AI Regulation Tracker  /  State law

Nebraska LB 525 gives conversational AI operators until July 2027 to add disclosures and crisis protocols

Nebraska has signed the Conversational Artificial Intelligence Safety Act, which requires public chatbots to disclose their AI nature, protect minors, refer users in crisis, and stop claiming to deliver mental health care. The duties take effect July 1, 2027.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

Nebraska has become one of the states writing safety rules for consumer chatbots. Governor Jim Pillen signed Legislative Bill 525 on April 14, 2026, after the Legislature passed it 49 to 0 on April 10. The bill carries two separate measures, an Agricultural Data Privacy Act and, more relevant to conversational-AI operators, the Conversational Artificial Intelligence Safety Act. The safety act sets four duties for operators and gives them a long runway. Under the slip law, sections 12 through 18 become operative July 1, 2027, so the obligations described below are law but not yet enforceable.

The delay matters for planning. Operators have more than a year to inventory their products, rewrite disclosures, and build crisis-response protocols before the state can act. That runway is unusual, and it is a reason to start now rather than later. Disclosure text, minor-detection logic, and a documented crisis protocol are the kind of changes that touch product, legal, and engineering at once, and they rarely ship on a single sprint. The following is what the act requires, and what it does not.

The act reflects a specific concern that ran through the 2026 legislative session in several states, the risk that open-ended, human-styled chatbots present to minors and to people in distress. Nebraska's approach is narrower than a general AI law. It does not try to govern every automated system. It targets the consumer-facing, conversation-simulating products where a user can plausibly forget that the counterpart is software.

Disclosure that a user is talking to AI

The central duty is transparency. Operators of a conversational AI service must make clear that the user is interacting with artificial intelligence rather than a person. As reported by law firms tracking the bill, the disclosure obligation is triggered when a reasonable person would be misled into believing the service is human. Practically, that reaches products designed to feel like a human correspondent, including companion apps and human-styled assistants, and it is less likely to reach an obvious, clearly labeled utility.

The requirement rises for minors. Secondary analyses of the text describe a heightened standard for services used by minors, requiring either a persistent notice that the user is interacting with AI or a disclosure at the start of a session with periodic reminders during use. Reporting on the exact cadence varies, with one summary citing a reminder roughly every three hours, so operators should confirm the precise interval against the statutory text before building it into a product.

Added protections for minors

The act treats minors as a distinct class. Beyond heightened disclosure, secondary analyses describe limits aimed at engagement and content. Operators serving minors are reported to be barred from using unpredictable reward schemes designed to increase engagement, from generating sexually explicit material directed at minors, and from producing content that creates a false impression of human interaction, emotional dependence, or romantic scenarios, including romantic innuendo. Several summaries also describe controls against a service claiming to be human or sentient when interacting with a minor.

The through-line is that a minors-facing product cannot lean on romantic, sexual, or emotionally manipulative design. Operators of any app that a significant number of minors can access should assume these controls apply and plan age-appropriate default behavior rather than relying on a terms-of-service age gate alone.

A protocol for suicide and self-harm

The act requires operators to plan for crisis. Consistent across the primary summary and secondary analyses, an operator must adopt a protocol for the service to respond to user prompts regarding suicidal ideation or self-harm. The reported standard includes making reasonable efforts to refer users to crisis service providers, such as suicide prevention hotlines. This is a documented-process duty, not a single line of code. Operators will need a written protocol, a defined referral path, and a way to show the protocol exists and functions.

No claim of professional mental or behavioral health care

The fourth duty limits how a chatbot may present itself. The act prohibits an operator from knowingly and intentionally causing or programming a conversational AI service to represent that it is designed to provide professional mental or behavioral health care. This is aimed squarely at products that market themselves as therapy substitutes or clinical care. The "knowingly and intentionally" standard suggests the target is deliberate positioning and programming, not an isolated, unscripted model output, though operators positioned near mental health should treat their marketing copy, onboarding language, and system prompts as the places most likely to create exposure.

Scope, and what the act does not do

Scope is defined by the product, not the company's address. Secondary analyses describe a conversational AI service as an application available to the general public that primarily simulates human conversation through text, audio, or visual means, and they describe the covered operator as the entity making that service available to Nebraska users regardless of where the operator sits. Several summaries report carve-outs for narrow-purpose systems, business-only or enterprise tools, and standard customer-service chatbots, which suggests the act is aimed at open-ended, consumer-facing conversation rather than task-specific bots. Operators should confirm any exclusion against the statutory definitions rather than assuming their product falls outside the act.

The act is not a general AI statute. It does not regulate model training, it does not create broad algorithmic-transparency duties, and on the reported reading it does not create a private right of action. Enforcement rests with the Nebraska Attorney General. Secondary reporting describes civil penalties and injunctive relief available to the state, with one summary citing a penalty floor of $1,000 per violation and a cap of $500,000 per operator per enforcement action, and a carve-out shielding upstream model developers from liability for a third-party operator's violations. Those specific figures come from secondary analysis and should be checked against the enacted text before they are relied on.

A practical sequence before July 2027

Compliance leads can treat the act as four workstreams rather than one project. The first is a product inventory. An operator should list every consumer-facing conversational service it offers, note which ones Nebraska users can reach, and flag which of those a reasonable user might mistake for a human. That inventory decides where the disclosure duty bites. The second workstream is disclosure design, including the standing or session-based notices for general users and the heightened, more frequent notices for minors. The third is the minor-safety layer, which combines age signals with content controls that block sexually explicit and romantic output and remove engagement mechanics aimed at children. The fourth is the crisis protocol, which needs a written procedure, a tested referral path to recognized hotlines, and a record that both exist.

Documentation is the connective tissue. Because enforcement sits with the Attorney General and turns on whether an operator met its duties, the ability to show a written protocol, dated disclosure copy, and a minor-safety configuration is likely to matter as much as the underlying code. Operators that treat this as a paper exercise as well as an engineering one will be in a stronger position if the state ever asks.

The multistate picture for a US reader

For operators outside Nebraska, the practical signal is familiar. A single state has set a concrete standard for chatbot disclosure, minor safety, and crisis response, and it joins a group of states legislating in the same direction in 2026. Secondary reporting places Nebraska among several states that acted on chatbots and mental health in the same window, alongside earlier activity such as Illinois's 2025 restrictions on AI in mental health services. The details differ from state to state, and an operator cannot assume Nebraska's text matches another jurisdiction's. What the trend does mean is that a product built to meet Nebraska's July 2027 requirements, clear AI disclosure, minor protections, a crisis protocol, and no clinical-care claims, will be closer to compliance if and when similar rules appear elsewhere. The reverse is also true. An operator that ignores this now may face a patchwork of state duties with overlapping but non-identical requirements, which is harder to retrofit than to build once against the most demanding standard in view.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.