On this page
Requirements mapCurrent scheduleIntended purposeData flowsOpen review questionsRegional mapUS · CaliforniaUS · New YorkUS · Utah: mental-health chatbotsUS · Utah: generated-media provenanceUS · IllinoisUS · TexasUS · Federal health software and dataUnited KingdomAustraliaChinaSouth KoreaCanadaJurisdiction decisionsChecked · 5 October 2026
Legal and data boundaries
A growing regional research map for AI, privacy and health-related product decisions.
Practical takeaways
- Start with function, service role, audience and target markets; selected US state rules differ from federal requirements.
- Distinguish enacted and scheduled law from policy and guidance, then map disclosure, privacy, health and export triggers.
- Review the actual product with appropriate legal expertise; this map is not a compliance certification.
Applicability depends on function, intended purpose, audience, provider role and actual data flows. The interaction implications below are design deductions, not a legal assessment of any particular product.
EU and Germany: from requirement to design consequence
| Area | Trigger or requirement | Proposed design consequence | Primary source |
|---|---|---|---|
| Sensitive personal data | Religion and health may be special-category data. An Article 6 basis and an appropriate Article 9 exception are separate requirements. | Separate purposes for conversation, memory, training and sharing. Make any consent specific and withdrawal usable. | Process personal data lawfully |
| AI transparency | Article 50 includes direct-interaction transparency unless the AI nature is obvious, with duties depending on role and content. | Identify the AI role by the relevant first interaction or exposure; distinguish generated output from Scripture and human services. | AI Act Article 50 |
| Prohibited AI practices | Article 5 addresses specified manipulation and exploitation subject to statutory conditions, including relevant harm thresholds. | Review fear-based nudges, vulnerable audiences and monetisation; do not treat all reminders as prohibited. | AI Act Article 5 |
| Medical software qualification | Intended medical purpose, functions and promotional claims matter to qualification and classification. | Align claims and behaviour; a disclaimer does not override contradictory medical functionality. | Guidance on software qualification and classification MDR and IVDR |
| High-risk AI classification | Article 6 has specific classification conditions, including regulated-product and conformity-assessment requirements. | Assess each function and deployment context; mental health content alone does not establish high-risk status. | AI Act Article 6 |
| Professional representation | German law protects psychotherapeutic titles and regulates relevant professional practice. | Do not represent an AI persona as a licensed psychotherapist. Assess human services and medical-practice permissions separately. | Psychotherapeutengesetz Section 1 |
| Health-related advertising | HWG applies to advertising in its statutory scope and restricts misleading claims. | Avoid guaranteed healing and unsupported clinical-effectiveness statements. | Heilmittelwerbegesetz |
| Accessibility | BFSG covers specified products and services, including relevant e-books and e-commerce. | Check scope and exemptions; design accessible reading, notes, audio and purchase flows. | Barrierefreiheitsstärkungsgesetz Section 1 |
Check the current implementation schedule
The Commission’s current consolidated Article 113 text gives a general application date of 2 August 2026. It lists later application of Chapter III Sections 1–3, except Article 6(5), for specified high-risk systems: 2 December 2027 under Article 6(2) and Annex III, and 2 August 2028 under Article 6(1) and Annex I. These are not blanket extensions of all AI duties. Check the current text for the actual function and role before launch.
Purpose is expressed by the whole product
A faith or wellness label does not decide classification by itself. Assess what the software actually does, what the organisation markets and what users are led to expect. Symptom diagnosis, treatment recommendations and clinical outcome claims need their own analysis. Spiritual support and clinical care have different responsibilities.
Turn data choices into actual controls
Map collected text and audio, inferred data, source retrieval, memory, training use, logs, human access and third-party transfers. A private-looking interface must match the data flow. Define minimisation, retention, deletion, access, processors and international transfers. Assess whether a data protection impact assessment is required.
Open review questions
- Children’s access, consent, safeguarding and age-appropriate support.
- Specific medical-practice questions, including the German Heilpraktikergesetz.
- Device qualification, conformity assessment and provider or deployer responsibilities.
- How deletion and withdrawal affect derived profiles, backups and audit records.
- Accessibility scope and possible exemptions for the precise service.
- Other target jurisdictions and their health, privacy and consumer rules. HIPAA is not a general law for every faith app.
This is a scoped research map, not a completed compliance matrix or a certification. Keep source dates and product assumptions with each assessment.
Regional research map
Selected markets reviewed on 5 October 2026. Coverage grows as primary sources are checked. Enacted law, scheduled duties, policy and regulator guidance are labelled separately; absence from this map does not mean absence of applicable law. The US entries are selected federal and state examples, not a fifty-state survey.
| Market | Evidence status | Start with this question |
|---|---|---|
| US · California | Enacted AI-specific law | Assess whether a spiritual companion persona falls within the definition. Design age-appropriate reminders and verified support routes as service capabilities, with a published protocol. |
| US · New York | Enacted AI-specific law | Separate onboarding from recurring session disclosure. Maintain a support-route and incident-handling design rather than relying on a friendly persona. |
| US · Utah: mental-health chatbots | Enacted AI-specific law | Review positioning and actual conversational behaviour together. Model absence and return as disclosure states; map model-provider and analytics transfers separately from interface privacy settings. |
| US · Utah: generated-media provenance | Enacted; relevant duties scheduled for 2027 | Plan export metadata and supplier compatibility for synthetic audio and media. A visible “AI-generated” badge alone does not establish fulfilment of latent-disclosure duties. |
| US · Illinois | Enacted AI-specific therapy restrictions | Keep pastoral support, public education and clinical treatment roles explicit. Do not assume an autonomous faith-branded chatbot qualifies as a human religious leader or exempt counseling service. |
| US · Texas | Enacted AI-specific law; effective 1 January 2026 | For health-service integrations, place disclosure before or by first service provision, with the statutory emergency timing exception. Review harmful response objectives as well as screens. |
| US · Federal health software and data | Existing law; regulator implementation guidance | If adding symptom tracking or treatment functionality, reassess data-product coverage and medical intended use. Plan usable incident notices where covered. |
| United Kingdom | Existing law + regulator guidance; policy statement | Review personal prayer/health data and third-party AI processing under the applicable data rules. Match health claims, instructions and functions to a defined intended purpose. |
| Australia | Existing law + regulator guidance; national policy | Assess privacy coverage, sensitive inputs and model-supplier handling. Reassess an interactive devotional if new diagnostic or treatment functionality changes its purpose. |
| China | Binding AI-content labelling measures; effective 1 September 2025 | Design origin information across text, synthetic narration, video, exports and receiving platforms. Assess the service role before selecting UI-only or file-level mechanisms. |
| South Korea | AI Basic Act in force; announced enforcement grace period | Separate service-entry notice from output-origin display. Review synthetic audio and realistic media labels with age and modality in mind. |
| Canada | Existing privacy law + joint regulator principles | Record applicable federal/provincial coverage and assess consent, minimisation, transparency and accountability for intimate conversation and memory. |
US · California
Enacted AI-specific law · Reviewed 5 October 2026
Applicability trigger
SB 243 addresses operators of defined companion chatbots available to California users. Sustained anthropomorphic relationships matter; statutory exclusions include specified productivity and source-analysis tools.
What the source establishes
Covered services need suicide/self-harm protocols. Human-confusion disclosure and additional known-minor protections have different triggers. For known minors, continuing interactions include break and nonhuman reminders at least every three hours. Annual reporting begins 1 July 2027. California SB 243: companion chatbots
Concrete design deduction
Assess whether a spiritual companion persona falls within the definition. Design age-appropriate reminders and verified support routes as service capabilities, with a published protocol.
Review limits. The reviewed source is the enacted 2025 text. Recheck current codification and amendments before launch; the label “Bible assistant” does not establish an exclusion.
US · New York
Enacted AI-specific law · Reviewed 5 October 2026
Applicability trigger
General Business Law Article 47 covers defined AI companions, including sustained human-like relationship features; exclusions are specified in section 1700.
What the source establishes
Sections 1701–1702 address suicide/self-harm handling and crisis-service referrals, plus AI/nonhuman notices at interaction start (not required more than once daily) and at least every three hours of continuing interaction. New York General Business Law Article 47
Concrete design deduction
Separate onboarding from recurring session disclosure. Maintain a support-route and incident-handling design rather than relying on a friendly persona.
Review limits. The recurring notice applies to covered users generally; it should not be confused with California’s known-minor rule. Check definitions and current statutory revisions.
US · Utah: mental-health chatbots
Enacted AI-specific law · Reviewed 5 October 2026
Applicability trigger
Chapter 13-72a combines therapy-like conversation with supplier representation or reasonable user belief that the system provides therapy or manages/treats mental-health conditions. Scripted-only exercises and human-therapist connection-only tools have specified exclusions.
What the source establishes
AI/nonhuman disclosure is required before feature access, after seven days without access, and when asked. Section 201 restricts sale/sharing of identifiable health information and user input, with statutory exceptions. Utah Code 13-72a-101: mental-health chatbot definitions · Utah Code 13-72a-203: disclosure requirements · Utah Code 13-72a-201: personal-information protection
Concrete design deduction
Review positioning and actual conversational behaviour together. Model absence and return as disclosure states; map model-provider and analytics transfers separately from interface privacy settings.
Review limits. Official indexed statutory excerpts were reviewed; direct PDF retrieval was unreliable. Obtain the complete current chapter, including advertising rules and exceptions, for implementation.
Patterns to review in this market
- Ai involvement disclosure
- Choose help
- Ai placement
- Sensitive topics
- Contextual safety
- Suicide concerns
- Possible abuse
- Spiritual abuse
- Safeguarding handoff
- Safe support access
- Human connections
- Honest support
- Reassurance loops
- Health and spiritual practice
- Interactive reflection
- Sensitive memory
- Private sharing
- Voice and recording
- Annotation library
US · Utah: generated-media provenance
Enacted; relevant duties scheduled for 2027 · Reviewed 5 October 2026
Applicability trigger
Chapter 13-72c sets content-provenance requirements for defined covered providers; qualification and technical feasibility matter.
What the source establishes
Section 203 is marked effective 1 January 2027 and addresses latent disclosures in AI-created or substantially modified image, video and audio. Capture-device obligations have a separate 2028 production-date trigger. Utah Code Chapter 13-72c: content provenance
Concrete design deduction
Plan export metadata and supplier compatibility for synthetic audio and media. A visible “AI-generated” badge alone does not establish fulfilment of latent-disclosure duties.
Review limits. Reviewed official indexed chapter text. These are scheduled duties, not a claim that every app already owes them; check covered-provider definitions and standards.
US · Illinois
Enacted AI-specific therapy restrictions · Reviewed 5 October 2026
Applicability trigger
Public Act 104-0054 regulates therapy/psychotherapy and AI use by licensed professionals. Section 35 includes exceptions for defined religious counseling, peer support and specified public self-help/education.
What the source establishes
The religious-counseling definition concerns clergy, pastoral counselors or other religious leaders within religious duties, explicitly faith-based services, and no representation as clinical therapy. Illinois Public Act 104-0054: psychological resources
Concrete design deduction
Keep pastoral support, public education and clinical treatment roles explicit. Do not assume an autonomous faith-branded chatbot qualifies as a human religious leader or exempt counseling service.
Review limits. Official indexed enacted-text excerpts were reviewed; direct retrieval failed. Obtain the complete current law before relying on an exception or designing a professional service.
US · Texas
Enacted AI-specific law; effective 1 January 2026 · Reviewed 5 October 2026
Applicability trigger
HB 149 includes applicability to specified Texas business, services used by residents, and AI development/deployment. Duties differ by actor and use.
What the source establishes
Section 552.051 addresses government consumer interactions and AI used in defined licensed health-care services/treatment. Section 552.052 prohibits intentional encouragement of self-harm, harm to others or crime. Texas HB 149: Responsible AI Governance Act
Concrete design deduction
For health-service integrations, place disclosure before or by first service provision, with the statutory emergency timing exception. Review harmful response objectives as well as screens.
Review limits. The reviewed text does not create a universal disclosure rule for every private Bible chatbot. Definitions, other prohibitions and enforcement need separate assessment.
US · Federal health software and data
Existing law; regulator implementation guidance · Reviewed 5 October 2026
Applicability trigger
FTC health-breach rules and FDA device-software oversight concern defined entities/functions. They are separate from state companion-chatbot laws.
What the source establishes
The FTC explains coverage for specified non-HIPAA personal-health-record businesses and related entities. FDA oversight depends on software function and intended use, including exclusions and enforcement discretion. FTC: complying with the Health Breach Notification Rule · FDA: device software functions and mobile medical applications
Concrete design deduction
If adding symptom tracking or treatment functionality, reassess data-product coverage and medical intended use. Plan usable incident notices where covered.
Review limits. Neither health discussion nor a faith label settles qualification. HIPAA is not the universal privacy standard for all apps; this entry is not a complete federal or state privacy survey.
Patterns to review in this market
United Kingdom
Existing law + regulator guidance; policy statement · Reviewed 5 October 2026
Applicability trigger
A 21 September 2026 parliamentary answer describes sector-based regulation and possible further legislation. ICO AI guidance addresses data protection; MHRA guidance addresses medical software purpose.
What the source establishes
The policy answer is not a new AI statute. Existing data and sector obligations still need assessment. ICO flags its AI guidance for review following the Data (Use and Access) Act. UK Parliament: AI regulatory frameworks, HL2461 · ICO: guidance on AI and data protection · MHRA: crafting an intended purpose for medical software
Concrete design deduction
Review personal prayer/health data and third-party AI processing under the applicable data rules. Match health claims, instructions and functions to a defined intended purpose.
Review limits. Do not transplant EU AI Act duties into UK law or treat guidance as legislation. UK market and medical-device details, including territorial differences, need product-specific review.
Patterns to review in this market
- Ai involvement disclosure
- Choose help
- Ai placement
- Sensitive topics
- Contextual safety
- Suicide concerns
- Possible abuse
- Spiritual abuse
- Safeguarding handoff
- Safe support access
- Human connections
- Honest support
- Reassurance loops
- Health and spiritual practice
- Interactive reflection
- Sensitive memory
- Private sharing
- Voice and recording
- Annotation library
Australia
Existing law + regulator guidance; national policy · Reviewed 5 October 2026
Applicability trigger
The National AI Plan describes an approach grounded in existing regulatory frameworks. OAIC AI-use guidance concerns entities covered by the Privacy Act; TGA guidance distinguishes regulated mental-health products and exclusions.
What the source establishes
The plan is policy, not an enacted general AI Act. TGA explains that therapeutic-purpose chatbots can qualify as medical devices; general advice and conditionally excluded tools differ. Australia National AI Plan: keep Australians safe · OAIC: privacy and commercially available AI products · TGA: digital mental health tools
Concrete design deduction
Assess privacy coverage, sensitive inputs and model-supplier handling. Reassess an interactive devotional if new diagnostic or treatment functionality changes its purpose.
Review limits. Distinguish statutory duties from OAIC recommendations and voluntary AI practices. Medical-device exclusion does not itself establish effectiveness or eliminate other applicable obligations.
Patterns to review in this market
- Ai involvement disclosure
- Choose help
- Ai placement
- Sensitive topics
- Contextual safety
- Suicide concerns
- Possible abuse
- Spiritual abuse
- Safeguarding handoff
- Safe support access
- Human connections
- Honest support
- Reassurance loops
- Health and spiritual practice
- Interactive reflection
- Sensitive memory
- Private sharing
- Voice and recording
- Annotation library
China
Binding AI-content labelling measures; effective 1 September 2025 · Reviewed 5 October 2026
Applicability trigger
The measures apply to specified internet-information service providers under linked algorithm, deep-synthesis and generative-AI rules, with separate generation/distribution roles.
What the source establishes
They address explicit labels, implicit file metadata and dissemination checks. Covered download/copy/export functions must retain required explicit labels; metadata duties and encouraged watermarking are distinct. China: measures for labelling AI-generated synthetic content
Concrete design deduction
Design origin information across text, synthetic narration, video, exports and receiving platforms. Assess the service role before selecting UI-only or file-level mechanisms.
Review limits. English summary of the official Chinese text. Article 9 has a conditional route for output without explicit labels; this entry does not assess broader religious-content, licensing or data obligations.
South Korea
AI Basic Act in force; announced enforcement grace period · Reviewed 5 October 2026
Applicability trigger
MSIT confirms the Act and decree entered into force on 22 January 2026, and describes obligations for generative/high-impact AI providers.
What the source establishes
The ministry describes advance AI-use notice and differentiated output labelling. It also announces at least a one-year enforcement grace period with exceptional serious-harm cases. MSIT: the AI Basic Act comes into force
Concrete design deduction
Separate service-entry notice from output-origin display. Review synthetic audio and realistic media labels with age and modality in mind.
Review limits. This entry uses the official implementation summary, not a full translation of all subordinate rules. A grace period does not mean the Act is absent; recheck current guidelines and enforcement position.
Canada
Existing privacy law + joint regulator principles · Reviewed 5 October 2026
Applicability trigger
Federal, provincial and territorial privacy authorities published principles for applying privacy protections to generative AI.
What the source establishes
The document states that applicable privacy laws continue to govern generative-AI activities; the principles are regulator guidance, not a standalone AI Act. Canadian privacy authorities: responsible generative AI principles
Concrete design deduction
Record applicable federal/provincial coverage and assess consent, minimisation, transparency and accountability for intimate conversation and memory.
Review limits. This is a privacy entry, not a complete Canadian AI-legislation survey. Determine the actual organisation, activity and provincial law before choosing controls.
Patterns to review in this market
Make a jurisdiction decision
- Describe the feature. A passage search, relational companion and symptom-treatment assistant can sit in one app but have different triggers.
- Identify location and role. Record where users and operators are, age groups, provider/deployer roles, professional services and distribution channels. Domain and interface language do not settle jurisdiction.
- Classify the evidence. Record the current instrument, section, definition, exclusions, effective date and any enforcement transition. Keep proposed requirements separate.
- Trace the whole flow. Review first use, return, long sessions, distress, model calls, memory, human referral and exported media.
- Turn conclusions into requirements. Name who owns disclosure, age handling, retention, support operations, output labelling and incident response; validate comprehension and actual behaviour.
- Recheck on change. New markets, minors, clinical claims, relational memory or synthetic-media exports can change the assessment. Keep an accountable review owner and source version.
Shared design foundations can support several markets; regional timing and service definitions still require explicit configuration. A notice is not consent, a label is not evidence of accuracy, and a crisis card is not a staffed handoff.
Coverage still to develop
Further US states, Canadian legislative developments, Singapore, Japan and other markets remain research paths. This map does not cover every child-safety, consumer, professional, accessibility, medical-device, privacy or religious-publication rule. Country entries should expand with verified sources rather than a blanket claim that an app is compliant.
Apply this to everyday product decisions
Notifications and email · Subscriptions and AI costs · Analytics, chat data and tracking. Each guide distinguishes proposed product choices from source-specific rules.