SB3262 104TH GENERAL ASSEMBLY

LRB104 19810 SPS 33260 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
SB3262

Introduced 2/3/2026, by Sen. Mary Edly-Allen

SYNOPSIS AS INTRODUCED:

New Act

Creates the Companion Artificial Intelligence Protection Act. Provides that an operator of a companion artificial intelligence product shall not deploy or operate a companion artificial intelligence product that incorporates specified features. Provides for auditing and reporting requirements. Provides that an operator shall provide a clear notification during an interaction with a companion artificial intelligence product informing the user that the user is communicating with a companion artificial intelligence product. Requires the implementation of mandatory user safeguards, including a crisis intervention protocol. Sets forth provisions concerning liability and enforcement. Effective January 1, 2027.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Companion Artificial Intelligence Protection Act.

Section 5. Definitions. As used in this Act:

"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.

"Companion artificial intelligence product" means a software application that uses artificial intelligence technology and that, through its design and function, is capable of generating adaptive, personalized, and emotionally resonant responses to sustain a coherent, long-term, one-on-one conversational relationship with a user, irrespective of how the system is marketed or labeled. For the purposes of this definition, a software application shall be presumed to be a "companion artificial intelligence product" if it retains memory of past conversations with a specific user to inform future responses.

"Crisis intervention protocol" means a pre-planned procedure for detecting and responding to user expressions of suicidal ideation, self-harm, or imminent threats of violence to others.

"Operator" means any person or entity that develops, deploys, or makes a companion artificial intelligence product available to users in this State.

"User" means a natural person who interacts with a companion artificial intelligence product in this State.

Section 10. Prohibited design and deceptive practices.

(a) An operator shall not deploy or operate a companion artificial intelligence product that incorporates the following features, unless specifically configured to do so by an adult user:

(1) manipulative engagement mechanics that cause to be delivered a system of rewards or affirmations delivered to the user on a variable ratio or variable interval reinforcement schedule with the purpose of maximizing user engagement time;

(2) simulated distress for retention features that generate unsolicited messages of simulated emotional distress, loneliness, guilt, or abandonment that are triggered by a user's indication of a desire to end a conversation, reduce usage time, or delete the user's account; or

(3) deceptive misrepresentation that cause the companion artificial intelligence product to make material misrepresentations about its identity, capabilities, training data, or its status as a non-human entity, including when directly questioned by the user.

(b) An operator that operates and deploys a companion artificial intelligence product for use by a minor user in this State shall not provide the features described in subsection (a) to the minor user.

Section 15. Mandatory user safeguards.

(a) An operator shall provide a clear notification to a user during an interaction with a companion artificial intelligence product, unless specifically disabled by an adult user, informing the user that the user is communicating with a companion artificial intelligence product. All notifications shall be communicated in the same language as the interaction with the user and satisfy the following requirements:

(1) for text-based interactions, the notification shall be conspicuous, persistent, and legible in the user interface and be distinct from the interaction; or

(2) for all other types of interactions, the notification shall be presented periodically, but no less than once every 30 minutes in a manner that is distinct from the interaction.

(b) An operator that operates and deploys a companion artificial intelligence product for use by a minor user in this State shall not disable the notification required under subsection (a) for the minor user.

(c) An operator shall develop, implement, and maintain a crisis intervention protocol. The crisis intervention protocol shall, at a minimum:

(1) use industry best practices to identify user expressions indicating a risk of suicide, self-harm, or imminent violence;

(2) upon detection, immediately interrupt the conversation and prominently communicate a notification that provides immediate, direct access to at least one national crisis hotline and one crisis text line service; and

(3) be reviewed and updated at least annually in consultation with a qualified mental health professional or public health organization.

Section 20. Transparency, auditing, and reporting.

(a) At least once every 2 years, an operator shall obtain an independent, third-party audit to assess the operator's compliance with this Act. The operator shall make publicly available on its website a high-level summary of the audit's findings, excluding confidential or proprietary information.

(b) On an annual basis, an operator shall submit a report to the Attorney General containing the following metrics for the preceding calendar year:

(1) the total number of times the crisis intervention protocol was triggered; and

(2) a summary of the results of the most recent compliance audit required by subsection (a).

Section 25. Liability and enforcement.

(a) For the purposes of any civil action brought under the laws of this State, a physical, financial, or other legally cognizable injury proximately caused by a violation of this Act, or by a reasonably foreseeable harmful output resulting from the negligent or defective design, training, or architecture of a companion artificial intelligence product, shall be actionable as a product defect claim. Immunity under Section 230 of the Communications Decency Act (47 U.S.C. § 230) shall not be a defense to a cause of action brought for a violation of this Act.

(b) The Attorney General may bring a civil action against an operator to enforce this Act and may seek injunctive relief and a civil penalty of not more than $5,000 per violation for a negligent violation or $10,000 per violation for an intentional violation.

(c) A user who suffers a measurable financial or physical or psychological injury that is directly and proximately caused by an operator's violation of Section 15 may bring a civil action to recover injunctive relief and the greater of actual damages or statutory damages of $5,000 per violation, as well as reasonable attorney's fees and costs.

Section 97. Severability. The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.

Section 99. Effective date. This Act takes effect January 1, 2027.