California already has a companion-chatbot law. Here is how to tell if your AI app is covered.

"Companion chatbot" sounds like a product category you would know if you were in it. The statutory definition is broader than that, and the duties are already live.

California SB 243 (Chapter 677, Statutes of 2025) took effect on 1 January 2026. If you ship anything conversational and emotional, it is worth reading the definition against your product instead of assuming it is about someone else.

The statute defines a companion chatbot as an AI system with a natural-language interface that gives adaptive, human-like responses, is capable of meeting a user's social needs, and can sustain a relationship across multiple interactions. It carves out customer-service and business-operations bots, limited video-game characters, and standalone voice assistants that do not sustain relationships or elicit emotional responses. The "operator" is whoever makes the platform available to users in California, which is you, wherever you are based.

What it asks of operators: a clear notice that the chatbot is AI when a reasonable person could be misled into thinking it is human. A protocol to keep the bot from producing suicidal-ideation or self-harm content, which must refer people who express those thoughts to crisis services, and which must be published on your website. For users you know are minors, a disclosure that they are talking to AI, a default reminder at least every three hours to take a break, and reasonable measures against sexually explicit material. A statement that companion chatbots may not suit some minors. And, from 1 July 2027, yearly reports to the state Office of Suicide Prevention covering crisis referrals and your detection protocols, without user identifiers. Enforcement is private: someone injured by a violation can sue for the greater of actual damages or $1,000 per violation, plus fees.

My read, with the caveat that I am not a lawyer and this is not legal advice: the carve-outs are narrow. A reflective journaling companion that remembers you across sessions and answers in an adaptive, warm voice is closer to the definition than to a customer-service bot. Whether a given product is inside it is a question for counsel, but I would rather ask it now than after a complaint.

Three things I think any small team in this space can do this month. First, write down which of your features sustain a relationship across sessions (memory, persona, check-ins), because that is the part of the definition doing the work. Second, look at what actually happens in your product when someone writes something about self-harm, with real test messages, and make sure the referral appears and is documented publicly. Third, decide how you will know whether a user is a minor, because several duties turn on what you know. If you have no age signal at all, that is a decision too.

One more point on the reporting duty: it only asks for counts and protocols, not content. If your logging cannot tell you how many times a crisis referral fired, you will be building that measurement under a deadline.

Other states are moving too. A law-firm summary published on 7 October lists New York and Utah measures alongside California's. I have only checked California's text against the chaptered bill, so verify the others yourself before relying on them.

For Murror, this is the kind of boundary I want to be explicit about, because the people using a journal are often having a hard day. Compliance is a floor, and the product question is what you do above it.

If you build anything conversational, did you check your product against this definition, and what did you conclude?