California SB 243 is now law: the Companion Chatbot Law. It is not a cannabis e-commerce statute. It is narrower than that. But it is a warning sign for every cannabis brand using AI chatbots, recommendation interfaces, or personalization flows.
The law focuses on companion chatbots, clear AI disclosures, safety protocols, and minors. Cannabis recommendation engines are not automatically the same thing as companion chatbots, but the direction of travel is obvious: AI systems that interact with consumers need clearer disclosure and better safeguards.
For cannabis brands, this sounds simple. It's not. Most recommendation engines were never built with this disclosure requirement in mind. The age verification is often too loose to know if the user is actually a minor. And the liability if you slip up isn't a fine. It's regulatory scrutiny in one of the most heavily watched industries in America.
This is the disclosure trap.
The Law Everyone Should Read Carefully
SB 243 was approved on October 13, 2025 and took effect January 1, 2026. At a high level, it requires companion chatbot operators to build transparency and safety controls around AI interactions, especially where minors may be involved.
- Companion chatbot users need clear notice that they are interacting with AI
- Operators need safety protocols for high-risk interactions
- Minors receive particular protection under the law
- Operators face recordkeeping, reporting, and civil liability exposure for violations
For cannabis specifically, this is radioactive as a signal. Cannabis regulators already treat any content or experience that could reach minors as a potential problem. You're already walking a tightrope with age verification. Now the broader AI regulatory environment is moving toward more explicit notice, safer interactions, and better records.
Most cannabis brands don't have that infrastructure.
Why Cannabis Recommendation Engines Are Suddenly Exposed
Here's the mechanics: A cannabis e-commerce site uses an AI-powered recommendation engine. A user lands on the site, gets recommended products based on their behavior, viewing history, or search patterns. The AI recommends Sativa strains if you've been looking at uplifting products. It recommends high-THC if you're a repeat buyer of potent flower.
That's an AI interaction. SB 243 may not directly govern every product recommendation engine, but the compliance lesson still applies: do not let AI-mediated consumer experiences operate silently.
But cannabis e-commerce has a problem: age verification is mostly a checkbox. You enter your birthdate, the site checks if you're over 21. If you're 17 and lie, the site has no real way to know.
Now you're operating a recommendation engine that may be serving minors without proper disclosure. That's a regulatory exposure.
Recommendation engines need AI disclosure and age-gate controls before they become a compliance problem.
The trap isn't that one California law suddenly covers every cannabis recommendation engine. It's that the law points toward a future where consumer-facing AI needs disclosures, age-aware safeguards, and evidence. Most cannabis e-commerce platforms are not built that way.
The Compliance Wall
Here's what cannabis brands actually need to do right now:
1. Audit your recommendation engine. Does it have AI disclosure? Is it visible before someone interacts with it? Most don't. They have it buried in a footer or not at all.
2. Upgrade age verification. A checkbox is a weak control for an AI-personalized cannabis experience. Higher-risk flows may need stronger verification, especially before personalized recommendations appear.
3. Add explicit AI disclosure to your chat, product recommendations, and personalization flows. Not buried. Not implied. Not "powered by AI." Explicit: "You're interacting with an AI."
4. Log your compliance. Save evidence that you showed the disclosure to the user. If a regulator asks, you need to prove it happened.
5. Restrict AI interactions for unverified users. If you can't confirm someone is 21+, don't show them recommendations. Make the experience non-personalized for unverified traffic.
These aren't minor updates. Many e-commerce platforms would need real product and compliance work to implement this fully.
Regulatory expectations around AI disclosure are moving faster than most cannabis ecommerce stacks.
The Timing Trap
Here's the cruel part: AI disclosure expectations are moving before cannabis-specific AI rules are clear. If you wait for a cannabis regulator to publish a perfect checklist, you may already be behind.
Cannabis regulators don't usually look backward aggressively, but enforcement happens in clusters. One brand gets audited. Suddenly everyone in that segment is under review.
The brands that move first have a narrative: "We updated our AI disclosures and age-aware controls before enforcement forced us." The ones that wait have a different story: "We operated silent AI recommendation flows until someone asked."
That story matters in regulatory proceedings.
What This Means for Strategy
This is bigger than compliance theater. For cannabis brands, personalization was supposed to be a competitive moat. You track what customers like, you recommend products they'll buy, you build loyalty through AI-powered curation.
SB 243 doesn't kill that. But it does kill the silent version. Every recommendation, every personalized experience, now requires a disclosure. That friction matters.
Some brands will disable recommendations for unverified users entirely. Others will add the disclosure and live with the slight UX cost. The smart ones will see it as a brand moment: "We use AI, and we're transparent about it. Here's why."
The cost of compliance is explicit disclosure, cleaner age gates, and better logs.
The window to act quietly is closing. If you're operating a cannabis e-commerce platform with recommendation engines, recommendation chatbots, or personalized product suggestions, audit them this month.
Don't wait for the first enforcement action. That's when the regulatory pressure gets real, and you're explaining why you were non-compliant for months while the rest of the industry was updating their systems.
SB 243 isn't a trap if you treat it as an early warning. It's a trap if you assume cannabis AI disclosure can stay silent forever.
2026 evidence and control update
The more useful 2026 question is not whether cannabis brands & california's ai disclosure trap is possible. It is whether operators buying AI tools without full training-data or decision transparency can prove what happened after the system made, shaped, ranked, routed, or explained a customer-facing decision.
The less obvious issue is that the hidden record is the distance between public training-data disclosures and the actual client workflow that produces a recommendation or compliance decision. That record is what separates a working AI pilot from a defensible operating system.
For source alignment, the public claim language should stay consistent with California AB 2013 training-data disclosure law and FTC guidance on AI claims. Those sources do not remove the need for local legal review, but they give the article a better evidence spine than vendor screenshots or unsupported performance claims.
This also connects to related operating risk, AI measurement gap, compliance workflow, because the same pattern keeps repeating: AI systems look clean in the dashboard while the proof, ownership, and customer context live somewhere else.
| Control layer | What to verify | Evidence to keep |
|---|---|---|
| Source data | Which approved source fed the answer, recommendation, ranking, or claim | Source URL, vendor field, timestamp, and owner |
| Decision boundary | Where the AI is allowed to help and where it must stop | Allowed use case, blocked topics, and confidence threshold |
| Human review | Who owns the exception, correction, or escalation | Reviewer role, handoff note, and approval record |
| Monitoring | How the team catches drift, complaints, or weak signals | Review cadence, sampled outputs, and customer feedback themes |
Frequently asked questions
Not necessarily. SB 243 focuses on companion chatbots. But cannabis brands should treat it as a signal that consumer-facing AI disclosure and safety expectations are tightening.
Cannabis already has age-gating, advertising, and product-claim restrictions. AI chatbots and recommendation flows add another consumer-facing layer that needs disclosure and records.
Disclose when users are interacting with AI, when recommendations are personalized, and when a response is generated rather than written by staff.
Log disclosure display, age-verification state, recommendation source, AI response, user consent, opt-out status, and any human escalation.
Disable personalized AI recommendations for unverified users, then add clear disclosure and logs before reintroducing personalization.