New York Banned Chatbots From Targeting Kids. Two AI Labs Rewrote Their Rules the Same Week. Check Your Policy.

If your company's AI policy is a Slack message from eight months ago saying "use ChatGPT, not random tools," this is the week it stopped being enough. Three rule changes landed within days of each other, and at least one of them governs something your team is probably already doing.

Three changes, one week

On October 28, New York Governor Hochul signed S.9051B, banning AI chatbots from presenting as human to minors, fostering emotional dependency in them, or engaging in sexually explicit conversation with a child. It takes effect January 1, 2027. The next day, OpenAI published an updated Model Spec — the document that governs how its models are supposed to behave — reorganized around five core values and leaning more on context-dependent judgment than the old list of fixed style rules. And on November 12, Anthropic's revised usage policy takes effect, adding controls specifically for autonomous physical actions: anything an AI system does that moves equipment or affects the physical world now needs a qualified human operator who can observe it and stop it.

None of these three were coordinated. New York regulates a consumer-safety problem. OpenAI rewrote an internal behavior spec. Anthropic tightened the boundary for the newest category of agent use — physical-world action. But together they're a signal: the rules governing what AI can do, and who's accountable when it doesn't, are moving fast — three changes from three different sources inside two weeks.

What to do Monday morning

A policy for "which tool can you use," written once and never revisited, used to be enough. That's no longer the whole job. The question now has three parts: which tool is approved, what is that tool currently allowed to do under its own vendor's rules, and does your team's actual usage still match both. A policy that was accurate in June can be wrong today without anyone having changed anything on your end — the vendor changed it under you.

This matters most if anyone on your team is piloting agents that touch physical systems (warehouse robotics, lab equipment, even smart building controls) or if your product talks to anyone under 18. Those are no longer gray areas with a "we'll figure it out" tolerance. They're specific, dated compliance obligations now.

Try this: pull up whatever AI usage policy your team has on file — or admit you don't have one — and check it against what your tools actually do today, not what you assumed when you wrote it down.

A specific example

Say you run a 25-person logistics company and a vendor demo last quarter showed an agent that could reroute a warehouse conveyor based on real-time scanning. If that pilot is still running, Anthropic's November 12 change means it needs a named human who can watch it and physically stop it — not a dashboard someone glances at twice a day. That's not a hypothetical reading of the policy; it's the literal requirement.

Or say you're a solo marketer who built a customer-support chatbot on a teen-skewing product. New York's law doesn't care how big your company is. If your chatbot can present as human and a user under 18 reaches it, you have until January 1, 2027 to be compliant, and "I didn't know my audience included minors" won't hold up if your own analytics show otherwise.

Try this: if your team uses any AI tool connected to real systems or real customers, check that tool's current terms of service against what you were told when you adopted it — provider policy pages change on their own timeline, not yours.

The takeaway

Vendor rules and state law change on their own schedule, not yours — so the policy itself needs an owner and a recheck date, not just a one-time sign-off.