New York's youth chatbot law: what teams shipping AI assistants need to build, and by when

What happened

New York's governor signed bill S.9051B/A.10379C on 28 October 2026. It prohibits companies with AI chatbot features from offering features deemed unsafe for minors, including chatbots that pretend to be human, build emotional dependency, encourage self-harm or engage in sexually explicit conversation¹². Press coverage reports that, like earlier state rules, it expects several age verification options, including at least one that does not need government ID⁴.

Two points need care. First, scope: Tech Times reads the definition as reaching general-purpose assistants, not only companion apps³. That is one interpretation, but a serious one. Second, timing: reports give different effective dates, from early 2027 to mid-2027. I would plan for the earliest.

The Future of Privacy Forum notes that New York acted about a month after California enacted its own chatbot law, SB 1119, and that the two states are taking different approaches⁵. For anyone with US users, that means designing for more than one rulebook.

Why this is an architecture problem

Most of these duties cannot be met with a line in the terms of service. They need the system to know something about the user, change the model's behaviour based on it, and keep evidence that it did. That cuts across identity, the model layer, the product and observability.

What to build

Treat "unknown age" as a state, not a default adult. Press coverage suggests the rules apply where age has not been established, not only to known minors⁴. The safe design has three states: verified adult, likely minor, and unknown. Unknown gets the protective feature set until the user chooses to verify.

Make features switchable by policy. Persona and memory features, romantic or companion modes, and long-term "relationship" memory are exactly what the law targets. Put them behind a policy service keyed on age state and jurisdiction, rather than scattered flags, so legal changes are configuration, not releases.

Check inputs and outputs, not just prompts. System prompts alone are not a control. Add classifiers or rules on both sides for self-harm, sexual content and manipulative engagement patterns, with routing to crisis resources. Test them with an evaluation set built for this, including adversarial attempts, and run it on every model or prompt change.

Always disclose that it is AI. A chatbot pretending to be human is on the prohibited list¹. Make disclosure part of the persona rules, and test that role-play cannot override it.

Keep evidence, carefully. You will need to show which policy applied and what the system did. Capturing full conversation content is the tempting way, and OpenTelemetry's generative AI instrumentation can do it, but it is opt-in for good reason⁶. For conversations that may involve minors, log policy decisions and check outcomes by default, and capture content only for flagged sessions under strict access and retention rules.

Who should act

• Consumer AI products and apps with chat: in scope almost certainly, wherever you are based, if New York users can reach you.
• Enterprise copilots: probably lower risk if access is limited to verified employees, but check any public or customer-facing deployment.
• Education, gaming and health apps: high priority, because minors are a large part of the audience.
• Teams outside the US: the same building blocks will help with the UK's and EU's child-safety expectations; see UK and Europe.

A plan for the next quarter

CTO take

State-level AI rules in the US are no longer abstract. Between California and New York, any public chatbot now needs age-aware behaviour, enforced guardrails and evidence. The cost of building that is far lower now than after an enforcement letter. Build it once, as a policy layer that sits in front of every model you use, so the next state law is a configuration change. For the wider US picture, see the Colorado AI Act reset and the US page; for guardrail engineering, prompt-injection defence and structured outputs.

How I can help

I design AI assistant platforms with policy layers, evaluation and evidence built in, and review them before launch or audit. I am based in India, the United States and the UAE, working globally. See AI architecture or analyse your challenge and bring the result to a call.