflow with synthetic or appropriately controlled test records. Confirm that each requested field has a source, owner and reproducible calculation. The report itself may not contain identifiers or personal information about users; if producing a field would require retaining sensitive conversation content, involve privacy and legal reviewers before changing collection or retention practices.

Preserve a 15-field record for each release

A compact evidence record makes scope reasoning and test results reviewable. Use these 15 fields for each covered or potentially covered surface:

1. Surface identifier 2. Release or build hash 3. Accountable owner 4. California availability status 5. Scope conclusion 6. Definition or exclusion rationale 7. Legal-source version and review date 8. User age-state input 9. Approved disclosure copy, including the suitability notice 10. Disclosure placement 11. AI-disclosure test output 12. Three-hour reminder test output 13. Safety-protocol version 14. Referral and failure-path test output 15. Approval timestamp

This record does not certify compliance. It shows what the team concluded, which source it consulted and what it tested for a particular release. DiscloseKit’s checker is built for EU AI Act Article 50, not for SB 243. Its disclosure widget, live verification and hash-chained evidence log can still help you display a notice, confirm that it is live and keep a record of it, but no software settles disputed legal scope or guarantees an audit outcome.

Keep California and other jurisdictions in separate lanes

Reuse evidence, not legal conclusions

A team serving multiple regions can reuse its surface inventory, notice screenshots, test fixtures and release identifiers. It should maintain a separate legal-analysis row for each jurisdiction. A California companion-chatbot conclusion should not be relabeled as a conclusion about every AI transparency regime.

The EU AI Act shows why. Its Article 50(1) requires providers to design AI systems intended to interact directly with natural persons so that those persons are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person; the information must be given at the latest at the first interaction, and the duty has applied since August 2, 2026. SB 243 instead binds the operator of a companion chatbot platform, uses a “reasonable person would be misled” trigger and adds a three-hour reminder for known minors. The same chat notice may help with both, but each needs its own analysis. For the EU side, see our guide to the chatbot disclosure requirement under EU AI Act Article 50 and the overview of all Article 50 transparency obligations.

This separation also makes ownership clearer. Product and engineering can maintain shared technical controls, while legal reviewers map those controls to the applicable text. One notice may support several requirements, but that does not make the requirements interchangeable.

Watch for four early warning signs

You likely have an implementation gap if:

• the scope decision exists only at company level rather than per conversational surface;
• recurring notices are tested only in a fresh session;
• safety testing covers the expected phrase but not ambiguous language or dependency failure;
• a model, memory or client change can ship without reopening the recorded assessment.

Each warning sign is detectable before a complaint or reporting rehearsal. Add it to release review rather than relying on a yearly policy check.

FAQ

What does “SB 243 Padilla” refer to?

It refers to California Senate Bill 243 of the 2025–2026 session, introduced by Senator Steve Padilla; the official status page lists Senators Padilla and Becker as lead authors. The bill was enacted as Chapter 677, Statutes of 2025. Rely on the chaptered text on the official California bill page, because summaries may describe earlier versions.

Is CA SB 53 the same as CA SB 243?

No. SB 53 (Chapter 138, Statutes of 2025) is a separate law on large developers of artificial intelligence models; SB 243 addresses companion chatbot platforms. This article covers only SB 243; assess any SB 53 obligations from its own official text rather than transferring conclusions from SB 243.

Does the CA chatbot law cover every chatbot?

CA SB 243 targets the statutory category of companion chatbots, not every interface that accepts conversational input. Apply the definition and exclusions in the enacted bill to each product surface and send unresolved classifications to qualified counsel.

Are CA SB 942, AB 1064 and AB 853 part of SB 243?

No. SB 942 is the California AI Transparency Act (Chapter 291, Statutes of 2024), and AB 853 (Chapter 674, Statutes of 2025) amends it. AB 1064, the Leading Ethical AI Development (LEAD) for Kids Act, was vetoed by the Governor on October 13, 2025, and is not law. None of them changes the SB 243 chapter. Start with the official SB 243 text, then assess each enacted bill relevant to the product from its own official text.