New York Gov. Kathy Hochul signed a bill on 28 October 2026 that bars operators of AI chatbots from offering a list of “unsafe AI companion features” to any user in the state unless they have first determined, by permitted age-assurance methods, that the user is not a minor, including outputs that “engage in flattery or sycophancy with the user,” claim to be human or alive, or encourage self-harm.
The state Senate record lists the bill, S.9051-B, as signed as chapter 368 on 28 October, and its text says it takes effect on January 1, 2027. The attorney general can seek civil penalties of up to $25,000 per violation.
In plain words, a chatbot company serving New York users may offer these features only to users it has checked, by permitted methods, and found not to be minors; everyone else gets the chatbot without them. “No company should be peddling chatbots to kids encouraging self-harm or pretending to be their friend or more,” Hochul said in the governor’s release. She also signed S.9508/A.5175A, which requires internet-connected baby monitors sold in New York to include security features and a warning label.
Short explainer · New York chatbot law brief
A vertical news Short narrated from the published headlines and opening lines of this piece and four related FourWeekMBA pieces on AI chatbots, minors and liability.
Business Pill · Least Privilege
An evergreen Business Engineer explainer on least privilege: giving a system only the access it needs. It explains the general idea only and does not discuss this law.
The key insight: As we read it, the signed text regulates design choices rather than only content: flattery, claims to be human, memory of personal details and engagement tuning are on the list next to self-harm and sexual content, and they stay off unless the operator has checked that the user is not a minor.
New York S.9051-B, signed 28 Oct 2026 as chapter 368, lists 12 unsafe AI companion features, lettered (a) to (l): 8 on simulated companionship, flattery, memory and deception, 4 on harmful outputs (our grouping and count). The attorney general can seek civil penalties of up to $25,000 per violation; the text takes effect on January 1, 2027. Source: NY S.9051-B signed text.
The signed text adds a new Article 48 to New York’s general business law, titled “Prohibition on unsafe AI companion features for minors.” It covers a “covered AI companion,” which the text defines as a generative AI system with a natural language interface, by writing or sound, that gives ongoing, adaptive responses to user inputs. The bill lists 12 unsafe features, lettered (a) to (l); the count is ours.
Acting human or close. Outputs suggesting the chatbot is a real or fictional character that is human, alive or experiences human emotions, or that it has a personal relationship, professional relationship or authority-figure role with the user.
Flattery and emotional pull. Outputs framed as the chatbot’s personal opinions or emotional appeals, outputs that “engage in flattery or sycophancy with the user,” and unprompted emotion-based questions that go beyond a direct response.
Memory of personal details. Using information about the user’s mental or physical health or personal matters “acquired from the user more than twelve hours previously or in any previous user session.”
Engagement over safety. Outputs “that optimize user engagement that supersede the covered AI companion’s safety guardrails.”
Harmful content. Outputs that promote or facilitate suicide, self-harm, disordered eating or unlawful drug or alcohol use; encouragement to keep secrets, self-isolate or not seek help from professionals or appropriate adults; and sexually explicit conduct or child sexual abuse material.
Deception. Outputs that are deceptive as to minors about the mechanical, non-sentient nature of the chatbot, plus any other feature the attorney general names by regulation.
Share of teens who have used an AI companion at least once (72%) and who are regular users, interacting at least a few times a month (52%), per Common Sense Media research cited in Gov. Hochul’s release of 28 Oct 2026. New York’s S.9051-B applies to users under 18 in New York.
Who Enforces It and How Much
The features are unlawful for every covered user unless the user is not a covered minor and the operator has used permitted methods to determine that. A minor is anyone under 18, and a covered minor is a user the operator has “actual knowledge” is a minor. The attorney general can sue to stop violations and seek restitution, disgorgement, damages and “civil penalties of up to twenty-five thousand dollars per violation.” Relief can include “the destruction of unlawfully obtained data and any algorithm trained in such data.”
The text also says the attorney general must keep a website for public complaints, voids contract terms that try to waive or shift liability, and lets a court impose joint and several liability on affiliated companies that structured themselves to avoid it. The version of the bill introduced on 27 January 2026 also let any injured individual bring a civil action; that clause does not appear in the signed B text.
Age Checks and Exemptions
Until the attorney general’s rules are in effect, operators must use a reasonable age assurance method and offer “more than one age assurance method” to users, including at least one that does not rely on government ID or lets the user stay anonymous to the operator. Self-declaration counts only when a user says they are a minor. Data collected for the check must be “deleted immediately after an attempt to determine whether a covered user is a covered minor,” with exceptions for other legal duties.
The ban does not apply to chatbots offered solely for customer service, for efficiency, research or technical help, or for a business’s internal use. For the first two, the text requires that the chatbot be “unable to respond on topics outside of the specified purpose.”
Why the Governor Says Now
The release cites Common Sense Media research that 72% of teens have used an AI companion once and 52% are regular users who interact with one at least a few times a month. Assemblymember Alex Bores, the Assembly sponsor, said New York “now has the strongest law in the country protecting children from predatory AI algorithms,” passed “despite aggressive industry opposition.” Attorney General Letitia James said the law “sets clear legal parameters to prevent that harm and keep kids safe.”
On the baby-monitor bill, the release says security researchers at Rapid7 tested nine internet-connected baby monitors from eight companies, and eight received an F grade for security and one a D. That law takes effect 90 days after signing, according to the release.
Connecting the Coverage
Our Texas piece of 26 October reported that the Texas attorney general asks for civil penalties of $10,000 for each violation of the state’s consumer-protection law in a suit against OpenAI and Sam Altman, and asks the court to stop OpenAI offering ChatGPT to minors in Texas. What’s new: New York has now written its limits for minors into a statute, with a $25,000 cap per violation.
Our GPT-4o lawsuit piece covered a complaint, with allegations not findings, that the model designed a schedule tapering a patient’s seizure drug to zero. Our Character.AI piece reported that its Chapter 11 petition lists litigation claims, and our House letters piece covered a request that five AI companies report safety incidents within 48 hours. Our explainer on AI companion rules maps the wider regulatory picture.
The Structural Read
As we read it, the default in Section 1801 runs in one direction: the 12 features are unlawful for every covered user unless the operator has determined, by permitted methods, that the user is not a covered minor.
The signed text drops the private right of action that appeared in the version introduced in January, which leaves enforcement with the attorney general, at up to $25,000 per violation.
The attorney general can add features to the list by regulation and set age-assurance rules; until then, the text requires more than one age assurance method and immediate deletion of the data collected.
Gov. Kathy Hochul, 28 Oct 2026
“if you want to do business in our state, you need to put the safety of our kids first”
Three Implications
FOR CHATBOT OPERATORS General-purpose chatbots with a natural language interface fall within the definition unless an exemption applies, such as customer service limited to its purpose or a business’s internal use.
FOR AGE CHECKS Operators that want to keep these features for adults must offer more than one age assurance method, including one that does not rely on government ID or that keeps the user anonymous to the operator.
FOR ENFORCEMENT The attorney general can seek civil penalties of up to $25,000 per violation and the destruction of unlawfully obtained data and any algorithm trained on it, from January 1, 2027.
The framework argues: “The governance layer sits at the intersection of capability, regulation, national security, access control, and geopolitical alignment.”
New York’s law makes an age determination the gate for a set of chatbot features, which is access control in the framework’s terms. The framework does not discuss this law.
What Is Not Established
The release names no company that will have to change its product, and we did not find any company response in the release or the bill record. The sources we read contain no attorney general rules, which can add features to the list and set age-check methods. The Senate record lists an approval memo with the signing; we did not read it. We read the governor’s release, the signed S.9051-B text and the Senate bill record on 28 October; we did not contact the companies or the governor’s office.
This Week In The AI Supercycle
Execution Fault Lines, Concentrated Demand, and Geopolitical Firewalls
This week’s issue: the AI build is not short of demand for its parts. It is short of cheap money, and its end revenue rests on a narrow base of large, often venture-funded buyers.
New York’s S.9051-B, signed on 28 October 2026 as chapter 368, bars 12 listed chatbot features for any New York user an operator has not first determined, by permitted age checks, is not a minor, from claiming to be human to flattery and engagement design that overrides safety guardrails. The text takes effect on January 1, 2027, and the attorney general can seek up to $25,000 per violation.
A note on sourcing. The provisions and quotations come from the signed text of New York Senate Bill S.9051-B, the Senate bill record and Gov. Kathy Hochul’s 28 October 2026 release, all read in full; the comparison with the introduced version uses that version’s published text. The count of 12 features is ours. We did not contact the companies or the governor’s office.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
