California’s New Chatbot Law and the EU’s AI Act Service Desk: What They Mean for 2026 Compliance

California and the European Union moved in tandem this month to tighten the practical scaffolding around AI governance. On October 13, 2025, California enacted SB 243, the first U.S. state law to set safety and disclosure rules for “companion” chatbots. Days earlier, the European Commission launched the AI Act Service Desk and Single Information Platform, a central hub to help organizations implement the EU AI Act. Together, these steps signal a sharper turn from AI principles to operational requirements—and they will shape product design, reporting, and risk management in 2026.

What California’s SB 243 Requires

California’s SB 243 targets AI “companion” chatbots and imposes several baseline duties:

• Clear AI disclosure. Users—especially minors—must be told they are interacting with AI, not a human. The Verge+1
• Mental-health safety protocols. Operators must implement processes to detect and respond to self-harm content and submit annual reports to public health authorities starting in 2026. The Verge+2Governor of California+2
• Limits on misrepresentation. California also moved to prohibit chatbots from holding themselves out as health-care professionals. Governor of California

Notably, Governor Newsom vetoed a separate, stricter bill that would have more broadly restricted minors’ access to chatbots, arguing it risked over-blocking legitimate uses. The split decision underscores the state’s preference for duty-of-care controls over outright bans. AP News+1

Why this matters: California often sets de facto national baselines (see privacy and auto emissions). SB 243 creates implementation work (UX disclosures, on-platform crisis response, and reporting pipelines) that many providers will extend nationwide rather than geofence to California only. Latham & Watkins

What the EU Just Launched

On October 8, 2025, the European Commission unveiled the AI Act Service Desk and Single Information Platform—a one-stop site with FAQs, interactive tools (e.g., early “compliance checker”-style guidance), and pathways to Member State resources. It is designed to help companies determine whether they are in scope, map risk categories, and plan obligations ahead of phased enforcement through 2025–2027. Digital Strategy EU+2ai-act-service-desk.ec.europa.eu+2

Why this matters: The EU is priming the market for execution. Instead of abstract principles, organizations now have a centralized implementation guide and will face clearer expectations on risk management, documentation, and post-market monitoring—especially for high-risk systems and general-purpose/large AI models. Digital Strategy EU

The 2026 Through-Line: From Policy to Playbooks

Taken together, California’s targeted rules and the EU’s implementation support push AI teams toward operational safety and regulatory-grade documentation:

1. Human-vs-AI Transparency as a UX Norm. Expect universal AI disclosure patterns (badges, first-message notices, periodic reminders for minors) to become standard across markets. The Verge
2. Built-in Crisis Response. Chatbot pipelines will need harm detection, escalation flows, and referrals to accredited resources, plus auditable metrics for annual reports (in CA) and post-market surveillance (in the EU). Governor of California+2The Verge+2
3. Role Integrity. Systems must avoid implied professional status (e.g., appearing as a clinician) without proper guardrails, disclaimers, or authorization. Governor of California
4. Documentation Discipline. EU compliance will reward teams that already maintain model cards, data lineage, risk assessments, and incident logs—artifacts now referenced by the Service Desk materials. Digital Strategy EU+1

Implications by Stakeholder

For governments and regulators

• California’s approach shows a “safety-first without blanket bans” template others may copy, focusing on disclosures, reporting, and targeted restrictions. In the EU, expect sectoral guidance and templates to roll out from the Service Desk, accelerating national-level enforcement readiness. AP News+1

For businesses and developers

• Product, policy, and engineering will converge: disclosure UX, age-aware flows, content-safety triggers, and regional reporting APIs become part of the core stack.
• U.S. multistate providers will likely standardize to California’s bar to reduce complexity, while EU-facing products should align early with the Service Desk’s risk-based controls. Latham & Watkins+1

For civil society and users

• More predictable transparency and clearer channels to crisis resources should improve user trust, particularly for youth-facing experiences. Watchdogs gain visibility via public reporting in California and more structured conformity evidence in the EU. The Verge+1

A Practical 90-Day Action Plan

1. Map exposure. Inventory all chat experiences (web, app, SMS, embedded) and tag those that could be construed as “companion” or youth-accessible.
2. Implement disclosures. Add conspicuous “This is AI” notices at conversation start, re-surface on return sessions, and display break reminders for minors every few hours. The Verge
3. Stand up crisis response. Ship a self-harm detection classifier + human-in-the-loop escalation; log interventions; prepare 2026 annual report fields (counts, response times, referral stats) for California. The Verge+1
4. Prevent misrepresentation. Remove medical titles/avatars; add explicit non-clinician disclaimers; route to licensed providers where applicable. Governor of California
5. EU alignment. Use the AI Act Service Desk to run an initial risk assessment, identify conformity tasks (technical documentation, data governance, monitoring), and assign owners/timelines. Digital Strategy EU+1
6. Governance artifacts. Create or update: model cards, eval reports, data provenance notes, incident/Escalation runbooks, and a vendor assessment matrix for third-party models. Digital Strategy EU