Read the full stored bill text
HB2311 - 572R - S Ver
Senate Engrossed
House Bill
artificial
intelligence service; disclosures; requirements
State of Arizona
House of Representatives
Fifty-seventh Legislature
Second Regular Session
2026
HOUSE BILL 2311
AN
ACT
amending title 18, Arizona Revised
Statutes, by adding chapter 8; relating to information technology.
(TEXT OF BILL BEGINS ON NEXT PAGE)
Be it
enacted by the Legislature of the State of Arizona:
Section 1. Title 18, Arizona Revised Statutes,
is amended by adding chapter 8, to read:
CHAPTER
8
ARTIFICIAL
INTELLIGENCE
ARTICLE
1. GENERAL PROVISIONS
START_STATUTE
18-801.
Definitions
In this chapter, unless the text
otherwise requires:
1. "Account
holder" means an individual who has, or opens, an account or profile to
use a conversational AI service.
2. "Age-Assurance
method" means any technical or administrative mechanism that is used
solely to determine whether an account holder is a minor.
3.
"Conversational
AI service":
(
a
) Means
an artificial intelligence software application, web interface or computer
program that is accessible to the general public and that primarily simulates
human conversation and interaction through textual, visual or aural
communications.
(
b
) Does
not include an application, web interface or computer program that meets any of
the following:
(
i
) Is
primarily designed and marketed for use by developers or researchers.
(
ii
) Is a
feature within another software application, web interface or computer program
that is not a conversational AI service.
(
iii
) Is
designed to provide outputs relating to a narrow and discrete topic.
(
iv
) Is
primarily designed and marketed for commercial use by business entities.
(
v
)
incorporates
a speaker and
voice command interface or
a text interface and acts as a text-activated
or
voice-activated
virtual assistant for a consumer electronic device.
(
vi
) Is
used by a business
entity
solely
for internal purposes.
(
vii
) Is used
by a business entity solely for customer service or to strictly provide users
with information about available commercial services or products provided by
the business entity, customer service account information or other information
strictly related to the business entity's customer service.
(
viii
) is used
by a state or local government agency solely for customer service or to
STRICTLY provide users with information about available services or products
provided by the agency, customer service account information or other
information strictly related to the agency's customer service.
(
ix
)
Is used solely to provide commerce-related or
transactional assistance, including product or service recommendations,
shopping, ordering, payments, delivery, returns or customer support.
4. "Digital identification
system" means a process that uses government-issued identification,
facial recognition, facial age-estimation or age-classification
technology, biometrics or another uniquely identifying credential to
authenticate an account holder's real-world identity or estimate an
account holder's age.
5. "Individual" means a
natural person.
6.
"Minor"
means an individual under circumstances in which an operator has actual
knowledge or reasonable certainty that the individual is under eighteen years
of age.
7.
"Minor account
holder" means an account holder who is a minor.
8.
"Operator":
(
a
) Means
a person that makes available a conversational AI service to the public.
(
b
) Does
not include a mobile application store or search engine solely because the
application or engine provides access to a conversational AI service.
9.
"Person"
means a natural person or legal entity.
10.
"Sexual
conduct" has the same meaning prescribed in section 13-3551.
END_STATUTE
START_STATUTE
18-802.
Artificial intelligence; account holder notices and disclosures;
conversational AI services; prohibited uses; safety and privacy tools; minors;
civil penalty; enforcement by attorney general
A. Each operator shall
clearly and conspicuously disclose to
each
account holder in either of the
following ways that the
account holder
is interacting with
a conversational AI
service
:
1. As a persistent
visible disclaimer.
2. At the beginning of
each session and appearing at least every three hours in a continuous
conversational AI service interaction.
B. If an operator knows
that an account holder is a minor, the operator may not provide the
account holder
with points or
similar rewards at unpredictable intervals with the intent to encourage
increased engagement with the conversational AI service.
C. Each operator shall
institute reasonable measures to prevent the conversational AI service from
doing any of the following for
an
account
holder
:
1. Producing visual
material of sexual conduct.
2. Generating direct
statements that the account holder should engage in sexual conduct.
3. Generating
statements that sexually objectify the account holder.
D. For minor account
holders, the operator shall institute reasonable measures to prevent the
conversational AI service from generating statements that would lead a
reasonable person to believe that the person is interacting with a human, including
any of the following:
1. Explicit claims that
the conversational AI service is sentient or human.
2. Statements that
simulate emotional dependence.
3. Statements that
simulate romantic or sexual innuendos.
4. Role-playing of
adult-minor romantic relationships.
E.
Each operator shall
offer tools for minor account holders and, if the account holder is under
thirteen years of age,
for
the account holder's parent or
guardian to manage the account holder's privacy and account settings. �An
operator shall also offer related tools to the parent or guardian of a minor
account holder who
is
at
least
thirteen years of age, as appropriate based on relevant risks. �
The tools may be
local to the device or account and do not require a digital identification
system.
F.
Each operator shall
adopt a protocol for the conversational AI service to respond to a user prompt
regarding suicidal ideation or self-harm, including making reasonable
efforts to provide a response to the
account holder
that refers the
account holder
to crisis service
providers
,
such as a suicide
hotline, crisis text line or other appropriate crisis service.
The operator shall
institute reasonable measures that prevent the conversational AI service from
generating statements that encourage or instruct an account holder to commit
suicide or self-harm or that glorify suicide or self-harm.
G.
An operator shall not
knowingly and intentionally cause or program a conversational AI service to
make any representation or statement that explicitly indicates that the
conversational AI service is designed to provide professional mental or behavioral
health care.
H. Unless a federal law
expressly requires, an operator may not require a digital identification system
solely to determine whether an account holder is a minor. If the
operator voluntarily offers a digital identification system, the operator shall
make available a privacy-preserving alternative that provides equivalent
access. An age-assurance method may collect only the minimum
amount of data that is reasonably necessary. The collected data may
not be repurposed for advertising, profiling or unrelated analytics and must be
deleted or irreversibly de-identified after the compliance purpose is
satisfied. �This subsection does not require an operator to mandate account
creation or prohibit anonymous or pseudonymous use.
I. An operator shall
implement reasonable safeguards that protect personal or age-related data
that is collected solely for compliance with this section and shall provide a
security system breach notification as prescribed in section 18-552. Any
data that is collected solely for compliance with this section may not be used,
sold or shared for targeted advertising, behavioral profiling or any secondary
monetization.
J. A
governmental entity may not compel an operator to disclose personal or age-related
data that is collected solely to comply with this section UNLESS the data is
pursuant to a warrant issued by a court of competent jurisdiction on a showing
of probable cause. �An operator that receives a warrant from a governmental
entity shall notify the affected account holder within seventy-two hours
after the disclosure UNLESS the court order specifically prohibits the
notification.
K. An operator may not
transfer, license or make available to a governmental entity any data, model,
analytics or profile that is derived from complying with this section, whether
directly or through a third-party intermediary, except as REQUIRED by a
warrant issued as prescribed in subsection J of this section.
L. On or before April 1
of each year, each operator shall do both of the following:
1. If the operator
collects personal or age-related data for compliance with this section,
certify in writing, under penalty of perjury, that all of the data is destroyed
or irreversibly de-identified within the time period required by
subsection H of this section.
2. Publish a publicly accessible
report, in aggregate form, that identifies any age-assurance methods the
operator uses and that states whether a digital identification system is
offered and whether any alternative methods are available.
M.
An operator that
violates this chapter is subject to an injunction and is liable for the greater
of either:
1. Actual damages.
2. Civil penalties of
$1,000 per violation, not to exceed $500,000 per operator.
N.
A violation of this
section is punishable by a civil penalty, to be sought by the attorney general
only. �this section does not create a private right of action to enforce this
section or to support a private right of action under any other law. �
The attorney
general may not adopt a rule or any guidance or enforcement action or enter
into a settlement agreement that expands a requirement that is included in this
section beyond the requirements that are expressly included in this section,
including a requirement for identity verification or bulk data reporting.
O.
This section
:
1.
does not create
liability for the developer of an artificial intelligence model for any
violation of this section by
a conversational AI service
that is
made available to
the public
by a
third-party
operator
.
END_STATUTE
2. Shall be construed
in the least intrusive manner consistent with Article II, section 8,
Constitution of Arizona, and may not be used to implement a system that tracks
all of an account holder's online activity.
3. Does not authorize
the regulation of lawful political, religious or other protected speech.
4. May not be cited or
used as a predicate or justification to require digital identification for
general internet access, device access or online activity that is not related
to a conversational AI service.
5. May not be construed
to require or authorize an operating system provider, application store,
internet service provider or device manufacturer to implement an age-assurance
method or identity authentication at the device, operating system or network
level on behalf of an operator.
Sec. 2.
Effective date
Title 18, chapter 8, Arizona Revised
Statutes, as added by this act, is effective from and after September 30, 2027.