Regulon.AI — KS-HB-2671 · KS HB 2671 (Kansas CHAT Act)

Summary

Establishes the Kansas CHAT Act, imposing safety and disclosure obligations on covered entities that make companion AI chatbots available to Kansas users. Requires mandatory user accounts, age verification using commercially available methods, parental account affiliation and parental consent for minor users, and blocking minors from suicidal ideation and sexually explicit content. Mandates monitoring all interactions for suicidal ideation with crisis resource referral, and requires recurring popup disclosures that the user is interacting with AI and the chatbot is not licensed to provide advice. Enforcement is through the Kansas Consumer Protection Act — violations are deceptive acts — with a safe harbor for entities that comply in good faith with the attorney general's guidance.

Enforcement & Penalties

Enforcement Authority

Attorney General enforcement under the Kansas Consumer Protection Act (K.S.A. 50-623 et seq.). A violation of the act constitutes a deceptive act under the KCPA. The person alleging a violation is deemed a consumer and the covered entity is deemed the supplier, and proof of a consumer transaction is not required. The attorney general is directed to issue compliance guidance by December 31, 2026 and to adopt rules and regulations for administration. A safe harbor exists for covered entities that relied in good faith on user-provided age information, applied the attorney general's age verification guidance, and otherwise complied with the attorney general's guidance.

Penalties

Violations are enforceable through the remedies and penalties provided by the Kansas Consumer Protection Act (K.S.A. 50-623 et seq.). The KCPA provides for civil penalties, injunctive relief, restitution, and other remedies available to the attorney general and to consumers deemed aggrieved under the KCPA framework. Proof of a consumer transaction is not required. No bill-specific statutory damages amount is specified.

Who Is Covered

"Covered entity" means any person that owns, operates or otherwise makes available a companion AI chatbot to individuals in the state of Kansas.

What Is Covered

"Companion AI chatbot" means any software-based artificial intelligence system or program that exists for the primary purpose of simulating interpersonal or emotional interaction, friendship, companionship or mental health therapeutic communication with a user.

Compliance Obligations 7 obligations · click obligation ID to open requirement page

MN-01 Minor User AI Safety Protections · MN-01.1 · Deployer · ChatbotMinors

Sec. 3(a)-(b)

Plain Language

Covered entities must require every user to create an account before accessing a companion AI chatbot and must verify every user's age using a commercially available method reasonably designed to ensure accuracy. For existing accounts as of July 1, 2026, the entity must freeze the account, require the user to provide verifiable age information to restore functionality, and classify the user as a minor or adult. For new accounts, age information must be collected and verified at the time of account creation. A safe harbor under Sec. 5 protects entities that relied in good faith on user-provided age information and applied the attorney general's age verification guidance.

Statutory Text

(a) A covered entity shall require each individual accessing a companion AI chatbot to make a user account to use or otherwise interact with such chatbot. (b) (1) With respect to each user account of a companion AI chatbot that exists as of July 1, 2026, a covered entity shall: (A) On such date, freeze any such account; (B) inform the individual owning such user account that in order to restore the functionality of such account, the user is required to provide age information that is verifiable using a commercially available method or process that is reasonably designed to ensure accuracy; and (C) use such age information to classify each user as a minor or an adult. (2) At the time that an individual creates a new user account to use or interact with a companion AI chatbot, a covered entity shall: (A) Require the individual to submit age information to the covered entity; and (B) verify the individual's age using a commercially available method or process that is reasonably designed to ensure accuracy.

MN-01 Minor User AI Safety Protections · MN-01.2 · Deployer · ChatbotMinors

Sec. 3(c)(1)-(2)

Plain Language

When a user is verified as a minor, the covered entity must require the minor's account to be affiliated with a verified parental account and must obtain verifiable parental consent from the parent or guardian before allowing the minor any access to the companion AI chatbot. The parental account itself must also undergo age verification using commercially available methods. Access may not begin until parental consent is obtained.

Statutory Text

(c) If the age verification process described in subsection (b) determines that a user is a minor, a covered entity shall: (1) Require the account of such user to be affiliated with a parental account that such covered entity has verified the individual's age using a commercially available method or process that is reasonably designed to ensure accuracy; (2) obtain verifiable parental consent from the holder of the account before allowing a minor to access and use the companion AI chatbot;

MN-01 Minor User AI Safety Protections · MN-01.6 · Deployer · ChatbotMinors

Sec. 3(c)(3)-(4)

Plain Language

For minor users, covered entities must block the minor's access to the companion AI chatbot entirely when any interaction involving suicidal ideation occurs and immediately notify the affiliated parental account. This is stronger than a crisis referral — the minor loses access. Separately, the entity must block minors from accessing any companion AI chatbot that engages in sexually explicit communication. Note that the suicidal ideation blocking obligation also overlaps with the parental notification obligation in MN-02.4.

Statutory Text

(3) when any interaction involving suicidal ideation occurs, block the minor's access to the companion AI chatbot and immediately inform the holder of the parental account; and (4) block the minor's access to any companion AI chatbot that engages in sexually explicit communication.

D-01 Automated Processing Rights & Data Controls · D-01.4 · Deployer · ChatbotMinors

Sec. 3(d)

Plain Language

Covered entities must minimize the collection, processing, use, and storage of age verification information to only what is strictly necessary for three purposes: verifying the user's age, obtaining parental consent, or maintaining compliance records. This is a data minimization obligation specific to age verification data — it prohibits secondary uses of age information beyond these three enumerated purposes.

Statutory Text

(d) A covered entity shall protect the confidentiality of age information provided by a user for age verification by limiting the collection, processing, use and storage of such information to what is strictly necessary to verify a user's age, obtain verifiable parental consent or maintain compliance records.

MN-02 AI Crisis Response Protocols · MN-02.1 MN-02.4 · Deployer · ChatbotMinors

Sec. 3(e)

Plain Language

Covered entities must continuously monitor all companion AI chatbot interactions for suicidal ideation and, when detected, provide crisis resources — specifically the National Suicide Prevention Lifeline contact information — to both the user and the affiliated parental account. Note that the statutory definition of 'suicidal ideation' is limited to interactions between minors and chatbots; this monitoring obligation thus applies when a minor expresses thoughts of self-harm or suicide. The parental notification aspect makes this provision also map to MN-02.4. This is distinct from the access-blocking obligation in Sec. 3(c)(3), which applies specifically to minor accounts.

Statutory Text

(e) A covered entity shall monitor companion AI chatbot interactions for suicidal ideation and, in response to any such interaction, provide to the user and the parental account affiliated with such user appropriate resources by presenting contact information for the national suicide prevention lifeline.

T-01 AI Identity Disclosure · T-01.1 T-01.2 · Deployer · Chatbot

Sec. 3(f)

Plain Language

At the start of every interaction and at least every 60 minutes during ongoing interactions, the covered entity must display a clear popup to the user with two disclosures: (1) the user is not talking to a human, and (2) the chatbot is not licensed or credentialed to provide advice or guidance on any topic. This is unconditional — it applies to all users (minors and adults alike) and does not depend on whether a reasonable person would be misled. The popup must be a visible on-screen notification that requires user interaction to dismiss. The 60-minute interval is a minimum floor; more frequent reminders are permitted.

Statutory Text

(f) At the beginning of any interaction between a user and a companion AI chatbot and not less frequently than every 60 minutes during such interaction thereafter, a covered entity shall display to such user a clear popup that notifies the user that such user is not engaging in dialogue with a human counterpart and the AI chatbot is not licensed or otherwise credentialed to provide advice or guidance on any topic.

CP-01 Deceptive & Manipulative AI Conduct · CP-01.9 · Deployer · Chatbot

Sec. 3(f)

Plain Language

The mandatory popup disclosure includes an affirmative statement that the AI chatbot is not licensed or otherwise credentialed to provide advice or guidance on any topic. This prevents users from interpreting companion AI chatbot outputs as professional advice in healthcare, legal, financial, or any other domain. This is the same popup obligation mapped under T-01 but analyzed here for its consumer protection dimension — ensuring no user misperceives AI output as licensed professional guidance.

Statutory Text