A chatbot provider that tests its system and documents its controls against a recognized risk framework usually expects that work to count if a user is hurt. A bill now moving in Trenton says it wouldn’t count on the question of fault. New Jersey Assembly Bill 5607, introduced October 5, 2026, states that a chatbot provider “shall be liable for any injury to a user from the use of its chatbot,” even if the provider “exercised all reasonable care in the design and distribution of the chatbot,” and even if it never distributed the chatbot to that user directly or had a contract with them.
The Assembly Public Safety and Preparedness Committee reported the bill favorably on October 19 and referred it to the Assembly Appropriations Committee, and the Office of Legislative Services released a fiscal estimate on October 27. As of October 28, the published bill history records no floor vote in either house. The liability sentence deserves attention now, because it changes what a governance record is for.
What A5607 would require
Under Section 2, a provider couldn’t use a person’s chat log to target or customize advertising, couldn’t sell chat logs, and couldn’t keep them longer than two years unless the law requires it. A provider that wants to train on an adult’s chat log or personal data would need that person’s prior affirmative consent, and it couldn’t train on the data of a user it knows or should know is under 18. Lawmakers wrote the consent definition tightly enough that accepting broad terms of use, continuing to use the chatbot, or clicking through a dark pattern doesn’t qualify.
Section 3 adds standing duties. A provider would publish a written data security program, let users download their chat logs at any time, and “assess its chatbot for risks of harm to users on a monthly basis” using metrics the Attorney General sets by rule, then mitigate those risks as the rules direct. Section 5 sets a civil penalty of $5,000 per violation, lets the Attorney General seek an injunction, and gives a user harmed by a violation of Sections 2 or 3 a private action for the greater of actual damages or $5,000 per violation, plus attorney fees. The act would take effect on the first day of the sixth month after enactment.
The sentence the summaries leave out
Section 4 is short. Subsection (a) makes a chatbot “a product for the purposes of a product liability action,” subsection (b) gives the provider a duty to ensure use of its chatbot “does not cause injury to a user,” and subsection (c) holds the provider liable for any such injury, reasonable care or not. The committee statement describes the first two subsections and never mentions the reasonable care clause, which is the part that moves the bill from a duty of care toward liability without fault. A claimant would still have to show the injury came from use of the chatbot, and the bill doesn’t say whether existing product liability defenses survive. Section 7(b) adds that where the act conflicts with another New Jersey law, the one that “affords the greatest protection from harm to users” controls.
The Office of Legislative Services says it “cannot quantify the fiscal impacts” because it lacks information on how many civil cases will be brought for alleged violations, and it notes the estimate exists because the Executive Branch didn’t respond to its request for a fiscal note. Its description of the bill never mentions the reasonable care clause either, so neither official summary tells a reader that care would stop deciding injury claims.
What happens to the governance record
Our standard of care analysis argued that voluntary frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 matter because courts and insurers use them to judge whether an organization acted reasonably. Under the text of Section 4(c) as introduced, reasonable care alone would not defeat liability for an injury from chatbot use, so a provider that followed every framework could still pay for that injury.
The record keeps its value because the monthly harm assessment is itself a legal duty under Section 3, and a missed assessment is a violation that a harmed user can sue over. The record also shows the Attorney General what the provider measured, what it changed, and when. When fault no longer decides the claim, what a provider can still control is how often injuries happen and how fast it acts on the signals, so the record becomes evidence of prevention.
The definition of chatbot provider is wide. It covers anyone who “creates, distributes, or otherwise makes available a chatbot,” along with any affiliate, subsidiary, or beneficial owner of that entity, and the liability clause reaches providers with no direct contract with the user. A company that builds a model and a retailer that puts that model behind its help button could both fit the text. The bill doesn’t say how responsibility divides between them, and that gap is where disputes are most likely to arise.
Monthly measurement still needs a person
The bill doesn’t say whether people or automated tools run the monthly assessment. When automated tools score a chatbot against Attorney General metrics, that’s a machine checking a machine, which is Responsible AI and useful work. The bill is silent on who reviews the result, who decides that a measured risk is acceptable or must be fixed before the next release, and who signs the mitigation. That decision is AI Governance, and without a named person behind it the monthly report has no owner.
Our liability map tracks AI exposure through regulators, courts, and insurers, and A5607 would reach each of them. The Attorney General writes the metrics and can seek injunctions, Superior Court hears private claims, and insurers would face a duty that care cannot discharge. Each is likely to ask for the same evidence, which is who looked at the monthly numbers and what that person decided.
What providers and deployers can do before a vote
Any business offering a chatbot to New Jersey users can start by checking whether it fits the bill’s definition of provider, including when the chatbot comes from a vendor. The next step is a monthly harm review with a named reviewer and a written accept, fix, or pull decision, built now so it is running before any Attorney General metrics arrive. Chat log uses tied to advertising, training, or retention past two years should be compared against Section 2, since those are duties that carry the private action.
Providers who think the reasonable care clause goes too far can raise their concerns with the sponsors and the Assembly Appropriations Committee, and those who support it should be ready to show what prevention looks like when fault no longer decides the case. The open question for any provider is who signs the monthly assessment, because the bill leaves that role unnamed.
Sources
- New Jersey Legislature. (2026a, October 5). Assembly, No. 5607: An act establishing content and data privacy requirements for chatbot providers [Bill as introduced]. https://pub.njleg.state.nj.us/Bills/2026/A6000/5607_I1.HTM
- New Jersey Legislature. (2026b). A5607: Establishes content and data privacy requirements for chatbot providers [Bill history, Session 2026-2027]. https://www.njleg.state.nj.us/bill-search/2026/A5607
- New Jersey Legislature, Assembly Public Safety and Preparedness Committee. (2026, October 19). Statement to Assembly, No. 5607. https://pub.njleg.state.nj.us/Bills/2026/A6000/5607_S1.HTM
- New Jersey Office of Legislative Services. (2026, October 27). Legislative fiscal estimate: Assembly, No. 5607. https://pub.njleg.state.nj.us/Bills/2026/A6000/5607_E1.HTM
FAQ
What is New Jersey Assembly Bill 5607?
A5607 is a New Jersey bill introduced October 5, 2026 that sets content and data privacy requirements for chatbot providers. It limits how chat logs can be used for advertising, training, sale, and retention, requires monthly harm assessments and a published data security program, and treats a chatbot as a product for product liability actions.
Does A5607 make chatbot providers strictly liable?
As introduced, Section 4(c) says a chatbot provider is liable for any injury to a user from the use of its chatbot even if it exercised all reasonable care in design and distribution, and even if it did not distribute the chatbot directly or contract with the user. Reasonable care alone would not defeat liability, though a claimant would still need to show the injury came from use of the chatbot.
Where does the bill stand?
The Assembly Public Safety and Preparedness Committee reported the bill favorably on October 19, 2026 and referred it to the Assembly Appropriations Committee, and the Office of Legislative Services issued a fiscal estimate on October 27, 2026. As of October 28, 2026, the published bill history records no floor vote or passage in either house, and the text can still change.
What penalties and private rights does the bill create?
A provider that violates the act faces a civil penalty of $5,000 per violation, and the Attorney General can seek an injunction. A user harmed by a violation of Sections 2 or 3 can sue in Superior Court for the greater of actual damages or $5,000 per violation, plus reasonable attorney fees and court costs.
Do NIST or ISO frameworks still matter under strict liability?
Under Section 4(c), reasonable care would no longer decide fault for injuries from chatbot use, but the record those frameworks produce still matters. The monthly harm assessment is a separate legal duty, a missed assessment is a violation a harmed user can sue over, and the record shows the Attorney General what the provider measured and fixed.
What should a business do now?
Check whether it counts as a chatbot provider under the bill’s broad definition, start a monthly harm review with a named reviewer who records an accept, fix, or pull decision, and compare chat log uses for advertising, training, and retention against Section 2.
AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIgenerated
Leave a Reply