Source: Business and Professions Code 22602 from leginfo.legislature.ca.gov, rendered and cropped by us on November 10, 2026.
Say your six-person team runs a fitness app with a "goal buddy" chat that remembers last week's goals and asks how you are feeling. That is our illustration, not a case. Your lawyer says the bot is a productivity tool, so California's companion chatbot law does not reach it. Is that right, and what changes on January 1?
I read the chaptered text of SB 243 (Chapter 677, Statutes of 2025), the current code for sections 22601 to 22606, and SB 1119, the 2026 bill that amends it. Two law-firm alerts on SB 243 were written in October 2025, before SB 1119 existed. The dates they give are right for 2026 and incomplete for 2027.
Is your bot a "companion chatbot"?
Section 22601(b)(1) defines it as an AI system with a natural language interface that "provides adaptive, human-like responses to user inputs and is capable of meeting a user's social needs, including by exhibiting anthropomorphic features and being able to sustain a relationship across multiple interactions." An "operator" is "a person who makes a companion chatbot platform available to a user in the state." The text has no carve-out for a bot built on someone else's model, and Gunderson says the same: the operator "cannot delegate its compliance obligations to the third-party AI provider."
Source: Business and Professions Code 22601 from leginfo.legislature.ca.gov, rendered and cropped by us on November 10, 2026.
There are three exclusions. The first is "A bot that is used only for customer service, a business' operational purposes, productivity and analysis related to source information, internal research, or technical assistance." The word that matters is "only". The second is "A bot that is a feature of a video game and is limited to replies related to the video game that cannot discuss topics related to mental health, self-harm, sexually explicit conduct, or maintain a dialogue on other topics unrelated to the video game." The third is a stand-alone speaker that "acts as a voice-activated virtual assistant, and does not sustain a relationship across multiple interactions or generate outputs that are likely to elicit emotional responses in the user."
For the goal buddy, the exclusion helps only while the bot stays a tool. Once it remembers you, adapts its tone and asks about feelings, a regulator or plaintiff can argue it is "capable of meeting a user's social needs". I would not rely on the lawyer's one-line answer without writing down which of the two parts of the definition the bot fails.
What has applied since January 1, 2026
Every section I read is marked "Effective January 1, 2026". Four duties matter to a small team.
- Under 22602(a), if a reasonable person "would be misled to believe that the person is interacting with a human", issue a clear and conspicuous notification that the bot is artificially generated and not human.
- Under 22602(b), do not let the bot engage with users unless you maintain a protocol for preventing suicidal ideation, suicide or self-harm content, including a notification that refers the user to crisis service providers. Publish details of the protocol on your website. This applies to every user, not only minors.
- Under 22604, tell users, on the app, the browser or any other format they use to reach the bot, that companion chatbots "may not be suitable for some minors".
- Under 22602(c), for a user the operator "knows is a minor", disclose that it is AI, show a break-and-AI reminder at least every three hours by default, and take reasonable measures to stop sexually explicit visual material or direct statements to the minor.
Enforcement is private. Section 22605 lets "a person who suffers injury in fact" sue for an injunction, "the greater of actual damages or one thousand dollars ($1,000) per violation", and attorney's fees and costs. I found no agency enforcement clause or fine anywhere in 22601 to 22606, and 22606 says the duties are cumulative with other law. Plaintiffs' lawyers are the audience for your notices, which is a reason to keep screenshots of them.
Skadden's memo says of the reasonable-person test in 22602(a): "The law does not clarify how this reasonable person test should be applied". Skadden suggests a conservative approach: disclose even if you believe many consumers will realize they are not talking to a human. I agree, because the cost is one banner and the risk is a $1,000-per-violation claim.
What changes on January 1, 2027, and what waits for July
Adam's Law (SB 1119) was approved on September 10, 2026 as Chapter 190, Statutes of 2026. Our Adam's Law post covers its new duties. This section is about what it removes. The Legislative Counsel's digest says: "This bill would delete those provisions imposing requirements on an operator if the operator knows the user is a minor."
Source: SB 1119 chaptered text from leginfo.legislature.ca.gov, Section 1, cropped by us on November 10, 2026.
The rewritten 22602 has the AI notice and the crisis protocol and nothing else. The three-hour reminder, the unconditional AI disclosure to a known minor and the sexual-content measures are gone. The bill does not touch 22604, so the "may not be suitable for some minors" notice stays.
The effective date is my derivation, not a line in the bill. The Constitution (article IV, section 8(c)(1)) says a statute enacted at a regular session "shall go into effect on January 1 next following a 90-day period from the date of enactment". Ninety days from September 10 is December 9, so I read January 1, 2027. The leginfo code page still showed 22602(c) when I opened it on November 10, 2026, which fits.
The new child duties are not on the same day. Section 21812 says "This section shall become operative on July 1, 2027", and 21812.5 and 21813 carry the same date. I found no delayed-operative sentence for Section 1, which deletes 22602(c). It also has none for 21811 (age determination, or applying the child protections to all users) or 21816 (enforcement). On my reading of the default rule, so from January 1, 2027 to July 1, 2027:
- 22602(a) and (b), the 22604 notice and the 22605 private claim keep applying.
- 22602(c) no longer applies.
- 21811 and 21816 apply, because neither carries a later date. The definition of "operator" in 21810.5(j) even names Section 21811 and Section 21816 as provisions that reach an operator before age has been determined. I did not work out what an operator would be violating under 21816 before July, since the duties 21816 mostly enforces are not yet operative.
- 21812, 21812.5 and 21813 do not apply until July 1, 2027.
So it is not a gap with no minor-related rule at all; it is a window in which the age-determination section is in force and the child duties are not. I did not research whether a claim for 2026 conduct under the old 22602(c) survives its deletion.
What starts on July 1, 2027
Source: Business and Professions Code 22603 from leginfo.legislature.ca.gov, rendered and cropped by us on November 10, 2026.
Section 22603 is the annual report SB 1119 leaves alone. "Beginning July 1, 2027, an operator shall annually report to the office" three things: the number of crisis referral notifications issued "in the preceding calendar year", the protocols to detect, remove and respond to suicidal ideation, and the protocols to prohibit a chatbot response about suicidal ideation. The report "shall not include any identifiers or personal information about users", the office posts the data, and the operator "shall use evidence-based methods for measuring suicidal ideation". The first report, due on July 1, 2027, counts "the preceding calendar year", which on my reading is all of 2026, so a team that has not logged referrals since January 1 will have to rebuild the count from its chat logs.
Under SB 1119, section 21812's risk assessment and the section 21813 prohibitions start the same day. Public prosecutors can then seek up to $5,000 per affected child for a negligent violation and $15,000 for an intentional one (21816(a)), and 21816(b) adds a narrower private action: "A child who suffers an actual harm as a result of a violation of paragraphs (1) to (5), inclusive, of subdivision (d) of Section 21812, or a parent or guardian acting on behalf of that child" may sue. If the harm is financial it "shall exceed one thousand dollars ($1,000) per child", and if it is emotional it "must constitute serious emotional distress". That is a different regime from SB 243's private claim, which needs only "injury in fact".
Two firms and two advocates on the same text
Megan Garcia, the mother of Sewell Setzer, said after the signing on October 13, 2025: "Finally, there is a law that requires companies to protect their users who express suicidal ideations to chatbots." Jai Jaisimha of the Transparency Coalition said the same day: "We look forward to working with Sen. Padilla and others to adapt these regulations as we learn more about the negative impacts of this fast moving technology." Both statements are in Senator Padilla's release. The second turned out to be literal: eleven months later the minor duties were rewritten.
The law firms read the same text as a checklist. Gunderson's alert, dated October 29, 2025, says a support bot that can "remember user preferences, provide recommendations tailored to a specific user, adapt its tone specific to a user or engage in human-like dialogue with a user will be regulated under SB 243." That is a firmer sentence than the definition, which still needs a bot "capable of meeting a user's social needs". It also glosses "knows" in 22602(c) as "aware, or reasonably should be aware". Section 22601 does not define "knows", so I would treat Gunderson's gloss as advice, not as statutory text. The page I read has no mention of SB 1119, as expected for its date. Skadden's memo, also from October 2025 by its URL, is the conservative one quoted above.
A dated checklist for a small team
My view, not legal advice: do not switch off the three-hour reminder or the minor AI disclosure on January 1 just because the text allows it. Adam's Law brings stricter child duties on July 1, 2027, and rebuilding a feature you deleted costs more than leaving it on until then. The plaintiff-facing duties, the AI notice and the crisis protocol, never go away.
- Now: write down why your bot is or is not a companion chatbot under 22601(b), naming which part of the definition fails and who decided. Keep the date.
- Now: show the AI notice, publish the crisis protocol on your site, and add the "may not be suitable for some minors" line where users open the bot (22602(a), (b), 22604). Keep dated screenshots.
- Now: reconstruct the count of crisis-referral notifications since January 1, 2026 from your logs, and keep counting, with dates and without user identifiers, so the 22603 count exists.
- January 1, 2027: 22602(c) leaves the code, and 21811 and 21816 apply on my reading. Decide in writing whether to keep the reminder and the minor disclosure (I would keep them), and how you will determine age under 21811.
- By July 1, 2027: file the first annual report, and compare your build with Adam's Law sections 21811 to 21813 using our Adam's Law post.
Other states have their own chatbot rules, including Utah's mental health chatbot law and Rhode Island's AI therapy laws. For how a private claim like 22605 compares elsewhere, see our private right of action guide and the state chatbot disclosure overview.
What I could not confirm
I read the legislature's text and two law-firm alerts, not a bill analysis, because the leginfo analysis pages would not open from this machine. I could not find where an operator files the 22603 report: section 131300 of the Health and Safety Code says the department "is hereby authorized to establish" the Office of Suicide Prevention and speaks of its duties "if established", and the CDPH address I guessed for the office's page returned "Page not found". The January-to-July picture above is my reading of a chaptered bill; no regulator or court I found has addressed it, and leginfo's code page will show the official effective date once it is updated. I did not find a decision applying 22605. Whether a customer-service bot with memory counts as a companion chatbot is untested in what I read.
