HB2311 - 572R

Be it enacted by the Legislature of the State of Arizona:

Section 1. Title 18, Arizona Revised Statutes, is amended by adding chapter 8, to read:

CHAPTER 8

ARTIFICIAL INTELLIGENCE

ARTICLE 1. GENERAL PROVISIONS

START_STATUTE18-801. Definitions

In this chapter, unless the text otherwise requires:

1. "Account holder" means an individual who has, or opens, an account or profile to use a conversational AI service.

2. "Age-Assurance method" means any technical or administrative mechanism that is used solely to determine whether an account holder is a minor.

3. "Conversational AI service":

(a) Means an artificial intelligence software application, web interface or computer program that is accessible to the general public and that primarily simulates human conversation and interaction through textual, visual or aural communications.

(b) Does not include an application, web interface or computer program that meets any of the following:

(i) Is primarily designed and marketed for use by developers or researchers.

(ii) Is a feature within another software application, web interface or computer program that is not a conversational AI service.

(iii) Is designed to provide outputs relating to a narrow and discrete topic.

(iv) Is primarily designed and marketed for commercial use by business entities.

(v) incorporates a speaker and voice command interface or a text interface and acts as a text-activated or voice-activated virtual assistant for a consumer electronic device.

(vi) Is used by a business entity solely for internal purposes.

(vii) Is used by a business entity solely for customer service or to strictly provide users with information about available commercial services or products provided by the business entity, customer service account information or other information strictly related to the business entity's customer service.

(viii) is used by a state or local government agency solely for customer service or to STRICTLY provide users with information about available services or products provided by the agency, customer service account information or other information strictly related to the agency's customer service.

(ix) Is used solely to provide commerce-related or transactional assistance, including product or service recommendations, shopping, ordering, payments, delivery, returns or customer support.

4. "Digital identification system" means a process that uses government-issued identification, facial recognition, facial age-estimation or age-classification technology, biometrics or another uniquely identifying credential to authenticate an account holder's real-world identity or estimate an account holder's age.

5. "Individual" means a natural person.

6. "Minor" means an individual under circumstances in which an operator has actual knowledge or reasonable certainty that the individual is under eighteen years of age.

7. "Minor account holder" means an account holder who is a minor.

8. "Operator":

(a) Means a person that makes available a conversational AI service to the public.

(b) Does not include a mobile application store or search engine solely because the application or engine provides access to a conversational AI service.

9. "Person" means a natural person or legal entity.

10. "Sexual conduct" has the same meaning prescribed in section 13-3551. END_STATUTE

START_STATUTE18-802. Artificial intelligence; account holder notices and disclosures; conversational AI services; prohibited uses; safety and privacy tools; minors; civil penalty; enforcement by attorney general

A. Each operator shall clearly and conspicuously disclose to each account holder in either of the following ways that the account holder is interacting with a conversational AI service:

1. As a persistent visible disclaimer.

2. At the beginning of each session and appearing at least every three hours in a continuous conversational AI service interaction.

B. If an operator knows that an account holder is a minor, the operator may not provide the account holder with points or similar rewards at unpredictable intervals with the intent to encourage increased engagement with the conversational AI service.

C. Each operator shall institute reasonable measures to prevent the conversational AI service from doing any of the following for an account holder:

1. Producing visual material of sexual conduct.

2. Generating direct statements that the account holder should engage in sexual conduct.

3. Generating statements that sexually objectify the account holder.

D. For minor account holders, the operator shall institute reasonable measures to prevent the conversational AI service from generating statements that would lead a reasonable person to believe that the person is interacting with a human, including any of the following:

1. Explicit claims that the conversational AI service is sentient or human.

2. Statements that simulate emotional dependence.

3. Statements that simulate romantic or sexual innuendos.

4. Role-playing of adult-minor romantic relationships.

E. Each operator shall offer tools for minor account holders and, if the account holder is under thirteen years of age, for the account holder's parent or guardian to manage the account holder's privacy and account settings. An operator shall also offer related tools to the parent or guardian of a minor account holder who is at least thirteen years of age, as appropriate based on relevant risks. The tools may be local to the device or account and do not require a digital identification system.

F. Each operator shall adopt a protocol for the conversational AI service to respond to a user prompt regarding suicidal ideation or self-harm, including making reasonable efforts to provide a response to the account holder that refers the account holder to crisis service providers, such as a suicide hotline, crisis text line or other appropriate crisis service. The operator shall institute reasonable measures that prevent the conversational AI service from generating statements that encourage or instruct an account holder to commit suicide or self-harm or that glorify suicide or self-harm.

G. An operator shall not knowingly and intentionally cause or program a conversational AI service to make any representation or statement that explicitly indicates that the conversational AI service is designed to provide professional mental or behavioral health care.

H. Unless a federal law expressly requires, an operator may not require a digital identification system solely to determine whether an account holder is a minor. If the operator voluntarily offers a digital identification system, the operator shall make available a privacy-preserving alternative that provides equivalent access. An age-assurance method may collect only the minimum amount of data that is reasonably necessary. The collected data may not be repurposed for advertising, profiling or unrelated analytics and must be deleted or irreversibly de-identified after the compliance purpose is satisfied. This subsection does not require an operator to mandate account creation or prohibit anonymous or pseudonymous use.

I. An operator shall implement reasonable safeguards that protect personal or age-related data that is collected solely for compliance with this section and shall provide a security system breach notification as prescribed in section 18-552. Any data that is collected solely for compliance with this section may not be used, sold or shared for targeted advertising, behavioral profiling or any secondary monetization.

J. A governmental entity may not compel an operator to disclose personal or age-related data that is collected solely to comply with this section UNLESS the data is pursuant to a warrant issued by a court of competent jurisdiction on a showing of probable cause. An operator that receives a warrant from a governmental entity shall notify the affected account holder within seventy-two hours after the disclosure UNLESS the court order specifically prohibits the notification.

K. An operator may not transfer, license or make available to a governmental entity any data, model, analytics or profile that is derived from complying with this section, whether directly or through a third-party intermediary, except as REQUIRED by a warrant issued as prescribed in subsection J of this section.

L. On or before April 1 of each year, each operator shall do both of the following:

1. If the operator collects personal or age-related data for compliance with this section, certify in writing, under penalty of perjury, that all of the data is destroyed or irreversibly de-identified within the time period required by subsection H of this section.

2. Publish a publicly accessible report, in aggregate form, that identifies any age-assurance methods the operator uses and that states whether a digital identification system is offered and whether any alternative methods are available.

M. An operator that violates this chapter is subject to an injunction and is liable for the greater of either:

1. Actual damages.

2. Civil penalties of $1,000 per violation, not to exceed $500,000 per operator.

N. A violation of this section is punishable by a civil penalty, to be sought by the attorney general only. this section does not create a private right of action to enforce this section or to support a private right of action under any other law. The attorney general may not adopt a rule or any guidance or enforcement action or enter into a settlement agreement that expands a requirement that is included in this section beyond the requirements that are expressly included in this section, including a requirement for identity verification or bulk data reporting.

O. This section:

1. does not create liability for the developer of an artificial intelligence model for any violation of this section by a conversational AI service that is made available to the public by a third-party operator. END_STATUTE

2. Shall be construed in the least intrusive manner consistent with Article II, section 8, Constitution of Arizona, and may not be used to implement a system that tracks all of an account holder's online activity.

3. Does not authorize the regulation of lawful political, religious or other protected speech.

4. May not be cited or used as a predicate or justification to require digital identification for general internet access, device access or online activity that is not related to a conversational AI service.

5. May not be construed to require or authorize an operating system provider, application store, internet service provider or device manufacturer to implement an age-assurance method or identity authentication at the device, operating system or network level on behalf of an operator.

Sec. 2. Effective date

Title 18, chapter 8, Arizona Revised Statutes, as added by this act, is effective from and after September 30, 2027.