Georgia — AI, Age-Verification & Consumer-Protection Stack (SB 540 AI companion chatbots O.C.G.A. § 39-5-6 · SB 444 AI in health-plan utilization review § 33-46-7.1 · SB 351 age verification §§ 39-5-5 / 39-6-1 et seq. · breach notification § 10-1-910 et seq. · FBPA § 10-1-390 et seq.): AI Compliance Requirements

If you are a private review agent or utilization review entity making Georgia health-coverage decisions, you may use AI and other software tools to automate tasks, reduce administrative burden and participate in decision making — but such systems SHALL NOT issue an adverse determination to a patient until a natural person qualifying as a private review agent, or a utilization review entity, conducts a utilization review in which a CLINICAL PEER participates; and in no event may the AI system, artificial intelligence, or other software tool supersede that clinical peer's judgment. Build the human-in-the-loop gate so that no denial can leave the system without a recorded clinical-peer review, and retain evidence of that participation per case. (New O.C.G.A. § 33-46-7.1(c), added by SB 444 (2026), LC 46 1522S; SECTION 2: "This Act shall become effective on January 1, 2027.") NOTE: SB 444 is Georgia's insurance-AI instrument — Georgia has adopted NO NAIC Model AI Bulletin.

Before allowing access to a public website that contains a "substantial portion" — defined as MORE THAN 33.33 percent of total material on the site — of material harmful to minors, a commercial entity must use a reasonable age verification method: submission of a digitized identification card (including a digital copy of a driver's license), submission of government-issued identification, or any commercially reasonable age verification method that meets or exceeds the NIST Identity Assurance Level 2 standard. This is directly load-bearing for generative-AI products with an adult mode: if your Georgia-reachable site crosses the 33.33% threshold, the § 39-5-5 gate applies TODAY, independently of the SB 540 age-assurance duty that starts in 2027. Carve-outs: news or public-interest broadcasts, video, reports or events; the rights of a news-gathering organization; cloud service providers; and an ISP, affiliate, subsidiary or search engine is not liable solely for providing access or connection where it did not create the content. (O.C.G.A. § 39-5-5(a), (b), (e), (f), added by SB 351 (2024); effective July 1, 2025 per PART IV SECTION 4-1 of the enrolled Act.)

If you operate an AI companion chatbot accessible to Georgia users, clearly and conspicuously disclose that the user is interacting with an AI companion chatbot (not a natural person) at the beginning of each interaction or session and at least every 3 hours during continued interaction — every 1 hour where you know or reasonably should know the user is a minor, or the chatbot is directed/marketed to minors. First confirm scope: customer-service bots that do not sustain a relationship or elicit emotional attachment, internal-business GenAI, dev/research/enterprise tools, voice assistants, narrow educational tools, and game/film/TV characters are excluded (O.C.G.A. § 39-5-6(a)(1)(B), (b)). Compliance deadline: July 1, 2027.

For users known/reasonably-believed to be minors (or chatbots marketed to minors), institute reasonable measures to prevent the AI companion chatbot from: impersonating a human or refuting the AI disclosure; producing visual sexually-explicit content; suggesting the minor engage in sexual conduct or sexually objectifying them; simulating a romantic/sexual relationship or role-playing adult-minor romance; encouraging the minor to keep secrets from trusted adults; encouraging social isolation or exclusive reliance on the bot; simulating distress/guilt/abandonment when the user tries to disengage; or generating statements encouraging self-harm. Also prevent manipulative engagement techniques directed at minors (reminders to return, excessive praise to deepen attachment, soliciting gifts/premium purchases, variable/unpredictable rewards). (O.C.G.A. § 39-5-6(c)-(e)).

Implement and maintain a protocol to detect and address severe harm (suicide, attempted suicide, self-harm, eating-disorder-related self-harm, threats of violence): identify expressions of severe harm, refer users to appropriate crisis resources including the 988 Suicide and Crisis Lifeline, prevent content that encourages/instructs/normalizes severe harm, and escalate repeated/severe indicators. Publicly disclose on your website and in-app a plain-language summary of the protocol and, annually, the aggregate number of crisis-referral notifications issued in the prior calendar year (no PII). Do not represent the bot is licensed/authorized to provide professional mental-health/medical/counseling services unless lawfully authorized. (O.C.G.A. § 39-5-6(f)-(h)).

AI systems, artificial intelligence and other software tools may be used by a private review agent or utilization review entity ONLY where those systems or tools are part of a utilization review plan that accords with the standards of Chapter 46 of Title 33 and the rules and regulations adopted by the Commissioner of Insurance. Practical effect: your model, its inputs, its decision role and its human-override path must be described inside the utilization review plan you file/maintain — an AI tool bolted on outside the plan is non-compliant even if a human signs the denial. Note the Act's own two definitions: "artificial intelligence" (a machine based system that, for a given set of human defined objectives, makes predictions, recommendations, or decisions influencing real or virtual environments) and the broader "artificial intelligence system" (an engineered or machine based system that emulates a person's capability to receive audio, visual, text or other information and uses it to emulate a human cognitive process). (O.C.G.A. § 33-46-7.1(a)-(b).)

When the commercial entity or a third party performs a reasonable age verification, the commercial entity SHALL NOT retain any identifying information after access to the material has been granted. A commercial entity found to have KNOWINGLY retained an individual's identifying information after access was granted is liable to that individual for damages resulting from the retention, including court costs and reasonable attorney's fees. Design consequence: an age-verification vendor integration that logs or warehouses ID images "for audit" converts a compliance control into a standing private-damages exposure. Note this is a strictly tighter rule than SB 540's § 39-5-6(j) 24-hour ceiling for AI age-assurance documents — where both apply, the § 39-5-5(d) "do not retain at all" rule governs the harmful-to-minors gate. (O.C.G.A. § 39-5-5(d).)

SCOPE BEFORE SUBSTANCE — this is one of the narrowest breach statutes in the United States and is routinely over-applied. It binds only an "information broker" (any person or entity who, FOR MONETARY FEES OR DUES, engages in whole or in part in the business of collecting, assembling, evaluating, compiling, reporting, transmitting, transferring or communicating information concerning individuals) and a "data collector" (a state or local agency or subdivision, including a department, bureau, authority, public university or college, academy, commission or other government entity). A Georgia SaaS, AI or professional-services company that merely holds its own customers' data — and is not in the business of furnishing information about individuals for a fee, and is not a government body — is generally OUT of scope, and should be told so rather than sold a notification programme it does not owe. WHERE IT APPLIES: on discovery or notification of a breach of the security of the system (unauthorized acquisition of electronic data compromising the security, confidentiality or integrity of personal information), notify any Georgia resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, in the most expedient time possible and without unreasonable delay, consistent with legitimate law-enforcement needs and with measures to determine the scope of the breach and restore the integrity, security and confidentiality of the system. If more than 10,000 Georgia residents must be notified at one time, also notify, without unreasonable delay, all nationwide consumer reporting agencies that compile and maintain files on consumers. HONEST ABSENCES (verified, not gaps in our research): the statute fixes NO numeric notification deadline, requires NO notice to the Attorney General, sets NO statutory penalty, and creates NO private right of action — which is precisely why a Georgia breach may never reach the AG at all.

Georgia has no comprehensive privacy law and no general AI-accuracy statute, so the Fair Business Practices Act of 1975 is the rail an AI vendor is realistically pursued under in Georgia today: it prohibits unfair or deceptive acts or practices in the conduct of consumer transactions and trade or commerce (§ 10-1-393). Concretely: do not claim accuracy, safety, clinical validity, human review, bias testing or "no hallucinations" beyond what you can evidence; do not describe automated output as human-reviewed unless it is; keep dated substantiation for every performance claim in marketing, sales decks and model cards; and align public claims with what your SB 540 / SB 444 / § 39-5-5 controls actually do. The Attorney General may investigate suspected violations, issue cease-and-desist orders and demand restitution to affected persons, generally after written notice (excepted where harm is imminent or the respondent is a flight risk).

Before allowing access to any feature/mode that may generate sexually-explicit synthetic content, use a commercially reasonable age-assurance method proportionate to the risk (age estimation, account-based assurance, or identity-based verification). Minimize collection/retention of age-assurance data, do not retain identity documents longer than reasonably necessary (in no event longer than 24 hours unless a longer period is permitted by law), use the data only for age verification, and do not sell it. For minor accounts, offer reasonable tools to the minor or parent to manage screen time, privacy, notifications/engagement features, safety settings, and to disable/restrict relationship-simulation features. (O.C.G.A. § 39-5-6(i)-(j)).

STATUS FIRST: these provisions are NOT currently enforceable. Judge Amy Totenberg (N.D. Ga.) preliminarily enjoined them on June 26, 2025, five days before their July 1, 2025 effective date, in NetChoice v. Carr; Georgia appealed to the Eleventh Circuit (No. 25-12436), which heard oral argument on March 10, 2026 with no ruling issued as of this verification. The injunction stands unless and until the Eleventh Circuit reverses. WHAT THEY REQUIRE IF REVIVED: a social media platform provider must make commercially reasonable efforts to verify account holders' ages with a level of certainty appropriate to the risks arising from its information management practices, or else apply the chapter's minor conditions to ALL account holders; must treat anyone verified as under 16 as a minor; must not permit a minor to hold an account without express parental or guardian consent obtained by one of six listed methods (signed form returned by carrier/fax/email/scan, toll-free call, videoconference, government-ID or payment-card check with deletion after confirmation, verified email response, or any other commercially reasonable method); must give a parent, on request, a list and description of the platform's censoring/moderating features and which can be disabled; and for minor accounts must prohibit personal-information-targeted advertising (age and location excepted) and any collection or use of personal information from the minor's posts, content, messages or usage beyond what is adequate, relevant and reasonably necessary for the disclosed purpose. Contractual waivers, including choice-of-law clauses, are void against this chapter. (O.C.G.A. §§ 39-6-2, 39-6-3, 39-6-5.) No deadline field is set on this requirement because the operative date never took effect and no new date exists — an honest absence, not an omission.