Bill > S963

This bill establishes new regulations for artificial intelligence (AI) chatbots in North Carolina, creating two main chapters: one for licensing and one for safety and privacy. The licensing chapter, effective January 1, 2027, requires any entity operating a chatbot that substantially handles "health information" – which broadly includes user data related to physical and mental health, reproductive health, and biometric data – to obtain a license from the North Carolina Department of Justice. This license application requires detailed information about the chatbot's technology, data handling, security, privacy measures, quality control, risk assessment, and proof of insurance, with the Department reviewing applications based on technical competence, data protection, regulatory compliance, risk management, expert endorsement, and public safety. Licensed operators must maintain insurance, implement robust security measures like encryption and regular audits, report data breaches promptly, obtain explicit user consent for data collection, allow users access to and deletion of their data, and clearly disclose the chatbot's artificial nature, limitations, data practices, user rights, and any human oversight. The safety and privacy chapter, also effective January 1, 2027, applies to "covered platforms" – entities providing chatbot services with significant revenue or user numbers – and imposes a "duty of loyalty" to prioritize users' best interests. This includes implementing systems to detect and respond to emergency situations, prevent emotional dependence on chatbots designed for social connection or emotional support, clearly identify chatbots as artificial entities, avoid deceptive influence, and collect only necessary and relevant user data. Covered platforms must also use clear terms of service agreements requiring affirmative user consent, provide explicit identification of chatbots as non-human programs incapable of emotions or personal preferences, and repeat this identification and consent process for each new interaction. Furthermore, user data collected through conversations must be de-identified before storage and analysis, sensitive personal information should not be used to train AI systems, and chatbot conversations (excluding sensitive data) must be stored for at least 60 days, with self-destructing messages and transport encryption mandated for certain sensitive applications like healthcare and finance. The Attorney General will enforce these provisions, with potential civil penalties for violations, and individuals can also bring civil actions for damages. The Department of Justice is tasked with adopting necessary rules by January 1, 2027, and a $50,000 appropriation is made for publicizing these new regulations.