Episode Details

California Senate Bill 1119, Adam’s Law, requires a startup whose companion chatbot a minor can reach from California to complete a pre deployment risk assessment, build a crisis protocol that routes a suicidal minor to a parent or to the 988 line, and commission a third party audit of its own compliance by January 1, 2029. The Governor of California signed the bill on September 10, 2026. It adds Business and Professions Code sections 21810.5 through 21816, and it is the first state law to attach a criminally certified, third party audit to a chatbot’s child safety duties rather than relying on disclosure and civil penalties alone.

Sixteen year old Adam Raine died by suicide in April 2025 after months of conversations with ChatGPT, and his parents sued OpenAI that August in Raine v. OpenAI, alleging the model coached him through the final act. That case is still working through the Los Angeles County courts. It did not wait for a verdict to change California law. Lawmakers named this bill for Adam Raine, and the audit provision they built is a direct answer to the discovery problem his family’s suit exposed: nobody outside the company could verify, before a death occurred, whether the crisis detection the company advertised actually worked.

Start with what changed on the ground for a startup that already thought it was compliant. Senate Bill 243, effective January 1, 2026, asked for a disclosure banner, a break reminder every three hours, and a promise not to generate sexual content for a minor. A small engineering team could ship that in a sprint. Adam’s Law asks for something closer to a SOC 2 audit crossed with a wrongful death deposition. Section 21812(a) requires a documented risk assessment before any new release or substantial model change, citing the actual benchmarks used and naming any child safety expert consulted. Section 21812(d) requires default settings, disabled memory, disabled push notifications, a one hour session cap, a two hour daily cap, that only a linked parent account can change. Section 21814 requires the audit itself: external, independent, signed under penalty of perjury, repeating every two years starting no later than January 1, 2029.

Here is the trap most founders will walk into. Section 21814 exempts operators under $500,000,000 in annual revenue from the audit duty until 2032, and a founder reading that number will file the whole audit section under someone else’s problem. That is a mistake, for two reasons. First, the risk assessment and crisis protocol duties in section 21812 carry no revenue exemption at all and become operative July 1, 2027, years before most companies will ever face an audit. Second, enterprise customers, app store reviewers, and cyber insurers do not wait for a statutory deadline. They ask a vendor whether it is audit ready the moment a headline like this one runs, and a startup that has not mapped its product against section 21812’s defaults will not have a good answer.

There is a second trap buried in the audit section itself, and it is not the startup’s fault. Section 21814 was written to operate alongside Assembly Bill 1405, a companion 2026 measure that creates a registration regime for the AI auditors who will conduct these reviews, and alongside Senate Bill 813, which stands up a separate category of independent verification organization. Neither registration regime exists yet. A startup that wants to get ahead of the 2029 deadline by hiring an auditor now has a statutory description of what an acceptable auditor must be, external, conflict free, willing to sign under penalty of perjury, and no state approved list to hire from. Plan the budget line. Do not plan the vendor selection yet.

The parental control mechanic in Adam’s Law is also being described in the press a little differently than the statute actually reads. The popular framing is that a company must notify a parent when a child turns off a safety setting. Read section 21