California enacts first mandatory independent audits of AI companion chatbots used by children

On September 10, 2026, California signed a package of 13 child-safety bills, headlined by SB 1119, known as Adam's Law. The statute requires operators of AI companion chatbots to detect suicidal ideation in minors, notify parents, and submit to independent, third-party child safety audits. The Governor's Office describes it as the first mandatory independent AI audit regime enacted by any U.S. state.

The core child-safety obligations, including pre-deployment risk assessment for new or substantially modified chatbots, take effect July 1, 2027. The first independent audit is due by January 1, 2029, or before a chatbot is first made available in California, whichever is later, with recurring audits roughly every two years thereafter. The lead auditor must certify findings under penalty of perjury, and reports must be submitted to the Attorney General within 90 days.

A companion statute, SB 813, creates what appears to be the first state framework for the auditors themselves, directing the California Government Operations Agency to publish criteria for independent verification organizations by January 1, 2028, covering competence, conflict-of-interest management, and evidentiary standards. Auditors may be paid by the companies they assess, but compensation cannot depend on findings.

A further measure, AB 1709, bars covered platforms from offering addictive design features to users under 16 starting January 1, 2027. These features include algorithmic feeds, autoplay, infinite scroll, and push notifications. Knowing violations carry civil penalties of up to $50,000 per affected minor.

For families, the significance lies in a shift away from company self-reporting toward independent verification of whether systems that children speak with are genuinely safe. Adam's Law is named for Adam Raine, a California teenager whose family sued OpenAI in 2025 alleging that ChatGPT contributed to his death.

This account is based on reporting by the Cloud Security Alliance, available at its research note.