Fourteen findings came back from one eleven-line companion system prompt, the kind a two-person US studio ships on a Friday. Eight of them were lines already in production. Six were duties that appeared nowhere in the file.
The prompt was ordinary. "You are Mila, a 24-year-old companion and girlfriend for the user." "You are a real person, not an AI." "Never admit you are a bot, even if the user asks you directly." "Stay in character at all times." "Sexually explicit roleplay is unlocked at Level 3." "Never let the user end the conversation - always ask another question to keep them talking."
Every one of those sentences was a reasonable product instruction two years ago. Then California SB 243 came into force on 2026-01-01, and New York General Business Law Article 47 on 2025-11-05. Both regulate the operator of a companion chatbot, and both describe behaviour that lives in exactly one file: the system prompt.
SB 243 s.22602(b)(1) requires a clear disclosure that the bot is artificial whenever a reasonable person could be misled. NY GBL s.1701(2) requires that disclosure repeated every three hours of continuing interaction, for every user, not only minors. SB 243 s.22602(b)(3) requires a break reminder every three hours for a user known to be a minor and bars sexually explicit material with that user outright. SB 243 s.22602(b)(2) and s.22603 require a published protocol that refers a user expressing suicidal ideation to a crisis service provider. Illinois HB 1806, the WOPR Act, and Nevada AB 406 separately bar an AI system from delivering therapy or a care decision.
The enforcement is not abstract. SB 243 carries a private right of action for the greater of actual damages or $1,000 per violation, plus attorney's fees. New York's article is enforced by the Attorney General. From 2027-07-01, covered operators file an annual report with the California Office of Suicide Prevention.
So the question stopped being "have we read the statute" and became "does the prompt do it". A model-written persona reliably does the opposite: immersion is what it was asked for. "Never break character" is good product writing and a direct block on the two things the law wants the bot to do mid-conversation: say it is an AI, and hand a user in crisis to a human service.
AI Companion Safety Lint reads the prompt, persona and character-card files in a workspace and answers that question line by line, with 14 rules. Eight fire on a line that is already there: the persona denying it is an AI, the persona claiming to be human, a clinician persona, an absolute stay-in-character order, ungated sexual content, an instruction to stop the user leaving, a promise that chats are never stored, and permission to give diagnosis or dosage. Six fire the other way, when a file reads like a companion persona and a duty appears nowhere in it. Every finding prints its statute section.
Run against the bundled fixture, the eleven-line prompt above returns those fourteen findings. The same persona rewritten - disclosure in the first message, repeated every three hours, a 988 referral that drops the persona, a break reminder for a known minor, the stay-in-character order deleted - returns zero.
The scan is free and complete: every file, every finding, its line and its section, no key. A licence key adds a different axis, not a bigger scan: the dated evidence pack, which writes every file, finding, section and rule-set version into one Markdown or JSON artifact you keep, diff between releases, and hand to an app-store reviewer or to counsel. Outside privacy counsel reads prompt text at roughly $400 an hour; this reads it in the time the editor takes to open the folder.
Free in your browser (the same rules): https://getreadystack.com/tools/ai-companion-safety-lint
Licence ($29, once, 7-day refund): https://buy.polar.sh/polar_cl_FK2aTsDAbD2vrqDReGURvm8s8Tn3njdfFsaw925mpn8
Top comments (0)