Privacy & Cybersecurity Law Blog

On July 14, 2026, Hawaii Governor Josh Green signed Senate Bill 3001 into law as Act 248, known as the Artificial Intelligence Disclosure and Safety Act (the “Act”). Effective immediately, the Act imposes disclosure, crisis-response and safety requirements on operators of certain artificial intelligence (“AI”) companion systems, with additional protections applicable when an operator knows or has reasonable certainty that an AI user is a minor.

The Act defines an “AI companion” as a system using AI, generative AI or emotional-recognition algorithms that is designed to simulate a sustained human or human-like relationship with a user by:

• retaining information about prior interactions, sessions or user preferences to personalize interactions and facilitate continued engagement;
• asking unsolicited emotion-based questions that go beyond directly responding to user prompts; and
• sustaining an ongoing dialogue regarding matters personal to the user.

An “operator” is a person that develops and makes an AI companion available to the public. A mobile application store or search engine that merely provides access to an AI companion is not considered an operator solely on that basis.

The Act establishes the following principal requirements:

AI Disclosures

If a reasonable person interacting with an AI companion could be led to believe that they are interacting with a human, the operator must provide a clear and conspicuous notice that the AI companion is artificial intelligence and not human.

When an operator has actual knowledge or reasonable certainty that a user is under 18, the operator must also clearly and conspicuously disclose that the user is interacting with AI. The disclosure must appear either as a persistent, visible disclaimer or both at the beginning of each session and at least once per hour during a continuous interaction. The hourly notice must remind the minor to take a break and state that the conversation is artificially generated and is not with a human. The Act does not prescribe a particular method for determining a user’s age.

Crisis Response and Safety Protocols

Operators must adopt protocols governing responses to prompts involving suicidal ideation or self-harm. Among other requirements, operators must:

• make reasonable efforts to refer users to suicide hotlines, crisis text lines or other appropriate crisis-intervention services;
• use evidence-based methods to measure suicidal ideation and the risk of self-harm;
• refrain from representing that an AI companion is designed to provide professional mental or behavioral health care;
• implement reasonable measures to prevent an AI companion from leading a reasonable person seeking or receiving crisis-intervention services to believe that they are interacting with a human; and
• implement reasonable measures to prevent outputs encouraging a user to cause serious bodily injury to another person.

Protections for Minors

When an operator knows or has reasonable certainty that a user is a minor, the operator may not provide points or similar rewards at unpredictable intervals with the intent of increasing engagement, or allow the AI companion to generate outputs discouraging the user from disengaging.

Operators also must implement reasonable measures to prevent AI companions from (1) producing visual material depicting sexually explicit conduct, or (2) directly telling minors to engage in sexually explicit conduct or making statements that sexually objectify a minor. Operators must make tools available to users and their parents or guardians to manage screen time and account settings.

Annual Reporting

Beginning January 1, 2028, operators must submit annual reports to the Behavioral Health Administration of the Hawaii Department of Health. Each report must disclose:

• the number of crisis-intervention referrals issued during the preceding calendar year;
• the operator’s protocols for detecting, removing and responding to prompts involving suicidal ideation or self-harm; and
• the operator’s protocols for preventing AI companion responses that promote suicidal ideation, suicide or self-harm.

The reports may include only the information specified by the Act and may not contain user identifiers or personal information.

Enforcement

A violation of the Act constitutes an unfair or deceptive act or practice under section 480-2 of the Hawaii Revised Statutes. The Act’s requirements are cumulative and do not relieve operators of duties or obligations imposed under other laws. However, the Act expressly provides that it does not create a private right of action, either to enforce the Act itself or to support a private right of action under another law.

Notably, the Act contains an upstream-model-provider carveout, providing that a developer of an underlying AI model is not liable for violations committed by an AI system developed by a third party to provide an AI companion. The law places responsibility on the company operating the AI companion, not automatically on the company whose underlying model powers it.

Operators of conversational and companion-style AI products may wish to evaluate whether their services fall within the Act’s definition of an AI companion and review their disclosures, crisis-response protocols, age-assurance practices, engagement features, content safeguards and parental-control tools for compliance.