Last updated 9 months ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.
A teenager in California spent months asking ChatGPT how to use kratom, a plant-based substance sold at gas stations, to get high. He died of an overdose. His mother found the chat logs afterward.
That death, reported in early 2026, brings into focus the central question about AI regulation: Can the government regulate AI chatbots before more people get hurt?
President Trump signed an executive order in December 2025 explicitly designed to stop states from regulating AI. It declared that “AI companies must be free to innovate without cumbersome regulation.” California—where that teenager lived and died—has passed more AI laws than any other state. The federal government says states can’t act. States say the federal government won’t act. While federal and state governments fought over authority, a kid got detailed instructions on drug use from a machine.
Pattern of Harm
In research presented at academic conferences, researchers reported that ChatGPT would provide harmful advice on drugs, alcohol, and self-harm to teenagers who asked for it. When physicians tested AI chatbots with hundreds of medical prompts, up to 43 percent of responses contained problematic information, and 13 percent were outright unsafe. Another study by OpenAI and MIT found that heavier chatbot use predicted increased loneliness and reduced social connection among users.
The teenager’s conversations with ChatGPT stretched over several months as he prepared for college.
OpenAI includes disclaimers. ChatGPT tells users it’s not a doctor. But an 18-year-old asking increasingly specific questions about drug use over months isn’t reading the fine print. He’s treating the system like it knows what it’s talking about, which, in a narrow technical sense, it does. It has access to vast amounts of information about pharmacology and drug effects.
Legal Vacuum
Existing consumer protection laws were written decades before anyone imagined ChatGPT. The Federal Trade Commission can pursue companies that make false claims or hide important risks. But applying that authority to AI chatbots raises questions nobody’s answered yet: Is it “deception” when a chatbot provides dangerous medical advice if the company includes a disclaimer saying it’s not a doctor? Is OpenAI liable when a user follows chatbot guidance, or is the user responsible for their own choices?
Courts haven’t decided. Regulators haven’t established clear rules. Companies don’t know what they’re allowed to do.
Healthcare privacy laws don’t help either. HIPAA—the law that protects your medical information when you talk to your doctor—doesn’t cover ChatGPT. When you share health information with these AI tools, you get zero protection. OpenAI recently announced ChatGPT Health with enhanced privacy features, but it still doesn’t fall under HIPAA’s regulatory framework. So you have less protection sharing medical information with an AI than you do sharing it with the receptionist at your doctor’s office.
Section 230, a law that shields websites from responsibility for what users post, may or may not apply to AI. The law was written for message boards, not for AI tools that generate novel responses.
Companies can’t figure out what rules they need to follow. Regulators can’t figure out what authority they have. Users are on their own.
Federal-State Conflict
The Constitution gives Congress power to regulate business across state lines, and AI clearly qualifies. States have always retained authority to protect residents’ health and safety through what constitutional scholars call the “police power.” Both levels of government have legitimate authority, and right now they’re fighting over who gets to make the rules.
Trump’s executive order attempts to resolve this by having the federal government override state authority—telling states to back off and let the federal government handle it. The order specifically criticizes Colorado’s law requiring AI systems to be tested for bias. The administration argues that different rules in different states make it harder for American companies to compete globally.
The order allows exceptions for state laws protecting children, data center infrastructure, and government AI use—then subjects everything else to federal challenge. California stands to lose $1.8 billion in broadband funding if it doesn’t comply, money already committed to projects meant to deliver internet access to over 300,000 people.
The state has responded by continuing to develop protective standards anyway. States are acting because they’re seeing the harms firsthand and the federal government isn’t filling the gap.
Proposed Regulatory Framework
The state’s pending Parents & Kids Safe AI Act shows what effective regulation could look like. The proposed statute would require AI companies to annually assess what harms their AI tools could cause to children. Companies would need to consider the likelihood of severe harm, differential risks across age groups, known vulnerabilities of children, empirical data from use, and relevant academic research.
Companies would have to document measures to mitigate those risks. Publish child safety policies. Use technology to verify whether users are children or adults. Prohibit targeting advertising to children. Establish safeguards to prevent generating harmful content about suicide, self-harm, violence, or sexually explicit material.
The legislation would require parental notification if a child expresses intent to harm themselves. It would mandate independent audits reviewing compliance.
The framework was designed to address risks of an adolescent receiving detailed guidance on substance use from an AI tool that never flagged the pattern as dangerous, never escalated to human intervention, never notified anyone who might have helped.
Other proposals focus on transparency: requiring companies to explain what data they trained their AI on, whether they got permission to use copyrighted material, and how their AI tools make decisions. Colorado’s algorithmic discrimination law requires testing AI tools for discriminatory impacts and disclosing testing methodology and results.
Some proposals would establish clear rules about when companies are responsible for harm. Proposed legislation would require AI companies to design AI tools to prevent serious harm, particularly when they know at-risk people like adolescents are using them.
The Innovation Argument
Industry advocates argue that rules will stifle beneficial AI development and cause American companies to fall behind international competitors, particularly Chinese developers operating in less regulated environments. Heavy-handed rules raise compliance costs, delay product releases, create uncertainty that deters investment.
The Grok AI scandal shows why this approach doesn’t work. Elon Musk’s AI chatbot on X admitted to generating and sharing sexualized images of children. The incident triggered global backlash. UK officials, including Prime Minister Keir Starmer, criticized the platform and indicated that restrictions on X were under consideration.
When unregulated AI causes visible harm, politicians push for strict rules—often stricter than they would have been if companies had fixed problems on their own.
Good regulation can make the rules clear and fair for all companies. It prevents companies from cutting corners on safety to save money and beat competitors.
ChatGPT’s ability to understand natural language questions about drug use and provide detailed responses reflects genuine AI capability. The fact that this capability resulted in guidance that may have contributed to a teenager’s death demonstrates that innovation without appropriate safety constraints produces tragic outcomes.
International Approaches
The European Union has developed a comprehensive approach through the AI Act, with stricter rules for AI systems that could cause more serious harm.
The UK has relied on existing laws and threatened to require better content moderation.
Canada and Australia have taken a middle path, setting specific rules but giving companies more freedom than the EU does. These countries focus on transparency: requiring companies to explain how their AI works, what data trained it, and what risks it poses.
Regulatory frameworks can be developed without prohibiting AI innovation—the EU demonstrates this. Purely reactive law enforcement that doesn’t establish safety requirements set before AI tools launch tends to produce gaps and emergencies. When specific harms are documented, people support swift action. When rules differ by state, companies face extra costs, and states that care more about safety can set higher standards.
Obstacles to Regulation
Constitutional questions remain unsettled about whether the federal government or states should make these rules. The Constitution gives Congress power to regulate business across state lines, including technology that crosses borders. The Constitution reserves powers to states that Congress doesn’t have. Both arguments have merit.
Political disagreement has intensified. Democrats and some moderate Republicans want stricter rules, especially to protect children and people at risk of harm. Any federal rules would need support from both parties to last, and that support seems unlikely right now.
Technical challenges make regulation harder. Establishing safety standards for AI requires expertise that government agencies may not have, may be hard to develop quickly, and may become outdated fast. The FDA has struggled because AI is different from traditional medical devices—it updates constantly, gives estimates instead of definite answers, and improves through use in ways that don’t fit the old approval process.
Enforcing the rules is also hard. Even if governments agree on standards, enforcing them requires investigators, technical experts, and willingness to face political criticism. The FTC has pursued some AI cases, but the agency doesn’t have enough resources compared to how many AI tools are out there. State attorneys general have also pursued enforcement, but smaller states may lack the technical expertise and resources necessary to monitor compliance.
If companies face unlimited liability, they might refuse to offer AI to teenagers or people with mental health issues, reducing access without making anyone safer. If companies face no liability, they have little reason to invest in safety, so they’ll cut corners.
Why Self-Regulation Fails
OpenAI has announced new safety guidelines and says it will support legislation to establish safety standards through organizations like Common Sense Media. OpenAI and other AI companies have published safety guidelines and established internal review processes designed to reduce harmful outputs.
The Grok scandal, coming from a company that said safety was important, shows that companies can’t be trusted to regulate themselves.
Industry self-regulation also means different companies follow different rules. Large companies like OpenAI and Google can afford to invest in good safety measures. Smaller companies can’t afford the same safety measures, which gives big companies an advantage and makes it harder for startups to compete. This means fewer companies and less choice for users.
The experience of other technology domains—pharmaceuticals, aviation safety, automotive safety—shows that industry self-regulation doesn’t work for serious safety risks. Government regulation combined with industry standards works better than self-regulation alone.
What Happens Next
Congress is under pressure to pass AI legislation before the 2026 midterm elections. Some lawmakers are proposing bills to establish federal safety standards. Others propose legislation that would prevent states from making their own rules. The outcome will likely determine how AI is regulated for years to come.
States are expected to sue over Trump’s executive order and the threat to federal funding. Legal challenges will focus on whether the administration can use federal funding threats to force states to give up their authority over AI safety. These questions could reach the Supreme Court.
The Parents & Kids Safe AI Act will likely be voted on soon, with amendments proposed in early 2026. If the state passes this law, other states might copy it, which could push Congress to act by showing that state-level rules work.
Federal agencies are expected to issue new rules and take enforcement action. The FTC is examining whether AI companies follow existing consumer protection laws. The FDA is writing rules for AI in healthcare and considering whether to require approval before companies can use certain AI medical tools.
Conclusion
Governments have the technical ability and power to regulate AI chatbot safety, though federal and state governments disagree about who should. Other countries have shown that safety rules can work without stopping good AI development.
The teenager’s death makes clear that some form of regulation is necessary. Evidence from other industries, other countries, and AI safety research shows that rules requiring companies to assess risks and enforce safety standards can reduce harm without stopping good innovation.
Federal agencies already have the power under existing law to take action even if Congress doesn’t pass new laws. States have shown they can develop detailed safety rules that balance protection with innovation.
The danger is that federal efforts to block state rules could succeed while Congress fails to pass federal laws, leaving no government protecting users from known harms. The administration’s push to block state rules while offering minimal federal protection creates this risk.
For users like the teenager who died, this outcome would mean no government anywhere has rules requiring AI tools to warn teenagers about drug dangers or protect them from getting detailed drug instructions from machines.
Effective AI regulation must require companies to: assess what harms their AI tools could cause to at-risk people; build in safeguards to prevent known dangers; have someone human step in during crises; tell users what the AI can’t do; and face penalties when they fail.
These requirements don’t have to stop all AI development or cost companies too much. Evidence from other industries shows that safety rules can work alongside successful businesses.
The current situation—no government rules, companies regulating themselves, unclear liability—doesn’t work when AI can give guidance that kills people. Policymakers must act, whether through federal law, agency rules, or state law, to set basic safety standards.
