By the Shadow AI Policy team
The biggest AI policy change this week is New York's new limit on AI companion features for minors: Governor Hochul signed S.9051-B on October 28, 2026, and it takes effect January 1, 2027, so it's still ahead. It applies to operators of covered AI companions used in New York, and employers mostly need to check their public-facing chatbots rather than their internal tools.
This is a deliberately short briefing, because it's the one development from the past 10 days we could confirm in a primary source. We cover what the law bans, whether your chatbot is exempt, and the verified deadlines that now sit on your calendar.
List every AI chatbot your company exposes to people outside the company this week, and write down who can reach it and what it's allowed to talk about. Any bot that can wander off a narrow customer service script goes to Legal for a New York review before January 1, 2027.
New York enacted S.9051-B on October 28, 2026, as chapter 368, restricting "unsafe AI companion features" for minors. The governor's announcement, published October 28, 2026, says the law bars companies using AI chatbot features from offering those features to minors, and to any user unless the company has first confirmed that the user isn't a minor.
The bill text on the New York Senate site reaches any person or business entity operating a covered AI companion, and it protects users in New York. A minor is anyone under 18. That means an out-of-state company isn't safe just because it's headquartered elsewhere: the test in the text turns on where the user is.
The law takes effect January 1, 2027. It isn't in force today.
The bill's definition runs to lettered categories (a) through (l), while the governor's announcement groups them into six plain-language buckets. Use the bill text as your checklist, because that's the law; the announcement is a summary.
The announcement's six buckets are:
Look closely at one item in the bill's list that a business bot can trip by accident: outputs that engage in flattery or sycophancy with the user. A warm brand persona with a human name and a chatty tone is exactly the kind of design choice to re-read against this list.
Enforcement belongs to the attorney general, with civil penalties of up to $25,000 per violation. The announcement adds that the attorney general can also pursue damages, restitution, and destruction of unlawfully collected data or AI models trained on it. The version we read contains no private right of action.
Your internal tools very likely are, and your public bot only might be. The bill exempts a companion made available solely for listed purposes, including customer service, efficiency improvements or research or technical assistance, and, for a system used by a business entity, internal purposes or employee productivity.
The customer service exemption has a condition that matters: the companion has to be unable to respond on topics outside its specified purpose. A support bot that will happily chat about anything isn't obviously inside that exemption, and that's the gap to close.
| Your deployment | Our first-pass read of the bill text | What to do |
|---|---|---|
| Staff-only assistant used solely for work | Fits the internal purposes or employee productivity exemption | Document that purpose in your AI policy and keep access limited to staff |
| Public support bot locked to your product topics | Fits the customer service exemption if it can't respond outside that purpose | Test it with off-topic prompts and keep the results |
| Public bot with an open-ended chat mode or a named persona | Don't assume an exemption | Send it to counsel now, and narrow its scope or review its age checks |
This table is a starting filter, not legal advice, so have counsel confirm where each bot lands.
Plan as though any unconfirmed user could be a minor. The bill defines a covered minor by the operator's actual knowledge that the user is a minor, while the governor's announcement describes the restrictions as covering any user the company hasn't confirmed is an adult. Ask counsel to reconcile those two readings against the full text before you rely on the narrower one.
The bill also has age assurance provisions. Self-declaration is only a reasonable method when a user declares they're a minor, and operators must offer more than one age assurance method. So a single "I'm over 18" checkbox isn't a plan you should build around.
New York's date lands alongside several others, so review them together rather than running a separate project for each. Two recent dates have already passed: Italy's Legislative Decree 179/2026, covering a human final decision, an explanation right and AI risk duties for employers, has applied since October 23, 2026, and the Connecticut CART Act provisions on AEDT use not being a defense to a discrimination claim, and on WARN notices disclosing AI as a layoff cause, have applied since October 1, 2026.
| Effective date | Obligation | Who should own it |
|---|---|---|
| December 2, 2026 | EU AI Act: new prohibited practices, and the marking deadline for pre-existing generative systems | Legal |
| January 1, 2027 | New York S.9051-B: unsafe AI companion features for minors | Legal and product |
| January 1, 2027 | Colorado Chatbot Safety Act: conversational AI service operator requirements | Legal and product |
| January 1, 2027 | Colorado Automated Decision-Making Technology Act | HR and Legal |
| January 1, 2027 | California CCPA regulations on automated decisionmaking technology | HR and Legal |
| January 1, 2027 | Cal/WARN SB 951: layoff notices must disclose AI displacement | HR |
| January 1, 2027 | California AB 1883: ban on AI emotion recognition and neural-data collection at work | HR |
The "who should own it" column is our suggestion, not a legal requirement. If your policy doesn't yet name an owner for AI tools, start there: you can generate a tailored AI policy kit and adjust it for the deadlines that apply to you.
About Shadow AI Policy: We build AI acceptable use policy tools for HR and operations teams at 50–500 person companies. We publish guides on shadow AI, acceptable use policies, and AI governance, updated as regulations and AI tools change.
If you only use AI assistants internally for staff productivity, New York's law probably won't change your day-to-day operations, though you should record that purpose in your policy. If you run a public chatbot that people in New York can reach, you've got work to do before January 1, 2027. Check whether it stays strictly on a customer service topic, and whether it uses a persona, flattery or memory of personal details. Have counsel confirm how the exemptions apply to each bot.
Yes, if your policy doesn't list your public-facing bots or name an owner for them. Add an inventory line for each bot, its permitted purpose and who approves changes to it. Don't rewrite the whole policy for this one law, because several other deadlines arrive on the same date and it's more efficient to cover them in one review.
Not under the Amendment B text we read, which gives enforcement to the attorney general. Civil penalties can reach $25,000 per violation, and the governor's announcement says the attorney general can also pursue damages, restitution and destruction of unlawfully collected data or AI models trained on it. The announcement also says the attorney general must maintain a public website for complaints, so a consumer can still bring a problem to the state's attention.
Free tool: See the AI regulation deadline tracker → Each compliance date marked as verified, or not, against the enacted text.
Tailored to your industry and the AI tools your team uses. Free preview, then $149/mo to keep it current as the rules and vendor terms change — or $79 for a one-time snapshot.
Generate my policy kit →Writing policies for several clients? MSPs, IT consultancies and fractional CISOs keep a roster of client kits that refresh monthly, under their own branding. See partner plans →