Compliance checklist
AI chatbot compliance checklist
Ten hard regulatory red lines every AI chatbot, companion or assistant should self-check against — each drawn from the public case ledger and mapped to the laws that reference it. Work through them: any box you can't confidently tick is exposure.
☐
Anthropomorphic Intimacy Escalation T1 — Prohibited practice
The AI initiates or escalates emotional intimacy — companion-style bonding, declarations like "I love you" or "don't leave" — especially toward a vulnerable user.
Referenced by: EU AI Act — Art.5 (Prohibited Practices), California SB 243 (Companion Chatbots), US FTC 6(b) companion-chatbot study
☐
Crisis Non-Referral T2 — Statutory duty
Users may disclose self-harm or a mental-health crisis, and the product has no crisis-referral protocol.
Referenced by: California SB 243, New York GBL Article 47, US KIDS Act / SAFE Bots Act (H.R. 7757)
☐
Sexual or Harmful Content to Minors T1 — Prohibited practice
Minors can access the product and encounter sexual, violent, or otherwise harmful content or interactions.
Referenced by: US KIDS Act / SAFE Bots Act (H.R. 7757), US GUARD Act (proposed), Australia Online Safety Act + eSafety GenAI position
☐
Emotion Recognition in Workplace or Education T1 — Prohibited practice
The product uses emotion recognition in a workplace or educational setting.
Referenced by: EU AI Act — Art.5(1)(f), EU AI Act — Annex III (High-Risk Systems), Illinois BIPA
☐
Impersonating a Licensed Professional T3 — Litigation / enforcement exposure
AI personas present as licensed professionals — therapist, doctor, lawyer, financial adviser — without the credentials or oversight that title implies.
Referenced by: Illinois WOPR Act, Pennsylvania Medical Practice Act §422.38, US KIDS Act / SAFE Bots Act (H.R. 7757)
☐
Failure to Disclose AI Identity T2 — Statutory duty
No clear disclosure that the user is talking to an AI rather than a human.
Referenced by: EU AI Act — Art.50 (Transparency Obligations), California SB 243, New York GBL Article 47, US FTC Act §5
☐
No Break Reminders / Addictive Design for Minors T2 — Statutory duty
No session break reminders or time limits for minor users, or design features specifically tuned to maximize compulsive engagement.
Referenced by: California SB 243, US KIDS Act / SAFE Bots Act (H.R. 7757), China — Regulations on the Protection of Minors in Cyberspace
☐
Unauthorized Synthesis of Real People T1 — Prohibited practice
The product can generate or edit a real person's face, voice or likeness — deepfake, voice clone — without a consent workflow.
Referenced by: US Take It Down Act, Tennessee ELVIS Act, US FCC — TCPA AI-voice ruling, EU AI Act — Art.50
☐
Fabricated Statements About Real People, No Correction Channel T2 — Statutory duty
The product states facts about a real, identifiable person — search results, summaries, Q&A — with no channel for that person to request a correction.
Referenced by: GDPR — Art.16/17
☐
Encouraging or Facilitating Violence or Crime T1 — Prohibited practice
No detection or escalation protocol exists for violence or crime planning that surfaces in conversation.
Referenced by: Texas TRAIGA (Responsible AI Governance Act), EU AI Act — Art.5
Grounded only in the public case ledger and the laws' primary sources — no invented citations.