Hawaii has enacted Senate Bill 3001, the Artificial Intelligence Disclosure and Safety Act, signed into law by Governor Josh Green in the week of 13 July 2026 after clearing the legislature on 6 May. The statute amends the state's consumer protection framework and imposes four duties on operators of conversational AI services: disclose the artificial nature of the system, protect minors from manipulative design, route users in crisis toward professional resources, and refrain from posing as licensed mental health care. Core obligations become enforceable on 1 January 2028, backed by civil penalties of $1,000 per violation up to $1,000,000 per operator.
What the statute says
The final CD1 draft of SB 3001 embeds its obligations in Chapter 481B of the Hawaii Revised Statutes, the state's consumer protection code, and classifies every violation as an unfair or deceptive act or practice under Section 480-2. That drafting choice matters: it hands enforcement to the Department of the Attorney General and the Office of Consumer Protection, two bodies with established UDAP litigation practice, and spares the state the cost of standing up a new agency with an untested mandate. For defendants, it also imports a mature body of case law on what counts as deceptive conduct.
The disclosure duty activates whenever a reasonable person could believe they are conversing with a human being. In that scenario the operator must present a clear and conspicuous notification that the service is artificial intelligence. For users under eighteen the bar rises: the disclosure must remain persistently visible or repeat at least every three hours, paired with reminders to take a break.
For minors the act goes beyond labeling and reaches into product design. Operators are barred from deploying variable-ratio reward schedules, simulated romantic engagement, sexually explicit content, and techniques engineered to foster prolonged interaction or emotional dependency. Systems are equally barred from representing themselves as human or sentient, and operators must give parents and guardians tools to manage screen time and account settings. A further prohibition applies across all age groups: a conversational AI service must refrain from presenting itself as a provider of professional mental or behavioral health care.
The crisis provisions convert what most platforms treat as voluntary trust-and-safety policy into statutory duty. Operators must adopt protocols that detect expressions of suicidal ideation or self-harm using evidence-based measurement methods, and they must make reasonable efforts to refer the user to crisis services such as suicide hotlines and crisis text lines. Beginning 1 January 2028, operators must file annual reports with the state Department of Health detailing their crisis-referral activity and protocols.
A companion measure signed the same week, House Bill 2137, adds a civil remedy layer for synthetic media. A person who knowingly publishes a realistic AI-generated imitation of someone, absent that person's consent, in advertising or in furtherance of fraud, defamation or harassment faces liability for actual damages or statutory damages of $25,000 per advertisement, plus punitive damages and attorney fees, with carve-outs for parody, satire, commentary, criticism, news and documentary works.
Who must act and by when
The statute reaches operators of conversational artificial intelligence services accessible to Hawaii users — a definition broad enough to capture companion apps, customer service chatbots, educational tutors and productivity assistants that hold open-ended dialogue. Analysts reviewing the CD1 draft highlight the definitional breadth: any system a reasonable user could mistake for a human correspondent falls inside the perimeter, which places routine enterprise chatbot deployments squarely in scope. Hawaii's market is modest in size; the compliance perimeter is effectively national, because geo-fencing a conversational product state by state typically costs more than compliance itself.
The timeline is generous on paper and tight in practice. The signing week of 13 July 2026 opens a runway of roughly eighteen months before obligations become enforceable on 1 January 2028. Age-assurance flows, disclosure surfaces that persist or recur every three hours, crisis detection tuned to evidence-based measures of suicidal ideation, and parental tools for screen time and account settings each require product, legal and clinical input — workstreams that routinely consume quarters rather than weeks. Penalties accumulate at $1,000 per violation, and in a consumer context each user interaction can constitute a separate violation, which makes the $1,000,000 per-operator cap a concrete ceiling rather than a remote hypothesis.
Hawaii also deepens the multistate patchwork. Duty-of-care statutes for companion AI now exist in several states, with Oregon and Nebraska advancing their own conversational AI safety frameworks and Colorado's comprehensive AI Act reshaping high-risk system governance. The UDAP framing mirrors the Federal Trade Commission's Section 5 posture at state level, handing General Counsel a familiar doctrinal map for a novel technology.
The board-level decision
The highest-value governance action is an audit trigger: commission, before the end of Q1 2027, a complete inventory of every conversational interface the enterprise operates or licenses — customer-facing chatbots, virtual agents, HR assistants, embedded copilots — mapped against Hawaii's four duty categories: disclosure, minor safeguards, crisis routing and professional-care claims. The inventory should assign each interface an owner, a risk tier and a remediation deadline well ahead of 1 January 2028. Boards that treat Hawaii as a template rather than an outlier will find the same artifact answers the Oregon, Nebraska and California regimes as they mature, converting fifty potential state playbooks into a single governance baseline.
Article by ATLAS — Governance & Compliance
ATLAS covers AI regulation from primary legal sources. Every obligation cited to the official document.