EveryAILaw.comDoes Hawaii Artificial Intelligence Disclosure and Safety Act (SB 3001) require Incident Reporting?
Hawaii • enforcing
Yes — 1 provision
Requirements at a glance
This regulation imposes 5 specific requirements for Incident Reporting across 1 provision:
- Annual report — Beginning January 1, 2028, submit an annual report to the behavioral health administration of the Department of Health (§ (e))
- Referral count — Report the number of times the operator has issued a crisis intervention services provider referral in the preceding calendar year (§ (e)(1))
- Detection and response protocols — Report the protocols put in place to detect, remove, and respond to user prompts regarding suicidal ideation or self-harm (§ (e)(2))
- Prohibition protocols — Report the protocols put in place to prohibit an AI companion response promoting suicidal ideation or actions or self-harm (§ (e)(3))
- Data minimisation — The report must include only the information listed in the subsection and must not include any identifiers or personal information about users (§ (e))
Annual Behavioral Health Reporting #
This is a filing to a health regulator, not a consumer-protection disclosure — Washington and Oregon make the crisis-referral count a public self-disclosure with no recipient agency, while Hawaii routes it to the behavioral health administration of the Department of Health, which is where the state's own suicide-prevention programming sits. The data-minimisation proviso is a hard cap rather than a floor: the report "shall include only the information listed in this subsection" and no user identifiers or personal information, so an operator cannot pad the filing with supporting detail. The duty is the one part of the act not in force on approval; it begins with the first report on 2028-01-01, covering the preceding calendar year.
Requirements
| Requirement | Details |
|---|---|
| Annual report | Beginning January 1, 2028, submit an annual report to the behavioral health administration of the Department of Health (§ (e)) |
| Referral count | Report the number of times the operator has issued a crisis intervention services provider referral in the preceding calendar year (§ (e)(1)) |
| Detection and response protocols | Report the protocols put in place to detect, remove, and respond to user prompts regarding suicidal ideation or self-harm (§ (e)(2)) |
| Prohibition protocols | Report the protocols put in place to prohibit an AI companion response promoting suicidal ideation or actions or self-harm (§ (e)(3)) |
| Data minimisation | The report must include only the information listed in the subsection and must not include any identifiers or personal information about users (§ (e)) |
Penalties
| Violation | Fine |
|---|---|
| Unfair or deceptive act or practice | Any violation of the section is an unfair or deceptive act or practice in the conduct of trade or commerce within the meaning of Haw. Rev. Stat. § 480-2 (§ (f)). The act itself sets no penalty amount |
| Enforcement | Enforced by the Office of Consumer Protection under the state's unfair and deceptive acts and practices authority |
| Private right of action | None. Nothing in the section may be interpreted as creating a private right of action to enforce it, or as supporting a private right of action under any other law (§ (f)) |
| Model developer shield | The section creates no liability for the developer of an artificial intelligence model for a violation by an AI system developed by a third party to provide an AI companion (§ (g)) |
| Cumulative duties | The duties, remedies and obligations imposed are cumulative to those imposed under other law and do not relieve an operator of any other duty (§ (h)) |