Regulon — R-03 · Operational Performance Reporting

Core Obligation

Operators of certain AI systems must submit periodic scheduled reports to designated regulatory authorities on system performance in live deployment. Unlike incident reporting, this reporting is routine and not triggered by a specific event. Unlike regulatory submissions, the focus is on operational metrics from production rather than pre-deployment assessments.

Sub-Obligations2 sub-obligations

Name & Description

Enacted

Proposed

R-03.1

Periodic quantitative metrics reporting Operators must report defined operational metrics to a designated authority on a prescribed schedule. Metrics may include crisis referral notification counts, safety protocol activation counts, or other jurisdiction-specified data. Reports must not include personal information about users. Where reporting covers safety or mental health metrics, operators must use evidence-based methods for measuring the relevant conditions and disclose the methodology used.

1 enacted

8 proposed

R-03.2

Protocol and process reporting Operators may be required to report on the protocols and processes in place to address defined risk categories, including updates to those protocols since the prior reporting period.

1 enacted

5 proposed

Bills That Map This Requirement 11 bills

Bill

Status

Sub-Obligations

Section

CA AB 1988 (Companion Chatbot Crisis Interruption Pauses) CA

Pending 2027-01-01

R-03.1R-03.2

Bus. & Prof. Code § 22587.3(b)

Plain Language

Beginning January 1, 2028, operators must submit an annual report to the Office of Suicide Prevention covering the prior calendar year's data on: the existence of a graduated response system, all credible crisis expressions detected, and the duration and conditions of all crisis interruption pauses initiated. Because the report covers the preceding calendar year, operators must begin collecting and retaining this data from January 1, 2027 — not from the first reporting date. The Office of Suicide Prevention is the designated recipient but is not granted enforcement authority under this bill.

(b) Beginning January 1, 2028, an operator shall annually report to the Office of Suicide Prevention the items set forth in subdivision (a) with respect to the previous calendar year.

CO HB 1263 (Conversational AI Services) CO

Pending 2027-01-01

R-03.1R-03.2

C.R.S. § 6-1-1708(5)(a)-(d)

Plain Language

Beginning July 1, 2027, operators must submit an annual report to the Colorado attorney general's office covering: (1) the number of crisis referral notifications issued in the preceding calendar year, (2) protocols for detecting, removing, and responding to suicidal ideation or self-harm, and (3) protocols for preventing AI responses about suicidal ideation or self-harm. Reports must contain no user personal information or identifiers. Operators must use evidence-based methods for measuring suicidal ideation and self-harm. The attorney general's office will publish report data publicly. Because reports cover the preceding calendar year, operators should begin tracking crisis referral counts from January 1, 2027 — the date the underlying crisis protocol obligation takes effect.

(a) On and after July 1, 2027, an operator shall annually report to the attorney general's office: (I) The number of times the operator has issued a crisis service provider referral notification in the preceding calendar year; (II) Any protocols the operator implemented to detect, remove, and respond to instances of suicidal ideation or self-harm by a user of a conversational artificial intelligence service; and (III) Any protocols the operator implemented to prevent a conversational artificial intelligence service response about suicidal ideation or self-harm actions. (b) The report required by subsection (5)(a) of this section must not include any identifiers or personal information about a user of a conversational artificial intelligence service. (c) The attorney general's office shall post on its public website data from reports submitted pursuant to subsection (5)(a) of this section. (d) For the purpose of creating a report as required by subsection (5)(a) of this section, an operator shall use evidence-based methods for measuring suicidal ideation or self-harm.

CO SB 189 (ADMT in Consequential Decisions) CO

Pending 2027-01-01

C.R.S. § 6-1-1706(3)(e)

Plain Language

Beginning January 2028, the attorney general must annually report to the legislature on enforcement activity under this Part 17, including actions filed, actions completed, cure periods offered, cure periods unmet, and violations where no cure period was provided. This is a government reporting obligation on the AG — not on developers or deployers. It sunsets January 1, 2030.

(e) BEGINNING IN JANUARY 2028, AND IN JANUARY EVERY YEAR THEREAFTER, THE ATTORNEY GENERAL SHALL INCLUDE, AS PART OF THE DEPARTMENT OF LAW'S PRESENTATION DURING ITS "SMART ACT" HEARING REQUIRED BY SECTION 2-7-203, A REPORT CONCERNING ENFORCEMENT ACTIONS BROUGHT AND CURE PERIODS OFFERED BY THE ATTORNEY GENERAL RELATED TO VIOLATIONS OF THIS PART 17, INCLUDING: (I) THE NUMBER OF ACTIONS FILED BY THE ATTORNEY GENERAL AGAINST DEVELOPERS AND DEPLOYERS, RESPECTIVELY; (II) THE NUMBER OF ACTIONS FILED BY THE ATTORNEY GENERAL AGAINST DEVELOPERS AND DEPLOYERS, RESPECTIVELY, THAT WERE COMPLETED; (III) THE NUMBER OF CURE PERIODS OFFERED BY THE ATTORNEY GENERAL TO DEVELOPERS AND DEPLOYERS, RESPECTIVELY; (IV) THE NUMBER OF CURE PERIODS OFFERED BY THE ATTORNEY GENERAL THAT WERE NOT MET BY DEVELOPERS AND DEPLOYERS, RESPECTIVELY; AND (V) THE NUMBER OF VIOLATIONS FILED BY THE ATTORNEY GENERAL AGAINST DEVELOPERS AND DEPLOYERS, RESPECTIVELY, WHERE A CURE PERIOD WAS NOT DEEMED POSSIBLE.

IL SB 3262 (Companion AI Protection Act) IL

Pending 2027-01-01

R-03.1R-03.2

Section 20(b)

Plain Language

Operators must submit an annual report to the Attorney General covering two items: (1) the total number of crisis intervention protocol activations during the preceding calendar year, and (2) a summary of the most recent biennial compliance audit required under Section 20(a). Because the report covers the preceding calendar year, operators should begin tracking crisis protocol activation counts from the law's effective date of January 1, 2027.

(b) On an annual basis, an operator shall submit a report to the Attorney General containing the following metrics for the preceding calendar year: (1) the total number of times the crisis intervention protocol was triggered; and (2) a summary of the results of the most recent compliance audit required by subsection (a).

MD HB 952 (Companion Chatbots) MD

Pending 2026-10-01

R-03.1R-03.2

Commercial Law § 14–1330(H)(1)–(2)

Plain Language

Beginning March 1, 2027, operators must annually report to the Office of Suicide Prevention: descriptions of the self-harm/suicide and sexually explicit content protocols (subsections B and C), the number of crisis referral notifications issued, details about the evidence-based detection methods used, and all complaints filed under the complaint system including review results and follow-up actions. Reports must not contain any personal identifying information about users. Because reports cover the preceding calendar year and the law takes effect October 1, 2026, operators need to begin tracking metrics from that effective date.

(H) (1) ON OR BEFORE MARCH 1 EACH YEAR, BEGINNING IN 2027, AN OPERATOR SHALL REPORT TO THE OFFICE: (I) INFORMATION ON THE PROTOCOLS REQUIRED UNDER SUBSECTIONS (B) AND (C) OF THIS SECTION; (II) THE NUMBER OF TIMES THE OPERATOR HAS ISSUED A NOTIFICATION UNDER SUBSECTION (B)(2) OF THIS SECTION; AND (III) DETAILS ABOUT THE METHODS USED UNDER SUBSECTION (B)(3) OF THIS SECTION; AND (IV) ALL COMPLAINTS FILED UNDER SUBSECTION (G) OF THIS SECTION, INCLUDING THE RESULTS OF THE REVIEW OF EACH COMPLAINT AND ANY FOLLOW–UP ACTIONS TAKEN. (2) THE REPORT REQUIRED UNDER PARAGRAPH (1) OF THIS SUBSECTION MAY NOT CONTAIN ANY PERSONAL IDENTIFYING INFORMATION ABOUT A USER.

MD HB 952 (Companion Chatbots) MD

Pending 2026-10-01

R-03.1

Commercial Law § 14–1330(H)(3)

Plain Language

The Office of Suicide Prevention must compile data from all operator reports for the preceding calendar year and publish the compiled data on its website by July 1 each year, beginning in 2027. This is a government agency obligation to aggregate and publish operator-submitted data — it does not create a compliance obligation for operators beyond what subsection (H)(1) already requires. Operators should be aware that their reported data will be made public in aggregated form.

(3) ON OR BEFORE JULY 1 EACH YEAR, BEGINNING IN 2027, THE OFFICE SHALL: (I) COMPILE DATA FROM THE REPORTS SUBMITTED UNDER PARAGRAPH (1) OF THIS SUBSECTION FOR THE IMMEDIATELY PRECEDING CALENDAR YEAR; AND (II) PUBLISH THE DATA ON THE OFFICE'S WEBSITE.

NC SB 624 (AI Chatbots - Licensing/Safety/Privacy) NC

Pending 2026-01-01

R-03.1

G.S. 114B-4(f)

Plain Language

Licensed health information chatbot operators must implement continuous monitoring systems for safety and risk indicators and submit quarterly performance reports to the Department that include incident reports. This combines a continuous operational monitoring obligation with a periodic reporting obligation on a quarterly cadence.

(f) A licensee shall implement continuous monitoring systems for safety and risk indicators and submit quarterly performance reports including incident reports.

NC SB 963 (AI Chatbots–Licensing, Safety, & Privacy) NC

Pending 2027-01-01

R-03.1

G.S. § 114B-4(f)

Plain Language

Licensees must maintain continuous monitoring systems for safety and risk indicators and submit quarterly performance reports — including incident reports — to the Department. This is a routine periodic reporting obligation distinct from the breach notification requirement in § 114B-4(b)(2). The continuous monitoring component is an ongoing operational obligation, while the quarterly reports are scheduled submissions.

A licensee shall implement continuous monitoring systems for safety and risk indicators and submit quarterly performance reports, including incident reports.

NC SB 988 (Protecting Workers in the Age of AI Act) NC

Pending 2026-07-01

G.S. § 143B-438.14A(c)

Plain Language

Employers that receive North Carolina state economic incentives must report to the Department of Commerce any layoffs that are attributable to automation or artificial intelligence. The bill does not specify the timing, format, frequency, or content of these reports, nor does it establish any penalty for failure to report. The obligation is limited to employers receiving state economic incentives — employers that do not receive such incentives are not covered.

Employers receiving State economic incentives shall report to the Department layoffs attributable to automation or artificial intelligence.

VA HB 635 (AI Chatbots Act) VA

Pending 2027-01-01

R-03.1

§ 59.1-619(C)

Plain Language

Operators must publish a semiannual public report disclosing two categories of quantitative data: (1) how many times the chatbot provided information about suicide, self-harm, suicidal ideation, harming others, or illegal activity, and (2) how many times a mental health crisis redirect was provided to users. Unlike some jurisdictions that require reporting to a regulatory authority, Virginia requires public publication of this data. The provision does not specify the format, publication location, or whether the first report covers a full six-month period or a partial initial period.

C. Operators shall publish a semiannual report available to the public on the number of times (i) the chatbot provided information about suicide, self-harm, suicidal ideation, harming others, or illegal activity and (ii) a mental health redirect has been provided to users.

VT H.804 (Companion Chatbots) VT

Pre-filed 2026-07-01

R-03.1R-03.2

9 V.S.A. § 4193c(a)-(c)

Plain Language

Beginning one year after the effective date (July 1, 2027), operators must submit annual reports to the Office of the Attorney General covering: (1) the number of crisis service provider referral notifications issued in the preceding calendar year, and (2) the protocols in place for detecting and responding to suicidal ideation or self-harm expressions and for preventing the chatbot from producing self-harm content. Reports must not include any user identifiers or personal information. The Attorney General's office will publish the reported data on its website. Because reporting covers the preceding calendar year, operators must begin tracking crisis referral counts from the act's effective date (July 1, 2026), not from the first reporting date.

(a) Beginning one year after the effective date of this act, an operator shall annually report to the Office of the Attorney General all of the following: (1) the number of times in the preceding calendar year the operator has issued a crisis service provider referral notification pursuant to subdivision 4193b(b)(2)(A) of this subchapter; and (2) the protocols put in place by the operator to: (A) detect and respond to expressions of suicidal ideation or self-harm by users; and (B) prohibit the companion chatbot from producing content about suicidal ideation, suicide, or self-harm with the user. (b) The reporting required by this section shall include only the information listed in subsection (a) of this section and shall not include any identifiers or personal information about users. (c) The Office of the Attorney General shall post on its website the data from a report received pursuant to this section.

CA SB 243 (Companion Chatbots) CA

Enacted 2026-01-01

R-03.1R-03.2

Bus. & Prof. Code § 22603(a)-(d)

Plain Language

Beginning July 1, 2027, operators must submit an annual report to the Office of Suicide Prevention covering: (1) how many crisis referral notifications were sent in the prior calendar year, (2) protocols for detecting and responding to suicidal ideation, and (3) protocols for blocking chatbot responses about suicide. Reports must contain no user personal information, and operators must use evidence-based measurement methods. The Office will post report data publicly on its website. Because the report covers the preceding calendar year, operators should begin tracking crisis referral counts no later than January 1, 2027.

(a) Beginning July 1, 2027, an operator shall annually report to the office all of the following: (1) The number of times the operator has issued a crisis service provider referral notification pursuant to Section 22602 in the preceding calendar year. (2) Protocols put in place to detect, remove, and respond to instances of suicidal ideation by users. (3) Protocols put in place to prohibit a companion chatbot response about suicidal ideation or actions with the user. (b) The report required by this section shall include only the information listed in subdivision (a) and shall not include any identifiers or personal information about users. (c) The office shall post data from a report required by this section on its internet website. (d) An operator shall use evidence-based methods for measuring suicidal ideation.