AI Regulation Guide · Multi-state (US)
US Conversational AI (Multi-State): who's covered, what it requires
US Conversational AI (Multi-State) carries 7 tracked obligations for companies in scope. This guide lists who is covered, the duty tiers, and every obligation with its deadline and statutory citation — all from Shieldra's versioned regulation pack, verified 2026-07-29.
By the Shieldra Compliance Team · Last updated 2026-07-29
Who does US Conversational AI (Multi-State) apply to?
Out of scope only if: No consumer-facing conversational AI reaching a covered state reported. This pack covers the 2025-26 state chatbot/companion/AI-therapy cluster, which attaches to conversational AI interacting with consumers in Maine, New York, the therapy-ban states (NV, IL, UT, RI, TN, VT, ME, CO), or the 2027-wave states (CO, WA, OR, RI, NE, ID, GA). Internal-only and authenticated-B2B-only tools sit outside the cluster — re-screen on any consumer-facing launch or persona, memory, or wellness feature.
Cross-references: California SB 243 companion duties (in force, with a private right of action) live in the california_ai pack; Connecticut PA 26-15 §§4-6 companion duties (from 1 January 2027) live in the connecticut_cart pack; Utah HB 452's mental-health chatbot regime (Utah Code §13-72a) lives in the utah_aipa pack.
- What is your role for the conversational AI product?
- Do you operate, provide, or supply a conversational AI — chatbot, voice assistant, in-product AI persona, companion app, or wellness/coaching feature — that communicates with individual consumers, rather than exclusively with authenticated business users in internal or B2B tooling?
- Could a reasonable consumer be misled into believing they are communicating with a human — e.g., a human name, photo-realistic avatar, or human-simulating conversation without a clear upfront AI label?
- Is any bot designed to sustain an ongoing relationship or emotional engagement with the user across interactions — adaptive, human-like or emotional responses, memory or a persistent persona, or marketing as a companion, friend, romantic partner, or emotional support?
- Does any marketing copy, product name, persona, avatar, system prompt, or output state or imply — explicitly or implicitly — that the AI can provide therapy, counseling, psychotherapy, or mental or behavioral health care, or use titles such as 'therapist', 'counselor', 'psychologist', or 'psychiatrist'?
- Is the system specifically programmed to provide a service or experience that would constitute the practice of professional mental or behavioral health care if provided by a natural person — diagnosis, treatment, or prevention of mental illness or emotional or behavioral disorders — or does it independently conduct therapy sessions, make therapeutic decisions, or generate treatment plans?
- If a therapy flag could apply: is every such feature limited to self-help materials or advice that do not purport to offer professional care, OR administrative support for licensed providers (scheduling, records, billing, session notes) with independent accuracy review of AI output, OR otherwise delivered under a licensed professional's oversight within the relevant state carve-out?
- Can minors (under 18) access or use the bot — is it open to the general public without age assurance, directed at minors, or known to have minor users?
- Can consumers in Maine use the product?
- Can users in New York use the product?
- Can users in any of Nevada, Illinois, Utah, Rhode Island, Tennessee, Vermont, Maine, Colorado, or Missouri use the product?
- Can users in any of Colorado, Washington, Oregon, Rhode Island, Nebraska, Idaho, or Georgia use the product?
What are the duty tiers under US Conversational AI (Multi-State)?
AI-therapy flag — remediate now (Nev. AB 406 (2025), NRS ch. 433 new sections (anchor of the multi-state AI-therapy cluster))
Citation: Nev. AB 406 (2025), NRS ch. 433 new sections (anchor of the multi-state AI-therapy cluster) — https://archive.leg.state.nv.us/Session/83rd2025/Bills/AB/AB406_EN.pdf
Fires on a representation flag (which no safe harbor cures — Nevada bans explicit AND implicit representations; Tennessee bans the marketing itself) or on a specifically-programmed therapy function without a documented safe-harbor fit. Nevada's 'specifically programmed' element means incidental capability of a general-purpose bot does not trigger the function ban, but emotional- or mental-wellness marketing undermines that position. Companion and disclosure duties below still apply alongside remediation. Flag for legal review, never auto-concluded.
Companion-bot operator duties (N.Y. Gen. Bus. Law art. 47, §§1700–1704 (anchor; in force since 5 November 2025))
Citation: N.Y. Gen. Bus. Law art. 47, §§1700–1704 (anchor; in force since 5 November 2025) — https://www.nysenate.gov/legislation/laws/GBS/A47
The statutory companion definitions (sustained human-relationship simulation with adaptive or emotional responses) and the business-bot carve-outs decide coverage — a labeled support bot on narrow product topics is generally outside every companion law in this pack. Private rights of action are the sharp edge: Washington and Oregon from 1 January 2027 (Oregon at $1,000 statutory damages per violation), plus California SB 243 (in force — california_ai pack) and Connecticut PA 26-15 §§4-6 from 1 January 2027 (connecticut_cart pack).
In scope — disclosure hygiene and documented carve-out fit (10 M.R.S. §1500-DD (enacted as §1500-Y by P.L. 2025, c. 294; reallocated by RR 2025, c. 1) (Me. P.L. 2025, ch. 294; LD 1727))
Citation: 10 M.R.S. §1500-DD (enacted as §1500-Y by P.L. 2025, c. 294; reallocated by RR 2025, c. 1) (Me. P.L. 2025, ch. 294; LD 1727) — https://www.mainelegislature.org/legis/bills/display_ps.asp?LD=1727&snum=132
The dominant outcome for a labeled customer-support bot with no companion elements and no therapy claims: maintain non-human labeling (Maine's duty is in force with UTPA exposure) and keep a documented record of carve-out fit per state, re-screened on product changes.
What are the obligations and deadlines under US Conversational AI (Multi-State)?
| Obligation | Who | Deadline | Citation |
|---|
| Stop or restructure AI-therapy representations and functions | developer, deployer | in force in stages — UT since 7 May 2025, NV since 1 July 2025, IL since 1 August 2025, VT since 17 June 2026, RI since 22 June 2026, TN since 1 July 2026, ME since 29 July 2026; CO applies from 12 August 2026 and MO from 28 August 2026 | Nev. AB 406 (NRS chs. 433/629 new sections); Ill. P.A. 104-0054; R.I. S 2197; Me. LD 2082; Tenn. SB 1580; Vt. Act 156; Colo. HB 26-1195; Utah Code §13-72a — https://archive.leg.state.nv.us/Session/83rd2025/Bills/AB/AB406_EN.pdf |
| Maine: disclose that the consumer is talking to AI, not a human | developer, deployer | in force since 16 September 2025 | 10 M.R.S. §1500-DD (enacted as §1500-Y by P.L. 2025, c. 294; reallocated by RR 2025, c. 1) (Me. P.L. 2025, ch. 294; LD 1727) — https://www.mainelegislature.org/legis/bills/display_ps.asp?LD=1727&snum=132 |
| New York: AI-companion disclosure cadence and crisis protocol | developer, deployer | in force since 5 November 2025 | N.Y. Gen. Bus. Law art. 47, §§1700–1704 — https://www.nysenate.gov/legislation/laws/GBS/A47 |
| 2027 wave: general conversational-AI duties (CO, NE, ID) — crisis protocol and no-therapy-representation | developer, deployer | applies from 1 January 2027 (CO HB 26-1263) and from 1 July 2027 (NE LB 525, ID S 1297) | Idaho Code 48-2103(2)–(3) (S 1297); Neb. LB 525 secs. 16–17; Colo. HB 26-1263 — https://legislature.idaho.gov/wp-content/uploads/sessioninfo/2026/legislation/S1297E1.pdf |
| Get ready for the 2027 conversational-AI wave (CO, WA, OR, RI, NE, ID, GA) | developer, deployer | applies from 1 January 2027 (CO HB 26-1263, WA HB 2225, OR SB 1546, RI S 2195) and from 1 July 2027 (NE LB 525, ID S 1297, GA SB 540) | Colo. HB 26-1263; Wash. HB 2225; Or. SB 1546; R.I. S 2195; Neb. LB 525; Idaho S 1297; Ga. SB 540 — https://leg.colorado.gov/bills/HB26-1263 |
| Maintain persistent non-human labeling on every consumer surface | developer, deployer | earliest binding duty (Maine) in force since 16 September 2025 | 10 M.R.S. §1500-DD (enacted as §1500-Y by P.L. 2025, c. 294; reallocated by RR 2025, c. 1) (anchor); N.Y. GBL art. 47; Utah Code §13-2-12/13-72; Cal. B&P Code §22601 et seq. — https://regulations.ai/regulations/RAI-US-ME-ETCTIXX-2025 |
| Document per-state carve-out and safe-harbor fit; re-screen on product changes | developer, deployer | in-force layer (Maine, New York, therapy bans) — document current fit; earliest duty in force since 16 September 2025; re-verify before the first 2027-wave duties apply from 1 January 2027 | Neb. LB 525 (business-entity/narrow-topic exclusions); Ga. SB 540; Wash. HB 2225; N.Y. GBL art. 47; Nev. AB 406 safe harbors — https://regulations.ai/regulations/RAI-US-NE-LB52500-2026 |
What should you do about each obligation?
Stop or restructure AI-therapy representations and functions (Nev. AB 406 (NRS chs. 433/629 new sections); Ill. P.A. 104-0054; R.I. S 2197; Me. LD 2082; Tenn. SB 1580; Vt. Act 156; Colo. HB 26-1195; Utah Code §13-72a)
Stop, redesign, or geo-restrict before exposure: Nevada prohibits making an AI system available that is specifically programmed to provide services constituting professional mental or behavioral health care AND any explicit or implicit representation of such capability (including therapist-type titles or avatars) — Division of Public and Behavioral Health enforcement, civil penalties up to $15,000 per violation, no cure period, no private right of action. Illinois bars AI from independently providing therapy or making therapeutic decisions, permitting only administrative or supplementary roles under a licensed professional's oversight (IDFPR, penalties up to $10,000 per violation); Rhode Island bars independent AI therapeutic decisions, requires written consent before AI use in recorded sessions, and limits internet-based AI therapy to licensed professionals; Maine requires a licensed professional for any therapy or psychotherapy service, including AI-delivered; Tennessee bans marketing an AI system as a qualified mental health professional. Colorado HB 26-1195 bars AI chatbots from conducting psychotherapy sessions or generating treatment plans without licensed human review from 12 August 2026. Remediation paths: scrub therapy claims, titles, and personas from marketing, avatars, system prompts, and outputs, and either restructure into a state safe harbor (self-help content not purporting to offer professional care, or licensed-provider administrative support with independent accuracy review) or geo-restrict — noting that Nevada separately bars even licensed providers from using AI to provide care directly to patients. Vermont Act 156 (signed 17 June 2026) took effect immediately on passage — the AI-only-therapy ban has been in force since 17 June 2026, enforced through Vermont's Consumer Protection Act (9 V.S.A. ch. 63) including private civil actions. Missouri SB 1019 was signed and applies from 28 August 2026: AI-therapy representations become unlawful practices under the Missouri Merchandising Practices Act ($10,000 first / $20,000 subsequent offenses). Tennessee SB 1580 violations are unfair/deceptive acts under the Tennessee Consumer Protection Act with civil penalties up to $5,000 per violation PLUS a private right of action for affected individuals.
Maine: disclose that the consumer is talking to AI, not a human (10 M.R.S. §1500-DD (enacted as §1500-Y by P.L. 2025, c. 294; reallocated by RR 2025, c. 1) (Me. P.L. 2025, ch. 294; LD 1727))
Give a clear and conspicuous disclosure, at the outset of the interaction, that the consumer is communicating with an AI system and not a human, wherever the technology may mislead or deceive a reasonable consumer into believing they are engaging with a human being. The duty reaches any person using such technology in trade and commerce with Maine consumers — no companion element, no size threshold, and no customer-service carve-out. A violation is an unfair trade practice under the Maine UTPA: a violation is a Maine UTPA violation — AG enforcement with civil penalties up to $10,000 per intentional violation (5 M.R.S. §209), plus UTPA private remedies, plus UTPA private remedies for aggrieved consumers. A persistent, prominent AI label at the start of every session satisfies the trigger and is the cheapest fix in this pack.
New York: AI-companion disclosure cadence and crisis protocol (N.Y. Gen. Bus. Law art. 47, §§1700–1704)
Disclose the non-human status of the AI companion at the start of each session and at least every three hours of continued interaction, and implement a protocol for detecting expressions of suicidal ideation or self-harm that refers users to crisis services such as the 988 lifeline. The Attorney General enforces with civil penalties up to $15,000 per day, and the Governor's office wrote directly to companion operators when the law took effect in November 2025 — enforcement attention is real. The duties bind operators of 'AI companions' (systems sustaining personalized conversations that simulate a human relationship); an ordinary customer-support or productivity bot falls outside the definition, and that determination should be documented.
2027 wave: general conversational-AI duties (CO, NE, ID) — crisis protocol and no-therapy-representation (Idaho Code 48-2103(2)–(3) (S 1297); Neb. LB 525 secs. 16–17; Colo. HB 26-1263)
These three states reach ALL in-scope consumer conversational AI services — companion elements, human-mimicry, or minor access are NOT required. Idaho (from 1 July 2027, Idaho Code 48-2103(2)–(3)) and Nebraska (from 1 July 2027, LB 525 secs. 16–17) require a suicidal-ideation crisis-referral protocol and prohibit explicitly representing the service as providing professional mental or behavioral health care; Colorado HB 26-1263 (from 1 January 2027) adds annual protocol reporting to the Attorney General. Build the crisis-referral protocol once (detection, referral to the 988 Suicide & Crisis Lifeline, documentation) and keep marketing/system prompts free of professional-care representations. Developer shields: ID 48-2105(3), NE sec. 18(4), and GA (m)(5) place these duties on the operator, not the upstream model developer.
Get ready for the 2027 conversational-AI wave (CO, WA, OR, RI, NE, ID, GA) (Colo. HB 26-1263; Wash. HB 2225; Or. SB 1546; R.I. S 2195; Neb. LB 525; Idaho S 1297; Ga. SB 540)
Build once for the strictest requirements and you cover the wave: non-human disclosure at the outset with a redisplay cadence (Washington every 3 hours, hourly for minors; Georgia at the beginning of each interaction or session and every 3 hours, dropping to hourly for known-minor users or minor-directed bots; Rhode Island at initiation and every 3 hours), suicide/self-harm detection with crisis referral (Washington requires a detection protocol (expressly including eating-disorder expressions), crisis-resource referral (suicide hotline / crisis text line), prevention of content encouraging or describing self-harm methods, and public disclosure of the protocol plus the yearly count of crisis referrals), minor safeguards (Georgia: commercially reasonable age assurance before access to any sexually-explicit-capable feature (24-hour data-retention cap), plus screen-time/privacy/safety tools for known minor accounts; Colorado commercially reasonable age estimation plus, for known minors, bans on engagement-maximizing incentive features, sexually explicit content, and emotional-dependency mechanics; Nebraska always-disclose-to-minors plus a sexually-explicit prohibition), and annual transparency duties — Oregon: public website report by 31 December each year (referral counts + protocol details, nothing is filed with the state); Rhode Island: annual AG reports beginning 1 July 2027; Colorado: annual protocol reports to the AG; Washington and Georgia: public disclosure of protocol details and yearly crisis-referral counts. Enforcement sharp edges: private rights of action in Washington and Oregon (Oregon at $1,000 statutory damages per violation), Rhode Island penalties up to $15,000 per day, Georgia AG penalties up to $10,000 per knowing violation, Nebraska and Idaho AG-only. The carve-outs are the screen: Nebraska excludes applications primarily designed and marketed for commercial use by business entities and bots limited to narrow and discrete topics; Georgia excludes internal business tools, customer service chatbots, and educational tools; Washington excludes business-oriented and gaming bots, general virtual assistants, and narrowly tailored educational tools; Idaho follows the Nebraska model (enrolled carve-out text not independently verified — confirm before relying on it); note that Colorado HB 26-1263 covers conversational AI services offered to Colorado users generally, not only companions. Hawaii SB 3001 adds similar duties from 2028 (exact date to be pinned from the enrolled act); parallel companion duties under California SB 243 (in force, private right of action) and Connecticut PA 26-15 §§4-6 (from 1 January 2027) live in the california_ai and connecticut_cart packs.
Maintain persistent non-human labeling on every consumer surface (10 M.R.S. §1500-DD (enacted as §1500-Y by P.L. 2025, c. 294; reallocated by RR 2025, c. 1) (anchor); N.Y. GBL art. 47; Utah Code §13-2-12/13-72; Cal. B&P Code §22601 et seq.)
Label every consumer-facing conversational surface as AI — a persistent, conspicuous non-human indicator at session start, and in the persona name where practical — and treat removing or weakening the label as a regulated product change. This single control satisfies the in-force Maine trigger, provides the baseline for the New York and 2027-wave cadence duties, and defuses the 'could a reasonable person be misled' element that most of the cluster hooks on; Utah's generative-AI disclosure duties (utah_aipa pack) and California SB 243's reasonable-person trigger (california_ai pack) point the same way. Keep screenshots and change logs of the labeling as compliance evidence.
Document per-state carve-out and safe-harbor fit; re-screen on product changes (Neb. LB 525 (business-entity/narrow-topic exclusions); Ga. SB 540; Wash. HB 2225; N.Y. GBL art. 47; Nev. AB 406 safe harbors)
Record a per-state determination of why each statute does not reach the product: which carve-out or definitional element applies (Nebraska's business-entity and narrow-and-discrete-topic exclusions; Georgia's customer-service, internal-tool, and educational exclusions; Washington's business-oriented, gaming, and virtual-assistant exclusions; New York's human-relationship companion definition; the Nevada/Illinois therapy safe harbors — self-help not purporting to offer professional care, or licensed-provider administrative support with independent accuracy review). Re-run the screen on any consumer-facing launch, persona or memory feature, wellness or emotional-support feature, or marketing change — the carve-outs are behaviour- and marketing-dependent, and a single feature release can silently move you into the companion or therapy tiers. This file is your first response to an AG inquiry and your evidence of good faith.
Disclaimer
Compliance guidance, not legal advice. Confirm obligations with counsel. Content version 2026.07.29-2, verified 2026-07-29.
Frequently asked questions
Who does US Conversational AI (Multi-State) apply to?
No consumer-facing conversational AI reaching a covered state reported. This pack covers the 2025-26 state chatbot/companion/AI-therapy cluster, which attaches to conversational AI interacting with consumers in Maine, New York, the therapy-ban states (NV, IL, UT, RI, TN, VT, ME, CO), or the 2027-wave states (CO, WA, OR, RI, NE, ID, GA). Internal-only and authenticated-B2B-only tools sit outside the cluster — re-screen on any consumer-facing launch or persona, memory, or wellness feature. Coverage turns on the screening questions listed on this page — each obligation then applies its own statutory gate.
When does US Conversational AI (Multi-State) take effect?
in force in stages — UT since 7 May 2025, NV since 1 July 2025, IL since 1 August 2025, VT since 17 June 2026, RI since 22 June 2026, TN since 1 July 2026, ME since 29 July 2026; CO applies from 12 August 2026 and MO from 28 August 2026. in force since 16 September 2025. in force since 5 November 2025. applies from 1 January 2027 (CO HB 26-1263) and from 1 July 2027 (NE LB 525, ID S 1297). applies from 1 January 2027 (CO HB 26-1263, WA HB 2225, OR SB 1546, RI S 2195) and from 1 July 2027 (NE LB 525, ID S 1297, GA SB 540). earliest binding duty (Maine) in force since 16 September 2025. in-force layer (Maine, New York, therapy bans) — document current fit; earliest duty in force since 16 September 2025. re-verify before the first 2027-wave duties apply from 1 January 2027
What are the obligations under US Conversational AI (Multi-State)?
Stop or restructure AI-therapy representations and functions; Maine: disclose that the consumer is talking to AI, not a human; New York: AI-companion disclosure cadence and crisis protocol; 2027 wave: general conversational-AI duties (CO, NE, ID) — crisis protocol and no-therapy-representation; Get ready for the 2027 conversational-AI wave (CO, WA, OR, RI, NE, ID, GA); Maintain persistent non-human labeling on every consumer surface; Document per-state carve-out and safe-harbor fit; re-screen on product changes.
