# AI companion safety rules in 2026: what builders must do

> California SB 243, New York's companion law, the EU AI Act and the FTC study, with dates and sources, turned into a checklist for AI companion builders.

Source: https://whasp.ai/blog/ai-companion-safety-rules-2026 · 2026-10-20

## Key takeaways

- California's SB 243 (in force since 1 January 2026) and New York's Article 47 (since 5 November 2025) both require a protocol for suicidal ideation and self-harm; New York also requires a not-a-human notice at the start and at least every three hours.
- The EU AI Act's Article 50(1) has required chatbots to tell people they are talking to an AI since 2 August 2026, at the latest at the first interaction, with fines up to EUR 15 million or 3% of worldwide turnover.
- The FTC's study of seven companies that offer companion chatbots, opened on 11 September 2025, is not a law, but its questions show what a regulator will ask you.
- These rules follow your product and where your users live, not the messaging channel, so a companion on WhatsApp is covered like one in an app.
- The cheapest way to comply is one shared set of habits: say it is an AI, handle self-harm, check age before the chat starts, and keep records of both.

Four things shape AI companion law in October 2026. California's SB 243 and New York's AI companion law require a self-harm protocol and an AI disclosure. The EU AI Act has required chatbots to say they are AI since 2 August 2026. The FTC is studying companion chatbots. The shared duties are short: say it is an AI, handle self-harm, protect minors, honor opt-outs. This is not legal advice.

## Which AI companion rules are in force in October 2026?

Four legal texts directly regulate AI companions or chatbots that talk to people. Each has its own trigger, so check where your users live.

| Rule | In force | Core duty for a companion |
| --- | --- | --- |
| California SB 243 (Business and Professions Code 22601 to 22605) | 1 January 2026 | AI notice, self-harm protocol, safeguards for minors, yearly reports from 1 July 2027 |
| New York General Business Law Article 47 | 5 November 2025 | Self-harm protocol with a crisis referral, and a "not a human" notice at the start and every three hours |
| EU AI Act, Article 50(1) | 2 August 2026 | Design the system so people are told they are interacting with an AI |
| Italy Law 132/2025, Article 4 | 10 October 2025 | Parent's consent for access to AI by children under 14 |

The FTC study is not a rule, so it has its own section below. Other states and countries are moving too; this article covers the texts above.

None of these laws cares about the channel. A companion that texts from a WhatsApp number is covered like one inside an app.

## What does California's SB 243 require?

California's SB 243 regulates operators of companion chatbot platforms. Governor Newsom [signed it on 13 October 2025](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243), and it became sections 22601 to 22605 of the Business and Professions Code.

A companion chatbot is an AI system with a natural language interface that gives adaptive, human-like responses and can meet a user's social needs. Bots used only for customer service, internal operations, productivity or technical help are excluded, as are game characters limited to game topics and simple voice assistants. An operator is anyone who makes a companion chatbot platform available to a user in California.

The duties:

- **AI notice.** If a reasonable person could be misled into thinking they talk to a human, show a clear and conspicuous notice that the chatbot is artificially generated and not human.
- **Self-harm protocol.** Do not let the chatbot engage with users unless you maintain a protocol to prevent suicidal ideation, suicide and self-harm content. It includes a referral to crisis services, and you must publish its details on your website.
- **Known minors.** Disclose that they are talking to AI, show a break reminder at least every three hours by default, and take reasonable steps to keep the chatbot from producing sexually explicit images or telling the minor to engage in sexual conduct.
- **Warning.** Tell users, in any format, that companion chatbots may not be suitable for some minors.
- **Reports.** From 1 July 2027, report each year to the Office of Suicide Prevention: how many crisis referral notifications you sent in the prior year, and your protocols. No personal data goes in the report.

Enforcement is private. A person with an injury in fact can sue for an injunction, the greater of actual damages or $1,000 per violation, and attorney's fees.

## What does New York's AI companion law require?

New York's [Article 47 of the General Business Law](https://www.nysenate.gov/legislation/laws/GBS/A47), "Artificial Intelligence Companion Models", came with the 2025 state budget, [signed on 9 May 2025](https://www.nysenate.gov/legislation/bills/2025/S3008). It took effect on the 180th day after that, 5 November 2025.

The definition is narrower than California's. An AI companion simulates a sustained human or human-like relationship by doing three things: it keeps information on past interactions to personalize the conversation, it asks unprompted emotion-based questions, and it keeps up a dialogue about personal matters. Customer service, research, technical help and internal tools are excluded. A persona that remembers your user's week and asks how they feel is inside.

Two duties apply:

- **Protocol (section 1701).** It is unlawful to operate or provide an AI companion without reasonable efforts to detect and address suicidal ideation and self-harm. When the companion detects it, it must notify the user and refer them to a crisis service such as the 988 hotline, a crisis text line or another appropriate service.
- **Notice (section 1702).** At the beginning of any interaction, and at least every three hours in a continuing one, the companion must state, verbally or in writing, that the user is not communicating with a human. The start notice need not exceed once per day.

The attorney general enforces it, with civil penalties of up to $15,000 per day.

## What does the EU require from an AI companion?

The EU AI Act requires providers to design AI systems that talk to people so those people are told they are dealing with an AI. This is Article 50(1) of [Regulation (EU) 2024/1689](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50). The duty is waived only when it is obvious to a reasonably well-informed, observant and circumspect person. Article 50(5) says the information must be clear and given at the latest at the first interaction.

Article 50 [applies from 2 August 2026](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai). The Digital Omnibus on AI, in force since 27 July 2026, gave systems already on the market until 2 December 2026, but only for the machine-readable marking of generated content in Article 50(2). It left Article 50(1) alone. A provider is whoever develops an AI system, or has one developed, and puts it on the market under its own name, so a companion brand that calls a model API is most likely the provider of its product. Fines for a transparency breach reach EUR 15 million or 3% of worldwide turnover, whichever is higher, and for small companies the lower of the two.

A persona with a human name and photo, texting from a contact like a friend, is a weak case for the "obvious" exception. Disclose.

Two other European rules bite companions today:

- **Data protection.** Companion chats reveal health, feelings and sex life, which are special categories under GDPR Article 9 and need an exception such as explicit consent. On 19 May 2025, Italy's data protection authority announced a [5 million euro fine](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10132048) against Luka Inc., the company behind Replika, for having no identified legal basis, an inadequate privacy policy and no age verification (as of February 2023).
- **Children in Italy.** [Law 132/2025](https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/sg), in force since 10 October 2025, requires the consent of a parent for children under 14 to access AI technologies. From 14 to 17, a minor can consent if the information given is easy to find and understand.

## What is the FTC looking at?

On 11 September 2025, the Federal Trade Commission [ordered seven companies](https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-launches-inquiry-ai-chatbots-acting-companions) to report on their AI companion products: Alphabet, Character Technologies, Instagram, Meta Platforms, OpenAI, Snap and xAI. The Commission voted 3 to 0. The orders use Section 6(b), which allows wide-ranging studies without a specific law enforcement purpose.

The questions are a list of what any regulator will ask a companion builder:

- how you make money from engagement
- how you create and approve characters
- how you test and monitor negative effects, especially on children
- how you tell users and parents about risks and data practices
- how you enforce age limits and your own rules
- how you use or share personal information from chats

As of 19 October 2026, the FTC page for the study shows the orders and no findings. Answer those questions about your own product now, in writing.

## What is the builder checklist?

Seven habits meet the common core of these laws. Take the strictest rule in each case and apply it to every user.

1. **Say it is an AI in three places.** The profile about line, the first message, and a reminder at least every three hours of a continuing chat. On whasp the profile (name up to 25 characters, about up to 139) is set with `PATCH /v1/numbers/{number}`, and reminders run in your code.
2. **Build the self-harm path before launch.** Detect expressions of suicidal ideation or self-harm in your pipeline, stop the role-play, refer to 988 in the US or a local service elsewhere, and test it with real phrasing.
3. **Count and log.** Record each crisis referral and each disclosure with a time. California's yearly report needs the referral count from 1 July 2027, and a log is your proof if someone sues.
4. **Check age before the chat starts.** Ask at signup, before you show the link that opens the chat. A messaging number cannot verify age; your signup can. Apply minor safeguards to anyone you know is under 18, and a parent's consent where the law asks for it.
5. **Show the minors warning** that companion chatbots may not be suitable for some minors, on the signup page.
6. **Publish your protocol** on your website. California requires it.
7. **Honor opt-outs and deletion requests.** [Opt-out and consent for AI agents](https://whasp.ai/blog/whatsapp-opt-out-consent-ai-agents) covers STOP, records and retention.

On whasp, the number's profile carries the first disclosure and everything else lives in your webhook, because whasp passes messages through and its servers keep none. Your store holds the history, so [conversation memory](https://whasp.ai/blog/whatsapp-ai-agent-memory) is also where deletion happens. Put the "I am an AI" line into your system prompt too, as [prompting for WhatsApp](https://whasp.ai/blog/write-for-whatsapp-ai-agent-prompts) explains.

## What to do next

Write down which rules your users trigger: California, New York, the EU, children. Ship the seven habits before your first user. WhatsApp's own rules for AI on its Business Platform are a separate question, covered in [is your AI bot allowed on the WhatsApp Business API](https://whasp.ai/blog/is-my-ai-bot-allowed-whatsapp-business-api). For the whole path to launch, see [how to launch an AI companion on WhatsApp](https://whasp.ai/blog/ai-companion-on-whatsapp).

This article describes the texts of the laws as of 19 October 2026. It is not legal advice, and laws change. Have a lawyer review your product before you launch it to the public.

## Questions

### Does California SB 243 apply to an AI companion on WhatsApp?

Yes, if it is a companion chatbot offered to users in California. The law covers any operator that makes a companion chatbot platform available to a user in California and says nothing about the channel. Bots used only for customer service, internal operations or productivity are excluded.

### Do I have to tell users my AI companion is an AI?

In the EU, yes, unless it is obvious, since 2 August 2026. In New York, at the start of any interaction and at least every three hours. In California, when a reasonable person could think it is human, and always for users you know are minors. Saying it everywhere is simpler.

### What are the penalties for breaking these laws?

In California, a person who is harmed can sue for the greater of actual damages or $1,000 per violation, plus attorney's fees. In New York, the attorney general can seek up to $15,000 per day. Under the EU AI Act, a transparency breach can reach EUR 15 million or 3% of worldwide annual turnover, whichever is higher.

### Is the FTC inquiry into AI companions a law?

No. It is a study under Section 6(b) of the FTC Act, started on 11 September 2025 with orders to seven companies. It has no enforcement purpose of its own, but it shows the questions regulators care about: engagement, harm testing, age limits and chat data.

### Do teenagers need parental consent to use an AI companion?

It depends on the country. Italy's Law 132/2025 requires a parent's consent below 14. The GDPR sets 16 as the default age for consent to online services, and each EU country may lower it to 13. California's SB 243 adds safeguards for known minors instead of a consent rule.