Oregon Just Passed the Country’s Toughest Chatbot Law. Your Company May Already Be Breaking It.  

Oregon’s Senate Bill 1546, which cleared both chambers on March 5 with near-unanimous support, is being called the first chatbot law with real enforcement power. That’s the assessment of lawyers at Baker Botts, a global law firm that has been closely tracking the wave of AI legislation sweeping U.S. statehouses. The firm warns that the law’s reach is wider than many companies realize and that the clock is already ticking.

The law, which is awaiting the governor’s signature, targets what it calls AI companions. software systems that remember past conversations, ask unprompted personal questions and build ongoing relationships with users. Think of the hospital chatbot that checks in on patients between appointments, or the HR tool that asks new employees how they’re settling in.

According to Baker Botts, even companies that did not build these tools themselves may be on the hook simply because they deployed them.

“The companies most likely caught off guard are not AI vendors,” the firm states in a recent advisory, “they are enterprises that integrated AI tools into customer-facing or employee-facing workflows without tracking how those tools evolved.”

The law requires operators to clearly disclose that a person is talking to an AI. They must also detect when a user expresses thoughts of suicide and immediately interrupt the conversation to provide crisis resources. In addition, they must file annual reports with the Oregon Health Authority.

For minors, the rules are stricter. Operators must remind users every hour that they are talking to an AI, keep the conversation free of sexually explicit content, and avoid any tactics designed to make the child emotionally dependent on the chatbot.

Related: NY Bill Would Bar AI Chatbots From Providing ‘Substantive’ Medical or Legal Responses

The stakes are high. The law allows any user who is harmed by a violation to sue for $1,000 per violation. Baker Botts points out that Oregon’s law never defines exactly what counts as a single violation. If every message in a conversation counts as one, a single user’s claim could run into the tens of thousands of dollars. A class action lawsuit could reach tens of millions.

The comparison to Illinois’ Biometric Information Privacy Act, known as BIPA, is hard to avoid. That law, which gave individuals the right to sue over biometric data violations, produced thousands of lawsuits and billions in settlements. Oregon’s law follows the same playbook.

Baker Botts says Oregon should be seen as a preview, not an outlier. The firm is tracking 78 chatbot-related bills across 27 states in 2026 alone. As those bills advance, companies face a fundamental choice: get their AI deployments in order now, or risk being caught flat-footed when similar laws land in their home states.

The firm advises companies to audit every AI tool they use in customer service, healthcare, HR and financial planning to see if it meets Oregon’s three-part definition of an AI companion. They should also review vendor contracts. Most agreements signed before this law was passed say nothing about crisis detection or conversation interruption requirements. And they should check their insurance to see whether chatbot-related lawsuits are covered.

The law awaits Governor Tina Kotek’s signature. If she signs it, companies have until the end of 2026 to comply. That may sound like plenty of time. Given the scope of what is required, Baker Botts suggests it isn’t.