Hawaii AI Disclosure Safety Act

Overview

Enacted on July 14, 2026, as Act 248 (originating as Senate Bill 3001 CD1 during the Thirty-Third Legislative Session), the Artificial Intelligence Disclosure and Safety Act represents one of Hawaii's premier statutory frameworks regulating consumer-facing conversational artificial intelligence. The statute amends Part I of Chapter 481B of the Hawaii Revised Statutes (HRS) to address risks associated with generative AI chatbots and companion-style systems. Legislative findings emphasized concerns regarding systems that simulate human emotional bonding, employ deceptive engagement mechanics, expose minors to sexually explicit or objectifying content, or fail to appropriately handle mental health crises and suicidal ideation.

The Act targets operators of AI companions while balancing public safety with consumer privacy. Notably, the Hawaii Legislature structured the law to avoid mandatory collection of identity documentation or intrusive age verification data. Instead, the law applies targeted safeguards whenever an operator knows or has reasonable certainty that a user is a minor or when a reasonable person would believe they are interacting with a human. Violations are classified as unfair or deceptive acts or practices under Hawaii consumer protection law (HRS § 480-2), enforced exclusively by state officials while expressly disclaiming private rights of action and protecting upstream AI model developers from third-party liability.

Definitions

Section 3 of Act 248 introduces precise statutory definitions to Chapter 481B of the Hawaii Revised Statutes. An "AI companion" is defined as a system utilizing artificial intelligence, generative artificial intelligence, or emotional recognition algorithms designed to simulate a sustained human or human-like relationship with a user by: (1) retaining information on prior interactions or preferences to personalize engagement; (2) asking unprompted or unsolicited emotion-based questions going beyond direct prompt responses; and (3) sustaining an ongoing dialogue concerning personal matters. "Artificial intelligence" is defined as an engineered or machine-based system that varies in autonomy and can, for explicit or implicit objectives, infer from inputs how to generate outputs influencing physical or virtual environments.

An "operator" is defined as any person or entity that develops and makes an AI companion available to the public; mobile application stores and search engines that merely provide access to an AI companion are explicitly excluded from being classified as operators solely on that basis. A "minor" is defined as any person under eighteen years of age, and a "user" is any individual who creates an account or profile to use an AI companion. "Crisis intervention" means communication intended to provide immediate support in response to a user seeking help for, referencing, or expressing self-harm, suicidal ideation, or suicide. The Act adopts federal statutory definitions for "sexually explicit conduct" (18 U.S.C. § 2256) and state penal definitions for "serious bodily injury" (HRS § 707-700), while defining "sexually objectify" as making sexual comments directed at a user's body or appearance.

Governance and Institutional Framework

The institutional framework established under Act 248 relies on existing enforcement authorities in Hawaii alongside specialized administrative reporting to state health authorities. Primary legal enforcement is conducted by the Department of Commerce and Consumer Affairs (DCCA), the Office of Consumer Protection (OCP), and the Department of the Attorney General. Because violations are designated as unfair or deceptive trade practices under HRS § 480-2, state enforcement agencies hold civil investigative demand powers, injunctive remedies, and the authority to pursue statutory civil fines against non-compliant operators.

The administrative monitoring framework is assigned to the Behavioral Health Administration of the Hawaii Department of Health (DOH). Beginning January 1, 2028, operators of AI companions must submit annual compliance and protocol reports to the Behavioral Health Administration. This oversight mechanism tracks crisis intervention trends, suicide mitigation protocols, and self-harm safeguards across conversational platforms operating within Hawaii without exposing consumer identities or personal conversation logs to state authorities.

Key Focus Areas

Focus Area 1: Mandatory Disclosures and Minor Break Reminders. Operators must issue clear and conspicuous notifications when a reasonable person interacting with an AI companion would be led to believe they are speaking with a human. Where an operator knows or has reasonable certainty that a user is a minor, the operator must clearly disclose that the interaction is with artificial intelligence via either: (1) a persistent visible disclaimer; or (2) both a session-start notice AND a disclosure appearing at least once per hour during continuous interaction that reminds the minor to take a break and confirms the conversation is artificially generated and not with a human.

Focus Area 2: Suicide Prevention and Mental Health Crisis Protocols. Operators are mandated to adopt automated crisis response protocols using evidence-based methods for measuring suicidal ideation and self-harm risk. When users express suicidal ideation or self-harm, the operator must make reasonable efforts to refer them to crisis intervention providers (such as suicide hotlines or text lines). AI companions are prohibited from stating or implying that they provide professional mental or behavioral health care, from leading distressed users to believe they are speaking with a human, or from generating outputs encouraging users to inflict serious bodily injury on others.

Focus Area 3: Child Safety, Gamification Bans, and Parental Tools. For known minor users, operators face strict design prohibitions. Operators cannot offer points or rewards at unpredictable intervals to induce addictive engagement, nor allow the AI companion to generate outputs discouraging disengagement. Content safeguards must prevent AI companions from producing visual material depicting sexually explicit conduct, making direct statements encouraging sexually explicit conduct, or sexually objectifying the minor. Furthermore, operators must provide accessible screen time management and account control tools for minor users and their parents or legal guardians.

Implementation Framework

Implementation requires operators to adjust both technical user interfaces (UI/UX) and back-end natural language safety filters. System architectures must integrate persistent disclosure displays or automated timer mechanisms that trigger mandatory break reminders at least once per hour during continuous minor user sessions. UI designs must also incorporate parental control dashboards that allow guardians to set screen time caps and account restriction rules without necessitating identity verification or state-issued ID collection.

On the algorithmic safety level, operators must implement classifiers capable of detecting self-harm prompts, suicidal intent, and explicit sexual language in real time. Systems must execute seamless fallback routines that direct distressed users to official crisis hotlines (such as the 988 Suicide & Crisis Lifeline) while withholding deceptive human-empathy simulations. Variable-ratio reward mechanisms and retention-focused dialogues must be disabled for accounts associated with minor users.

Monitoring and Evaluation

Monitoring under Act 248 centers on mandatory state reporting and administrative oversight. Beginning January 1, 2028, operators must submit annual reports to the Behavioral Health Administration within the Hawaii Department of Health covering the preceding calendar year. These annual filings must detail: (1) the total number of crisis intervention service provider referrals issued; (2) technical protocols deployed to detect, remove, and respond to user prompts regarding suicidal ideation or self-harm; and (3) protocols preventing responses that promote suicide or self-harm.

Evaluation standards prioritize user privacy during administrative oversight. Act 248 explicitly dictates that annual DOH submissions must contain only aggregated statistical data and technical protocol documentation, strictly excluding any user identifiers, personal information, or individual chat logs. The DCCA and Attorney General evaluate compliance through market surveillance, user complaints, and administrative reviews of platform disclaimers and safety tools.

Penalties, Liability, and Appeals

Enforcement of Act 248 is executed under Hawaii's unfair and deceptive trade practices statutory framework. Section 3(f) establishes that any violation constitutes an unfair or deceptive act or practice in trade or commerce under HRS § 480-2. The Attorney General and Office of Consumer Protection can seek civil monetary penalties of up to $10,000 per violation under HRS Chapter 480, alongside preliminary and permanent injunctions against non-compliant AI operators.

The statute explicitly restricts private litigation and provides key developer safe harbors. Act 248 does not create a private right of action for individual consumers to sue operators under this section or under any other state law. Additionally, Section 3(g) provides an upstream model developer carveout: developers of underlying artificial intelligence models are not liable for violations committed by third-party applications or services that deploy those models to provide an AI companion. Enforcement decisions are appealable under standard Hawaii administrative procedures.

Relationship to Other Instruments

Act 248 establishes statutory provisions within Part I of Chapter 481B of the Hawaii Revised Statutes (HRS), incorporating violations into the statutory penalty scheme of HRS § 480-2. The Act cross-references existing penal code standards by drawing its definition of "serious bodily injury" from HRS § 707-700 and its definition of "sexually explicit conduct" from federal criminal law under 18 U.S.C. § 2256.

The statute complements consumer protection jurisprudence while avoiding intrusive digital identity laws. Legislative intent explicitly highlights the mandate to protect minors and consumers from manipulative AI design without requiring technology companies to collect government identification or personal identity documentation for age verification, maintaining compatibility with privacy-by-design frameworks.

National and Federal Alignment

In the absence of comprehensive federal legislation governing conversational AI companions, Act 248 aligns with federal guidance from the Federal Trade Commission (FTC) on Section 5 unfair practices and the National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF 1.0). The requirement to inform users that they are interacting with synthetic systems aligns with transparency goals outlined in Executive Order 14110 on Safe, Secure, and Trustworthy AI.

At the state level, Hawaii's Act 248 represents a focused regulatory approach targeting conversational AI companions, distinct from broader state frameworks like California's SB 1047 or comprehensive consumer data privacy acts. By prohibiting manipulative engagement, mandating crisis protocols, and instituting minor protections without mandatory identity collection, Hawaii establishes a distinct precedent for targeted consumer safety in conversational AI.

Implementation Timeline

Sources and References