Idaho Governor Brad Little signed Senate Bill 1297, the Conversational AI Safety Act, into law on March 31, 2026. It is one of the most comprehensive state laws specifically targeting how businesses deploy public-facing AI chatbots, and it sets requirements that go well beyond what most companies currently have in place.
This is not niche legislation. If your business uses any publicly accessible AI system that simulates human conversation, text, visual, or audio, this law may apply to you.
What the Law Requires
The Conversational AI Safety Act applies to operators of publicly accessible conversational AI services. That covers customer service chatbots, AI-powered website assistants, voice agents, and similar tools. There are exemptions for internal developer tools, systems used only within a business (not facing the public), and basic voice assistants that just set timers and play music, but commercial AI deployments meant to interact with customers or the public are in scope.
For all covered deployments:
Operators must disclose that users are interacting with an AI when there is a reasonable chance of the user believing they are talking to a human. The law is specifically aimed at AI systems that could be mistaken for a person, not ones that are obviously automated.
Operators must also implement crisis protocols. If a user expresses suicidal ideation or self-harm, the system must direct them to crisis services rather than continuing the conversation as normal. This is now a legal requirement in Idaho, not just a best practice.
And operators cannot claim, directly or by implication, that the AI provides licensed mental or behavioral health care. A general wellness chatbot that says “I’m here to support you” is in a very different legal position than one that says “as your therapist, I recommend…”
When a minor is using the system:
The law adds a second tier of requirements when an operator knows, or has reasonable certainty, that a minor is using their service.
In those situations, the AI must carry a persistent, clearly visible disclosure that the user is interacting with an AI, not a person. That disclosure must appear at the start of every session and at minimum every three hours during continuous use.
Gamification features designed specifically to increase engagement must be restricted or removed for minor users. The law targets the mechanics that make AI companions compelling, not just addictive, and that drive continued interaction through reward loops.
Sexually explicit content generation must be blocked. Operators must implement age assurance measures if explicit content is part of the platform.
Parental supervision tools are required. Screen time controls, privacy settings, notification management, and safety features must be available to parents or guardians.
Penalties:
$1,000 per violation, capped at $500,000 per operator, or actual damages, whichever is greater. Violations can also be enjoined by a court.
Why This Matters Beyond Idaho
Idaho is a state with a population of around two million people. The law is not going to reshape the AI industry on its own. But it is part of something bigger.
As we covered in March, Congress has been unable to pass federal AI legislation while states sprint ahead with their own rules. Tennessee passed its own law barring AI from posing as mental health professionals, signed the same week. Georgia passed a similar chatbot disclosure bill and sent it to the governor’s desk before the legislative session ended on April 3. The pattern is clear: states are not waiting.
For businesses that operate across multiple states, this matters. An AI customer service agent that complies with current federal guidance may not comply with Idaho, Tennessee, Georgia, or a dozen other states that are writing similar rules. The patchwork is getting denser.
The Trump administration’s attempt to preempt state AI laws with a 10-year moratorium, included in the House reconciliation bill, faces significant opposition even within the Republican Party. Until that fight resolves, businesses need to think about state compliance individually.
What Businesses Running AI Systems Should Check
If you operate any public-facing AI chatbot or voice agent, the practical review is relatively straightforward.
Disclosure: Does your system make clear it is an AI when users could be confused? A prompt buried in terms of service is unlikely to satisfy the spirit of these laws. The Idaho requirement is that the disclosure happens in context, when the potential for confusion exists.
Crisis protocols: Does your AI have a defined response to mental health crisis signals? This does not require a licensed clinician. It requires the system to recognize distress signals and respond by directing users to appropriate human resources, not by trying to handle it.
Minor-specific controls: If your platform is accessible to minors, do you have the technical infrastructure to apply different rules to those users? This is the requirement most likely to require actual development work, because it assumes operators can detect minor users and segment their experience.
Marketing claims: Review how your AI is described and how it presents itself. Language like “your AI coach” or “your digital advisor” occupies a grey zone that these laws are designed to address.
What This Means for Business
The regulatory direction is clear: AI-generated conversations with the public are going to be treated more like regulated communications, not like software features. The standards are rising.
This has practical implications for businesses using AI in customer-facing roles. The ones that get ahead of it, with proper disclosure, crisis protocols, and minor-specific controls, will be in a better position as compliance requirements expand. The ones that view their AI chat widget as a product feature with no legal dimension are building technical debt.
Businesses deploying AI agents for customer interaction through services like Omni Voice benefit from working with providers who already build these compliance considerations into the deployment. Getting the disclosure and crisis protocol architecture right from the start is significantly cheaper than retrofitting it.
If you are evaluating how AI regulation applies to your specific business, the Omni Advisory service can help you understand what is required now and what is likely to be required in the next 12 months as more states follow Idaho’s lead.
Idaho SB 1297 was passed by the Senate 21-12 on March 19, 2026, the House 54-12, and signed by Governor Brad Little on March 31, 2026. The law tracks at LegiScan and the Idaho Freedom Foundation published detailed analysis of its provisions.