Staff Reports
Virginia’s Joint Commission on Technology and Science quietly moved the map this week. The panel accepted a staff report that lays out six policy principles and a menu of rules to guide lawmakers who will write Virginia AI chatbot rules next session. The recommendations aim to protect users — especially children — from emotional harms, but they also hand state agencies new teeth and leave key questions unanswered.
What the commission actually approved
JCOTS endorsed a set of principles that focus on mitigating extreme harms, targeting risky design features, and demanding transparency and accountability. The practical options on the table include clear disclosures that a chatbot is not a human and is not a licensed professional, reminders to take breaks (every two hours was floated), friction-free exit options, and limits on romantic or sexual content by default. For minors the report recommends parent-linked accounts, highest privacy settings by default, and bans on sexual or romantic interactions unless parents expressly opt in. The plan also calls for protocols to spot and route users who show signs of self-harm to crisis resources, plus incident reporting to state authorities and annual complaint reports to the Virginia Department of Behavioral Health and Developmental Services (DBHDS).
Good intentions, growing bureaucracy
On paper, these sound sensible. Who would argue with warnings, easy exits, or steering people in crisis to real help? But the conservative in me — and the budget hawk in your neighborhood — notes what the commission left open. Delegate David Reid rightly asked whether assigning duties to multiple agencies would trigger funding reviews. Chair Delegate Cliff Hayes said the vote was about policy, not budget. Translation: legislators get to write rules now, and taxpayers will get the bill later. Meanwhile, small developers and startups will have to guess which features trigger costly compliance or reporting requirements.
Enforcement, privacy, and mission creep
The recommendations envision DBHDS collecting risk assessments and the Attorney General having authority to investigate and seek civil penalties. That raises practical and constitutional flags. Who verifies age without forcing intrusive checks? How do you regulate “emotional” design choices without chilling legitimate product improvements? The report wisely targets features — not speech categories — but vague wording invites mission creep. Lawmakers should not let technocrats rewrite user experience by fiat. Parental control is correct in principle, but it must be practical and privacy-respecting, not a new playground for state surveillance.
What lawmakers should do next
Accept the recommendations as a starting point, yes. But the General Assembly must translate them into narrowly tailored law. Fund enforcement only after lawmakers decide which agency will actually have the chops to oversee complex AI systems. Protect kids, preserve parental authority, avoid broad design bans that stifle innovation, and insist on a one-year review clause the report recommends so the law can be fixed quickly. If legislators follow those steps, Virginia can set smart standards for AI chatbot safety without turning every chatbot into a state-approved teddy bear.
