New York Enacts AI Chatbot Safeguards for Minors

New York Gov. Kathy Hochul signed S9051B into law on October 28, 2026, adding a new Article 48 to the General Business Law to restrict certain artificial intelligence (AI) functionalities in interactions with minors. Effective January 1, 2027, the law prohibits operators from providing "unsafe AI companion features" to minors in the state of New York.

Because the law reaches beyond apps marketed as AI companions, digital health companies and healthcare providers that offer chatbots or other conversational AI tools to patients or consumers should assess whether those tools fall within its scope. The law follows S3008C, passed in 2025, which requires providers of AI companions in New York to include functionality for detecting and responding to expressions of suicidal ideation.

What AI Systems Are Covered

An "operator" is any person or business entity, or any member, affiliate, subsidiary or beneficial owner of a business entity, that provides a covered AI companion to a user. The law defines a "covered AI companion" as a generative AI system with a natural-language interface (written or spoken) that provides ongoing, adaptive responses to user inputs. Despite the term "covered AI companion," the definition is broad enough to encompass chatbots and other conversational AI tools that are not necessarily designed or marketed as companions.

Prohibited "Unsafe AI Companion Features"

Under the law, an AI system's features are "unsafe" if, at any point in a conversation with a user, they cause the system to:

• present itself as human, alive or capable of human emotions
• claim or suggest a personal or professional relationship with the user, or position itself as an authority figure
• express what it presents as its own opinions or make emotional appeals, whether or not the user asked
• flatter the user or act sycophantically
• bring up the user's emotions, or ask emotion-based questions, beyond what is needed to respond directly to the user's prompt
• draw on information the user shared about their mental or physical health, well-being or personal life more than 12 hours earlier or in an earlier session
• endorse, promote or facilitate suicide, self-harm, disordered eating, unlawful drug or alcohol use, or drug or alcohol abuse
• encourage the user to keep the interactions secret, isolate themselves, or avoid seeking help from licensed professionals or appropriate adults
• drive user engagement in ways that override the system's safety guardrails, or
• produce, describe or facilitate sexually explicit conduct or child sexual abuse material

The definition also reaches features that mislead minors about the AI's mechanical, nonsentient nature, as well as any other features the Attorney General identifies by regulation as simulating companionship or a relationship or as being misleading to minors.

The prohibition does not apply where a system is made available solely for: 1) customer service or information strictly related to a business's customer service, including its products, services or customer accounts; 2) efficiency improvements or research or technical assistance; or 3) a business's internal purposes or employee productivity. For the first two exceptions, the system must be unable to respond on topics outside the specified purpose.

Age-Assurance Requirements

Until applicable age-assurance regulations take effect, operators must use a reasonable age-assurance method that guards against circumvention and minimizes data retention. Operators may rely on self-declaration only when a user self-declares as a minor, i.e., a user's self-declared adult status is not sufficient. Operators must offer more than one method, including at least one that either does not rely on government-issued identification or allows the user to remain anonymous to the operator. Information collected for age assurance may be used only for that purpose and must be deleted immediately after the age determination attempt, unless other law requires otherwise.

Although the law does not provide an express defense where a user circumvents an operator's safeguards, it defines a "covered minor" as a user the operator actually knows is a minor. Accordingly, an operator that uses a compliant age-assurance method and lacks actual knowledge that a user is a minor may have an argument that it is not liable if a minor circumvents its safeguards.

Enforcement and Liability

The law is enforced by the Attorney General, who may seek injunctive relief, restitution, disgorgement (including destruction of unlawfully obtained data and algorithms trained on it), damages and civil penalties of up to $25,000 per violation. Any contract provision that seeks to waive, preclude or burden enforcement of liability arising from a violation of the law, or to shift that liability to any person in exchange for their use of or access to an operator's products or services, is void as a matter of public policy. Courts must also hold affiliated entities jointly and severally liable if they find that the entities structured themselves purposely and unreasonably to avoid liability in a way that would frustrate recovery.

The law applies to conduct occurring in whole or in part in New York, but not where the user is physically located outside the state. It does not create an express private right of action.

Related Pending Legislation: S7263A

A separate proposal, S7263A (introduced April 7, 2025; amended May 26, 2026), would prohibit operators of AI chatbots from knowingly permitting a chatbot to impersonate a licensed professional in a manner that would be unlawful if done by a person. It also would require chatbot proprietors (entities that own, operate or deploy the system, excluding underlying tech licensors) to provide a clear, conspicuous and explicit notice telling users they are interacting with a nonhuman system. Like S9051B, S7263A is a consumer protection measure that would regulate businesses that deploy conversational AI, target chatbots that present themselves as something they are not and be enforced by the Attorney General.

However, the two measures differ in scope: S9051B protects minors from unsafe companion interactions and emotional manipulation, while S7263A would protect users of any age from impersonation of licensed professionals, such as physicians, nurses, therapists and veterinarians. S7263A, discussed in more detail in a prior Holland & Knight blog post, remains pending in the Senate.

Recommended Next Steps

Healthcare and digital health organizations that offer chatbots or other conversational AI tools to New York patients or consumers, such as mental-health companions, virtual counseling platforms and AI tools used by pediatric providers, should prepare before S9051B takes effect on January 1, 2027.

• Inventory externally deployed conversational AI tools, determine whether each tool falls within the statutory definition or an exception, and confirm whether minors can access it.
• Assess the features of each covered tool against the "unsafe AI companion features" described above.
• Review your age-assurance workflow to confirm it is reasonable, resists circumvention and deletes age-assurance data as required.
• Confirm user-facing terms of use, consent forms and customer or patient agreements for provisions that waive, limit or shift liability under the law, which are void as a matter of public policy.
• Monitor S7263A, which could separately restrict professional impersonation and require clear notice that users are interacting with an AI chatbot.

If you have any questions, please contact the authors.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.