AI Regulation Tracker  /  State statute

Hawaii Signs an AI Companion Safety Law, and a Deepfake Law the Same Day

On July 14, 2026, Hawaii's governor signed Senate Bill 3001, the Artificial Intelligence Disclosure and Safety Act, into law as Act 248, putting real duties on the companies that run AI companion products. The same day, the governor signed House Bill 2137 as Act 247, letting people sue over nonconsensual, realistic AI imitations of themselves when the imitation is used in an advertisement or to cause harm, fraud, defamation, or harassment.

By Anthony Guerriero  ·  The Leveraged Years Regulatory Research  ·  Published July 15, 2026  ·  Last updated July 15, 2026

What SB 3001 actually requires

Start with a point that matters for anyone reading a headline about this bill. The statute does not regulate "chatbots" as a broad category. It regulates a defined thing it calls an "AI companion," and the definition is narrow. An AI companion is a system using artificial intelligence, generative AI, or emotion-recognition algorithms that is designed to simulate a sustained human or human-like relationship with a user by doing three things together: remembering prior sessions and preferences to keep you engaged, asking unprompted emotion-based questions that go past a direct answer, and sustaining an ongoing dialogue about matters personal to you. A general customer-service bot or a one-off question-and-answer tool is not the target. A companion product built to keep someone coming back and talking about their life is.

The duties fall on the "operator," which the law defines as a person who develops and makes an AI companion available to the public. An app store or a search engine that merely provides access to one does not become an operator just for that.

Here is what an operator has to do. First, disclosure. If a reasonable person interacting with the AI companion would be led to believe they are talking to a human, the operator has to give a clear and conspicuous notification that it is artificial intelligence and not a person. That is the baseline for every user.

Second, a heightened rule for minors. Where the operator has actual knowledge or reasonable certainty that a user is a minor, meaning anyone under eighteen, it has to disclose the AI nature of the interaction in one of two ways. Either a persistent visible disclaimer, or both a disclosure at the beginning of each session and a reminder that appears at least once an hour during a continuous interaction, telling the user to take a break and that the conversation is artificially generated and not with a human.

Third, a suicide and self-harm protocol. The operator has to adopt a protocol for the companion to respond to prompts about suicidal ideation or self-harm that includes making reasonable efforts to refer the user to crisis intervention providers, such as a suicide hotline or crisis text line. It has to use evidence-based methods for measuring suicidal ideation and self-harm risk. It cannot program the companion to represent that it provides professional mental or behavioral health care. It has to take reasonable measures to keep the companion from pretending to be human when a user is seeking crisis services, and to keep it from generating outputs that encourage the user to seriously physically hurt another person.

Fourth, design limits aimed at minors. Where the operator knows or has reasonable certainty a user is a minor, it cannot hand out points or similar rewards at unpredictable intervals to drive engagement, cannot let the companion generate outputs designed to discourage the user from leaving, and has to take reasonable measures to stop the companion from producing sexually explicit visual material, telling the minor to engage in sexually explicit conduct, or making statements that sexually objectify the user. It also has to give users, parents, and guardians tools to manage screen time and account settings.

Fifth, reporting. Beginning January 1, 2028, the operator has to file an annual report with the behavioral health administration of the state Department of Health. The report covers how many times it issued a crisis referral in the prior year and the protocols it has to detect and respond to self-harm prompts. The statute is explicit that the report cannot contain user identifiers or personal information.

How it is enforced, and where the limits are

This is the part executives should read twice, because it shapes the risk. A violation of the section is an unfair or deceptive act or practice under Hawaii Revised Statutes section 480-2. In plain terms, this is a consumer-protection statute enforced by the state, and the attorney general's office and the Office of Consumer Protection are the machinery behind it. The law says nothing in the section creates a private right of action to enforce it. So the exposure here is state enforcement, not a wave of individual consumer suits under this section.

The statute also draws a line on who is responsible. It does not create liability for the developer of an underlying AI model when the violation comes from a system a third party built to provide an AI companion. And it says its duties are cumulative, meaning it does not relieve an operator of obligations that already exist under other law.

One more precision point. The enrolled text adds the new duties as a section of chapter 481B and leaves the exact section number blank for the reviser to assign on codification. If you are building a compliance citation, cite the act and the chapter, and pick up the assigned section number once it is codified rather than guessing at it.

The companion law: HB 2137 on AI deepfakes

House Bill 2137, signed the same day as Act 247, is a different tool for a related problem. It does not regulate companion bots. It creates a new chapter of Hawaii law protecting people from realistic AI-generated imitations of themselves.

The core prohibition is this. It is unlawful for any person to knowingly publish a realistic digital imitation of an identifiable individual, without that individual's consent, if the imitation is used in connection with an advertisement, causes harm, or is used to commit fraud, defamation, harassment, or other criminal acts. "Consent" is defined as express written permission. A "digital imitation" is a highly realistic AI-generated depiction of a real person's voice, face, or likeness in a recording or work where they did not actually perform or appear.

The remedy is a civil suit. An injured individual, or their estate for up to ten years after death, can sue for injunctive relief to pull the imitation down, monetary damages of up to twenty-five thousand dollars per advertisement or their actual damages including reputational and emotional harm, punitive damages where malice is proven, and attorneys' fees. The attorney general can bring an action for equitable relief where the conduct involves broad public interest or widespread harm.

The law carves out protected uses, though these are statutory exemptions with their own conditions, not blanket immunities. As enacted, it does not reach parody, satire, commentary, criticism, scholarship, or political and educational expression. It does not reach news reporting that uses altered content to illustrate a story, or documentary and biographical work with some degree of fictionalization. It exempts the platforms and media that merely carry third-party content, and it says it neither limits nor expands Section 230 protections.

A word of caution on secondary coverage of this bill. Earlier House drafts included a general "clear and conspicuous" AI-disclosure label and a separate regime for synthetic performers in advertising. Those provisions did not survive into the enacted conference draft. The law that got signed is a prohibition-and-civil-remedy statute, not a labeling mandate. Read it for what it is.

So what this means for how you operate

If you run an AI companion product and it is available to people in Hawaii, you have concrete work to do, and the clock already started. You need a machine-not-human disclosure that a reasonable user actually sees. You need an age-aware path that triggers the minor-specific disclosures and design limits when you have actual knowledge or reasonable certainty a user is under eighteen. You need a real self-harm response protocol wired to crisis resources, not a generic safety disclaimer. You need to strip out engagement mechanics aimed at minors, the variable rewards and the anti-disengagement nudges. And you need to stand up the data pipeline for the 2028 health-department report now, because it counts events across a calendar year.

If you are not in the companion business but you use AI-generated likenesses in marketing, HB 2137 is your line. Using a real person's realistic AI likeness in an ad without their written consent is now a civil liability in Hawaii, with statutory damages per advertisement and attorney-general exposure on top.

The larger signal is worth naming without overstating it. A single state has moved from talking about AI companion safety to imposing operating duties with an enforcement hook, and it did the deepfake question in the same signing. Other states have been circling both issues. Hawaii is now a live compliance jurisdiction on both, which means the practical question for an operator is no longer whether to build these controls, but whether the version you already have would satisfy a state that has written the requirements down.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel in the relevant jurisdiction.