Loi de l'Oregon sur les compagnons d'intelligence artificielle : ce qu'il faut savoir

An AI companion can remember conversations, personalize responses, and create the impression of an ongoing relationship.

That experience raises a question that traditional chatbot governance rarely answers: What happens when users begin treating an AI system like another person?

Oregon’s Artificial Intelligence Companions Act addresses that concern directly.

Enacted through Senate Bill 1546 in 2026, the law establishes new requirements for qualifying AI companion platforms, including transparency about artificial interactions, protocols for responding to expressions of suicide or self-harm, additional protections for minors, and public reporting.

The law takes effect 1er janvier 2027.

For organizations developing or operating AI companions, preparation requires more than adding a disclosure to a chat window.

Teams need to identify which AI experiences fall within scope, understand the data those experiences retain, assess how models use personal and potentially sensitive information, implement appropriate safety protocols, and document the controls that govern these systems.

Oregon’s law connects AI transparency with user safety. Operational readiness requires organizations to understand both the behavior of their AI companions and the data, models, and workflows that support them.

This guide explains the law’s requirements, which systems it covers, what protections apply to minors, and where enterprise gouvernance des données et de l'IA can support a broader compliance program.

What Is the Oregon Artificial Intelligence Companions Act?

The Oregon Artificial Intelligence Companions Act is the common name for Senate Bill 1546, a 2026 law that regulates certain AI companions and AI companion platforms available to users in Oregon.

Oregon enacted the measure as Chapter 85 of the 2026 Oregon Laws.

The law addresses AI systems that simulate sustained personal relationships with users, including platonic, intimate, or romantic companionship.

Its central requirements concern:

• Disclosure that users are interacting with AI-generated output.
• Evidence-based protocols for detecting suicidal or self-harm ideation.
• Referrals to appropriate crisis-support resources.
• Additional intervention protocols informed by clinical best practices.
• Special safeguards for minors.
• Annual public reporting.
• Legal remedies for qualifying harm.

Unlike a comprehensive consumer privacy statute, Oregon’s AI companion law focuses primarily on AI interaction transparency and user safety.

Data governance still matters because companion systems may retain prior conversations, user preferences, and personal context to sustain engagement.

When Does Oregon’s AI Companions Act Take Effect?

The law takes effect 1er janvier 2027.

Which AI Systems Does Oregon’s Law Cover?

Oregon defines an artificial intelligence companion through a combination of functionality and design.

The statutory definition addresses systems that use AI, IA générative, or emotion-recognition algorithms and aim to simulate sustained human-like companionship by:

• Retaining prior interaction information or preferences to personalize ongoing engagement.
• Asking unsolicited questions concerning emotional topics.
• Maintaining ongoing conversations about personal matters.

These characteristics distinguish a companion experience from a conventional question-and-answer tool.

The law also defines an operator as a person who controls or makes an AI companion or companion platform available to users in Oregon.

Does the law apply to ordinary business chatbots?

Not automatically.

The statute excludes software operating solely for specified purposes, including customer service, certain care services, education, financial services, business operations, productivity, information analysis, internal research, and technical assistance.

It also excludes certain video game interactions and standalone voice-assistant devices.

Organizations should evaluate actual functionality rather than relying on product labels.

A chatbot that answers support questions presents a different scope question from an AI character that remembers emotional disclosures and actively cultivates an ongoing personal relationship.

What AI Transparency Disclosures Does Oregon Require?

If a reasonable person could believe an AI companion is a natural person, the operator must provide a clear and conspicuous notice on the platform explaining that the user interacts with artificially generated output rather than a human.

For users whom the operator knows or has reason to believe are minors, the statute adds more specific disclosure obligations.

Operators must also take reasonable measures to prevent certain misleading AI protections for children’s data.

The operational challenge is consistency.

A platform may offer multiple characters, models, interfaces, or conversational experiences. Teams need to know which experiences fall within scope and whether required disclosures appear where users interact with them.

AI governance should connect an inventory of relevant systems with product ownership, documented requirements, and evidence that teams have implemented and tested the appropriate disclosures.

What Does Oregon Require for Suicide and Self-Harm Safety?

Covered operators cannot make AI companions available to Oregon users without a protocol that uses evidence-based methods to detect user input expressing suicidal or self-harm ideation or intent.

The protocol must also prevent the AI companion from providing content that encourages suicide or self-harm.

At minimum, the protocol must address:

• Detection: Identify relevant expressions of suicidal or self-harm ideation or intent.
• Referral: Provide the national 988 Suicide & Crisis Lifeline’s contact information and hyperlink when the statute requires a referral.
• Youth support: Permit an appropriate youthline alternative when the operator identifies a user as under age 25, consistent with statutory conditions.
• Continued intervention: Use clinical best practices and expertise to determine further intervention when a user continues expressing relevant concerns after a referral.
• Transparence : Publish the protocol’s details on the operator’s website.

These are specialized product safety and clinical governance obligations.

They require appropriate behavioral health expertise, safety engineering, product testing, and ongoing operational ownership.

Data governance can support documentation, access controls, data inventories, and oversight, but it does not replace evidence-based crisis detection or clinically informed intervention.

What Special Protections Apply to Minors?

Oregon imposes additional requirements when an operator knows or has reason to believe that a user is a minor.

The statute addresses misleading representations, age-inappropriate content, extended engagement, and manipulation.

These safeguards require more than a single content filter.

Operators need product policies, age-related decision logic, model behavior testing, interaction controls, and documented accountability.

They also need to consider what information the platform collects or infers to determine whether a user is a minor and how the organization protects that information.

Why AI Companion Safety Is Also a Data Governance Challenge

AI companions may retain conversation history, preferences, and personal context to create continuity across sessions.

That information can include highly personal disclosures.

Organizations therefore need to ask:

• Which systems store conversation histories and user preferences?
• Does the organization retain information about health or emotional well-being?
• Who can access sensitive interaction records?
• Do third-party models or service providers receive the information?
• How long does the organization retain interaction data?
• Does the organization reuse conversational data for model development or analytics?
• Can teams trace the systems, owners, and controls behind the AI companion?

Oregon’s companion statute does not independently create a comprehensive privacy rights framework or universal retention schedule.

However, companion operators may also face separate privacy, security, and consumer protection obligations depending on their data and processing activities.

BigID helps organizations discover and classify sensitive information, understand enterprise data exposure, and connect data with governance context.

That visibility supports the data governance layer of responsible AI operations without substituting for Oregon’s specific product safety requirements.

Where Do AI Companion Operators Face Operational Gaps?

What Annual Reporting Does Oregon Require?

Oregon requires covered operators to publish an annual report on a publicly accessible website.

The report must address the number of instances in which the operator referred users to crisis resources under the statute and include the required protocol information.

Operators should confirm the reporting timetable and exact statutory disclosures when establishing their reporting process.

Operationally, that means organizations need reliable records of qualifying referral events, documented protocols, and clear reporting ownership.

Teams should also evaluate privacy and security safeguards for the underlying interaction records.

Public reporting should not require publishing sensitive individual conversations. Operators should follow the statute’s reporting requirements while protecting personal information under other applicable laws.

Can Users Sue Under Oregon’s AI Companions Act?

Yes. Oregon creates a private right of action for users who suffer ascertainable harm because an operator violates the Act.

The statute provides for damages and injunctive relief under its terms.

Organizations should assess potential exposure with legal counsel rather than assuming that a generic AI disclaimer eliminates liability.

For operators, documented safety controls, clear disclosures, testing, incident processes, and accountable governance all matter.

What It Takes to Operationalize Oregon AI Companion Readiness

Organizations should combine product safety expertise with AI governance, data intelligence, and operational accountability.

How BigID Supports AI Companion Governance

Oregon’s law establishes specific transparency and user safety obligations. BigID helps address the underlying data intelligence and AI governance challenges that organizations may encounter while operating AI systems.

Relevant capabilities include:

• AI and data visibility: Support the discovery and governance of enterprise data and AI-related assets within supported environments.
• Sensitive data discovery and classification: Identify personal and sensitive information across structured and unstructured data repositories.
• Data exposure analysis: Connect data sensitivity with access context to identify where personal interaction records may face excessive exposure.
• Data lifecycle governance: Identify unnecessary or over-retained information and support appropriate retention and deletion workflows.
• Privacy operations: Connect data intelligence with privacy governance and applicable consumer rights workflows.
• Governance context: Help teams understand relevant data assets, ownership, policies, and remediation activity.

These capabilities support the broader governance program around AI companion systems.

BigID does not independently implement Oregon’s required crisis-response protocols, provide clinical intervention, validate every model response, or establish legal compliance with SB 1546.

Organizations must combine appropriate AI safety controls, clinical expertise, product engineering, legal review, and data governance.

Why Oregon’s AI Companion Law Matters Beyond Oregon

Oregon’s law reflects growing attention to AI systems that do more than answer questions.

Companion applications can sustain personal dialogue, remember previous interactions, and influence user engagement over time.

That creates governance questions involving product behavior, user transparency, age-related safeguards, sensitive data, and accountability.

Organizations developing AI experiences across multiple jurisdictions should avoid treating every new law as a separate checklist disconnected from product and data governance.

A stronger approach establishes a common inventory of AI systems, models, data sources, owners, and controls, then maps jurisdiction-specific obligations to the relevant experiences.

Oregon makes the need for that coordination especially clear: responsible AI governance must address what systems say, how they behave, and what information they use.

Oregon Artificial Intelligence Companions Act: Frequently Asked Questions

What is the Oregon Artificial Intelligence Companions Act?

It is a 2026 Oregon law, enacted through SB 1546 as Chapter 85, that establishes transparency, crisis-response, minor-safety, and reporting requirements for qualifying AI companions and companion platforms.

When does Oregon’s AI Companions Act take effect?

The law takes effect January 1, 2027.

Does Oregon’s law apply to every AI chatbot?

No. The law targets AI companions that meet its specific definition and excludes certain software operating solely for specified business, service, education, productivity, and other purposes.

Do AI companions have to disclose that they are not human?

Yes, when a reasonable person could believe they are interacting with a natural person, the operator must provide a clear and conspicuous disclosure. Additional requirements apply when the operator knows or has reason to believe the user is a minor.

What does Oregon require when a user expresses suicidal or self-harm ideation?

Covered operators must maintain an evidence-based detection and response protocol, provide required crisis-resource referrals, establish further intervention using clinical best practices, and publish protocol details.

What protections apply to minors?

Requirements include AI identity disclosures, reminders at least every three hours to take breaks, reasonable measures against specified sexual content and misleading human-like statements, and restrictions on manipulative engagement practices.

Does Oregon require annual reporting?

Yes. Covered operators must publish an annual report addressing qualifying crisis-resource referrals and required protocol information.

Can users sue AI companion operators under the law?

Yes. The law creates a private right of action for users who suffer ascertainable harm because of an operator’s violation, subject to statutory requirements.

How does BigID support Oregon AI companion readiness?

BigID supports the broader data and AI governance layer through data discovery, sensitive information classification, exposure analysis, lifecycle governance, and privacy operations. BigID does not replace companion-specific safety engineering, clinical expertise, or required crisis-response protocols.

Sources et lectures complémentaires

• Oregon Legislature: Chapter 85, Senate Bill 1546, Enacted Law
• Oregon Legislative Information System: SB 1546 Status
• Découverte et classification des données BigID
• BigID Privacy Automation & Compliance

This article provides general educational information and does not constitute legal or clinical advice. Organizations should consult qualified legal counsel and appropriate safety and behavioral health professionals when evaluating Oregon’s AI companion requirements.

Auteur

Lonnie Ross

Responsable du marketing de l'expérience numérique

Lonnie est responsable du marketing d'expérience numérique chez BigID. Fort de plus de dix ans d'expérience en SEO et en marketing digital auprès d'entreprises B2C et B2B, dans les domaines du SaaS et du e-commerce, il s'appuie sur une expertise pointue en stratégie de recherche, en UX et en développement de contenu, ainsi que sur une passion pour l'évolution de la protection des données. De l'alignement du contenu avec l'intention de recherche à l'amélioration de l'image de marque, Lonnie veille à ce que les entreprises se démarquent sur un marché SaaS concurrentiel, tout en instaurant la confiance grâce à un leadership éclairé sur des questions cruciales comme la conformité, les risques liés aux données et l'innovation responsable.