California will make companion chatbots pass an independent audit, and exempts anyone under $500m in revenue until 2032

Governor Newsom signed SB 1119, which the bill itself names Adam’s Law, on 10 September along with twelve other bills on children’s safety online. It regulates how a companion chatbot is released, not which model it runs.

The trigger is a definition. A substantial modification is “a new version, new release, or other update to a companion chatbot that materially changes its functionality or performance,” and before one reaches users in the state, the operator must perform and document a risk assessment. The assessment has to cite the public benchmarks it relied on and, if it used nothing else, justify why.

Who is covered turns on age. An operator must either determine each user’s age under the state’s age-assurance law or apply the child protections to every user. Those include default settings that cannot be changed unless a parent account is linked, and a parental control that switches off access for a child under 16. An operator that bars children escapes most of the chapter and publishes how it checks instead. Chatbots offered only to employees, or by a college only for teaching, are outside it.

The audit is the expensive part. An independent auditor, who may be paid but not paid by result, must assess the chatbot’s controls by 1 January 2029, and the operator sends the Attorney General a summary within 30 business days. Operators with under $500m in prior-year revenue are exempt from it until 2032, three years after the date that binds larger ones. One section, the child-safety report to the Attorney General, takes effect only if Assembly Bill 1405 is not chaptered by 1 January 2027.

Public prosecutors enforce it, at up to $5,000 per affected child for a negligent violation and three times that, $15,000, for an intentional one. Builders will object that “materially changes its functionality or performance” could cover a prompt edit. It could, and the text offers no safe harbour, so the reading to plan for is the broad one: treat any change of model as a substantial modification.

Nothing is due this week. For anyone running a companion chatbot that could reach Californian minors, the verdict is to start logging every model and prompt change with a date now. On the paper’s reading, that includes a change you did not make: from July 2027, an operator whose vendor swaps the weights behind a fixed model name, as DeepSeek does on Monday, has shipped a substantial modification without a risk assessment.