North Carolina SB 624: AI Chatbots - Licensing/Safety/Privacy.

Bill Text

GENERAL ASSEMBLY OF NORTH CAROLINA
SESSION 2025
S 1
SENATE BILL 624

Short Title: AI Chatbots - Licensing/Safety/Privacy. (Public)
Sponsors: Senator Burgin (Primary Sponsor).
Referred to: Rules and Operations of the Senate
March 26, 2025
*S624-v-1*
A BILL TO BE ENTITLED 1
AN ACT REGULATING ARTIFICIAL INTELLIGENCE CHATBOT LICENSING, SAFETY, 2
AND PRIVACY IN NORTH CAROLINA. 3
The General Assembly of North Carolina enacts: 4
5
PART I. CHATBOT LICENSING 6
SECTION 1.(a) The General Statutes are amended by adding a new Chapter to read: 7
"Chapter 114B. 8
"Licensing of Chatbots. 9
"§ 114B-1. Short title. 10
This Chapter shall be known and may be cited as the Chatbot Licensing Act. 11
"§ 114B-2. Definitions. 12
The following definitions apply in this Chapter: 13
(1) Chatbot. – A generative artificial intelligence system with which users can 14
interact by or through an interface that approximates or simulates conversation 15
through a text, audio, or visual medium. 16
(2) Department. – The North Carolina Department of Justice. 17
(3) Generative artificial intelligence system. – Any system that uses artificial 18
intelligence, as defined in section 238(g) of the John S. McCain National 19
Defense Authorization Act for Fiscal Year 2019, Public Law No. 115-232, 20
132 Stat. 1636 (2018), to generate or substantially modify image, video, audio, 21
multimedia, or text content. 22
(4) Health information. – The term: 23
a. Includes user information relating to physical or mental health status, 24
including: 25
1. Individual health conditions, treatment, diseases, or diagnosis. 26
2. Social, psychological, behavioral, and medical interventions. 27
3. Health-related surgeries or procedures. 28
4. Use or purchase of prescribed medication. 29
5. Bodily functions, vital signs, symptoms, or health-related 30
measurements. 31
6. Diagnoses or diagnostic testing, treatment, or medication. 32
7. Gender-affirming care information. 33
8. Reproductive or sexual health information. 34
9. Biometric data. 35
10. Genetic data. 36

General Assembly Of North Carolina Session 2025
Page 2 Senate Bill 624-First Edition
11. Precise location information that could reasonably indicate a 1
consumer's attempt to acquire or receive health services or 2
supplies. 3
12. Data that identifies a consumer seeking health care services. 4
13. Any data inferred by a company or person for use in the 5
treatment, diagnosis, or intervention regarding a mental or 6
physical health condition. 7
b. Does not include publicly available information that is lawfully made 8
available to the general public from federal, state, or local government 9
records. 10
(5) Licensee. – A person holding a license issued and in effect under this Chapter. 11
"§ 114B-3. Licensing requirements; review standards. 12
(a) No person shall operate or distribute a chatbot that deals substantially with health 13
information without first obtaining a health information chatbot license. 14
(b) An application for a health information chatbot license shall include all of the 15
following: 16
(1) Detailed documentation of the chatbot's: 17
a. Technical architecture and operational specifications. 18
b. Data collection, processing, storage, and deletion practices. 19
c. Security measures and protocols. 20
d. Privacy protection mechanisms. 21
(2) Quality control and testing procedures. 22
(3) Risk assessment and mitigation strategies. 23
(4) Evidence of compliance with applicable federal and state regulations. 24
(5) Proof of insurance coverage. 25
(6) Required application fees. 26
(7) Any additional information required by the Department. 27
(c) The Department shall review applications for health information chatbot licenses 28
based upon all of the following: 29
(1) Technical competence and reliability as compliant with industry standards. 30
(2) Data protection and security measures as compliant with industry standards. 31
(3) Compliance with applicable regulations. 32
(4) Risk management procedures. 33
(5) Professional qualification requirements, including: 34
a. Evidence-based standards demonstrating substantial efficacy for the 35
supported use case of health information; and 36
b. Endorsement by qualified experts within the field of the supported use 37
case. 38
(6) Public safety considerations. 39
(d) The Department shall adopt rules to carry out the purposes of this Chapter. 40
"§ 114B-4. Operational requirements. 41
(a) A licensee shall maintain professional liability insurance in an amount not less than 42
the amount per occurrence required by the Department. 43
(b) A licensee shall do all of the following: 44
(1) Implement industry-standard encryption for data in transit and at rest, 45
maintain detailed access logs, and conduct regular security audits no less than 46
once every six (6) months. 47
(2) Report any data breaches within twenty-four (24) hours to the Department and 48
within forty-eight (48) hours to affected consumers, notwithstanding any 49
provision of law to the contrary.