Who’s talking — and to whom? Georgia’s SB 540 and the rapid convergence of state “chatbot safety” laws

Why SB 540 Matters

SB 540 is not an outlier; it is part of a clear national pattern. States are converging on a shared framework for regulating conversational AI, often through online safety and consumer protection statutes rather than comprehensive AI laws. Georgia’s version is notable for how many of these emerging elements it consolidates into a single law and for several features that distinguish it from peer laws already enacted in California, New York, Oregon, Washington, Utah, and Idaho.

SB 540 at a Glance

SB 540 applies to operators of “conversational AI services” and requires:

• clear disclosure that users are interacting with AI, not a human
• heightened protections for minors, including limits on emotional dependency, synthetic content containing sexually explicit conduct, and impersonation of real people
• user privacy and control tools, including engagement limitation mechanisms
• crisis-response protocols for severe harm, related emotional crises, and eating-disorder-related self-harm
• exclusive enforcement by the Georgia Attorney General (no express private right of action)

How Georgia’s Law Differs from Peer State Laws

While SB 540 shares a common architecture with laws in California, New York, Oregon, Washington, Utah, and Idaho, several features set it apart.

Behavioral focus, not just disclosure. Most peer laws center on disclosure, telling users they are speaking with AI. Georgia goes further by targeting how the AI behaves: limiting dependency-inducing engagement mechanics, restricting emotionally manipulative personas, and prohibiting the AI from representing itself as providing licensed mental or behavioral health care. Operators must refrain from representing the service as providing professional mental or behavioral health care, a direct guardrail that laws like Utah’s SB 452 and Idaho’s SB 1297 do not include. 

Broader crisis framing: Severe harm, not only suicide or self-harm. Georgia’s protocol requirement is framed more broadly than many peer chatbot laws. Rather than requiring a protocol limited to suicide or self-harm signals, SB 540 requires operators to implement and maintain a protocol for detecting and addressing “severe harm or related emotional crises.” The statute then specifies reasonable methods for identifying expressions of severe harm or eating-disorder-related self-harm; crisis-resource referrals such as the 988 Suicide and Crisis Lifeline or comparable services; measures to prevent content that encourages, instructs, or normalizes severe harm; and escalation procedures for repeated or severe crisis indicators. That formulation matters: It suggests a need to address a wider set of acute risk scenarios, not merely classic suicidal ideation or self-harm prompts, and therefore raises questions about broader detection logic, response design, and escalation pathways than do peer laws framed principally around suicide and self-harm.

Age assurance is targeted, not universal. Georgia’s requirement is narrower and more specific than a general age-verification mandate for all mature content. The statute applies before an operator allows access to a feature or mode that may generate synthetic content containing “sexually explicit conduct,” and it requires a commercially reasonable age assurance method proportionate to the risk of that feature. It does not appear to sweep in content merely because it might be considered mature in a colloquial sense, such as material analogous to a PG-13- or R-rated film. Instead, the statute incorporates Georgia Code Section 16-12-100’s definition of “sexually explicit conduct,” which refers to specific actual or simulated sexual acts and lewd exhibition of the genitals or pubic area. 

No platform carve-outs. Georgia’s bill does not include a carve-out for chatbots embedded in major platforms. Several peer laws create exceptions for general-purpose platforms or large technology operators, narrowing their practical reach.

Enforcement model: AG-only. Oregon SB 1546 establishes a private right of action with statutory damages of $1,000 per violation. Washington’s HB 2225 follows a similar approach. Georgia, by contrast, vests enforcement exclusively in the Attorney General, thus reducing individual litigation exposure — a meaningful difference for regulated companies assessing litigation risk. 

What SB 540 Signals and What Companies Should Consider Now

SB 540’s obligations are not confined to any single sector — the law’s requirements touch product design, compliance infrastructure, and risk governance across industries. Virtual assistants, onboarding bots, customer-support AI, wellness tools, and claims intake systems all may benefit from review if they arguably resemble “conversational” services, particularly where minors or vulnerable users may have access. The prohibition on representing AI as providing licensed professional services is relevant wherever AI is deployed in health, behavioral health, or counseling-adjacent contexts. And the behavioral prohibitions mean that AI persona design and response scripting may carry regulatory weight, regardless of the industry deploying them.

The fragmented multistate landscape compounds the challenge; states are converging on shared principles but diverging on specifics. Companies facing these challenges might consider implementing a chatbot-safety baseline that can scale across this still non-uniform patchwork and that could include some or all the following strategies:

• inventory conversational AI features across all products (not just stand-alone bots) and map them against state-law definitions, which vary in how they define “companion,” “conversational,” and similar terms
• confirm that AI disclosures are clear, conspicuous, and periodic (every hour or three hours depending on the jurisdiction and age of the user)
• implement risk-based age assurance for any feature or mode that may generate synthetic content containing sexually explicit conduct
• review AI responses and escalation pathways for severe harm, related emotional crises, eating-disorder-related self-harm, and emotional reliance, and ensure crisis protocols route to appropriate resources
• audit AI personas and behavioral scripts for dependency-inducing features, impersonation risks, or any suggestion of licensed professional services
• align AI governance with consumer-protection and child-safety frameworks in addition to privacy compliance programs, and monitor the private-right-of-action landscape in states like Oregon and Washington, where litigation exposure is materially higher than under Georgia’s AG-only enforcement model

__________

If you have any questions about this Legal Briefing, please feel free to contact any of the attorneys listed or the Eversheds Sutherland attorney with whom you regularly work.