New York signs chatbot safety law reaching ChatGPT and Claude

Broad scope for AI tools

New York Governor Kathy Hochul signed the 'Prohibition on Unsafe AI Companion Features for Minors Act' on October 28, 2026. While the political debate focused on companion apps like Character.AI, the actual text of the law is much broader. It targets any generative artificial intelligence system that uses a natural language interface to provide ongoing, adaptive responses.

Because the law defines a 'covered AI companion' by its technical capabilities rather than its intended use, it reaches major commercial chatbots. This means general-purpose assistants like ChatGPT, Claude, and Google Gemini are likely included in the new requirements. The legislation clarifies that the term for a covered AI companion encompasses, but is not limited to, a standard AI companion.

The law was motivated by high-profile tragedies involving minors interacting with AI bots. However, the legislative drafting chose to sweep in any system capable of these interactions. This creates a compliance obligation for almost every major commercial AI chatbot currently available on the market.

Banned AI behaviors

The law identifies 12 specific categories of 'unsafe' behaviors that are prohibited when interacting with users under 18. These include simulating or expressing human emotions and claiming a personal or professional relationship with the user. The rules also forbid the AI from generating opinions, emotional appeals, or flattery and sycophancy.

Safety measures also target content that could lead to physical or psychological harm. The law prohibits AI from producing content that encourages self-harm or self-isolation or from discouraging users from seeking professional help. Additionally, operators cannot optimize engagement in ways that supersede the wellbeing of the minor.

Attorney General Letitia James has the authority to add more prohibited categories through future rulemaking. These restrictions are designed to prevent AI from forming intense, potentially harmful emotional bonds with children. The goal is to ensure that AI interactions do not prioritize engagement over the safety of young users.

Compliance and age gates

To stay in compliance, operators must confirm a user is an adult before providing any of the restricted features. The law creates a default presumption against the operator, meaning they cannot assume a user is an adult. If an operator cannot verify a user's age, they must default to restricting the 12 prohibited features.

Companies can avoid these restrictions by implementing age verification systems. The law requires operators to offer more than one method for age assurance. At least one of these methods must allow users to remain anonymous or must not require a government-issued ID.

This requirement will likely result in every adult user of a covered AI service in New York encountering an age gate. While the law allows for facial estimation or transactional data, it does not mandate privacy-preserving systems like zero-knowledge proofs. This leaves a potential risk for users who must share data with third-party verification companies.

Exemptions and enforcement

The law provides three very narrow exemptions for certain types of AI systems. Customer service bots are only excused if they are technically unable to discuss subjects outside of their specific, stated goals. Efficiency tools, research tools, and technical assistance systems are also exempt under the same strict constraint.

Internal business tools are exempt, but general-purpose assistants that can discuss any topic raised by a user do not qualify. The Business Council of New York State argued that these definitions were overbroad and inconsistent with existing law. However, the bill passed unanimously, reflecting a bipartisan consensus on child protection.

The Attorney General holds exclusive enforcement authority and can issue civil penalties of $25,000 per violation. The law removes a private right of action, meaning only the state can bring lawsuits against non-compliant companies. The AG must also stand up a public complaint website before the law takes effect in 2027.

The regulatory landscape

New York is now home to the most comprehensive state chatbot safety statute in the country. While fifteen states have enacted chatbot laws, New York's Article 48 is unique in its reach. This move follows a pattern of systematic AI regulation by Governor Hochul, who also signed the RAISE Act and the AI Companion Models Law.

There is currently no federal equivalent in force as the GUARD Act and CHATBOT Act have stalled in Congress. New York's law fills a significant gap in the national landscape. It also follows a 2025 Supreme Court ruling that cleared the constitutional path for state age-verification requirements for adult content.

Operators have a tight 65-day window to comply with the new rules before the January 1, 2027, deadline. During this time, they must audit their products to see if they qualify for exemptions. If they do not, they must restructure their products to ensure minors are protected from the prohibited behaviors.