Chatbot disclosure laws: when you must say it is an AI.

The short answer

Say it at the start. A first message that tells the visitor they are chatting with an automated assistant, before they type anything, is what every rule below is reaching for, and it costs you nothing. The details differ by place, so the rest of this guide sets them out.

This covers the rules most likely to touch a small business website or chat window as of October 2026. US states keep adding AI laws, so treat the list as a starting point. It is general information, not legal advice: check the current rules where your customers are with your own adviser.

Say it in the first message, before the visitor types anything. A notice buried in your terms or privacy policy does not do the job.

The rules at a glance

Where, who it covers, and what it asks for:

• EU, AI Act Article 50(1), from 2 August 2026. Covers AI systems that interact directly with people. People must be told they are interacting with an AI system, in a clear and distinguishable way, at the latest at the first interaction, unless it is obvious. It reaches businesses outside the EU when the system's output is used in the EU.
• Maine, title 10, section 1500-DD of the Maine Revised Statutes, enacted in 2025. Covers chatbots and any other computer technology used in trade and commerce. A business may not use one in a way that may mislead a reasonable consumer into believing they are dealing with a person, unless it tells the consumer clearly and conspicuously that they are not. A breach is a violation of the Maine Unfair Trade Practices Act.
• California, Business and Professions Code section 17941, in force since 1 July 2019. Covers bots that talk to people in California online. Using one with the intent to mislead about its artificial identity, to push a sale or influence a vote, is unlawful. A clear and conspicuous disclosure that it is a bot removes the liability.
• California, Health and Safety Code section 1339.75, since 1 January 2025. Covers health facilities, clinics and physicians' offices that use generative AI to write patient communications about clinical information. They need an AI notice, shown throughout a chat, and instructions for reaching a person, unless a licensed provider reviews the message. Scheduling and billing messages are excluded.
• Colorado, conversational AI services, from 1 January 2027. Covers public chat services built mainly to simulate conversation. They must say they are AI at the start of each day's first chat, at least every three hours or with a notice that stays on screen, and whenever the user asks. Bots designed mainly for customer service, shopping or ordering are excluded, and so are bots used by HIPAA covered entities and their business associates.

The EU rule in more detail

Article 50(1) puts the duty on the provider: whoever develops the AI system, or has it developed, and puts it into service under its own name. A business that has a chatbot built for it and runs it under its own brand can be that provider. A business that uses a chat product under the vendor's brand is usually a deployer, and the vendor carries the duty. Either way the notice belongs in the chat window, so agree with your vendor who writes it.

The Commission's questions and answers on Article 50 say people must be notified from the start of the first interaction, in a clear and distinguishable way. Whether it is obvious that someone is talking to an AI is judged from the point of view of a reasonably well-informed, observant and careful person, and the Commission says that exception should be read narrowly. The notice must also meet accessibility requirements.

National market surveillance authorities enforce the rule, and the Commission says proportionality can be taken into account for small and medium-sized businesses. The rest of the Act, and what it asks of businesses that use AI tools, is in the EU AI Act for small businesses.

Maine: the broadest US test

Maine's law is the one most likely to catch an ordinary business chatbot in the US, because it needs no intent to deceive. The question is whether the chatbot is used in a way that may mislead a reasonable consumer into thinking they are talking to a human. A chatbot with a human name, a staff photo and typing pauses could do that even if nobody meant it to.

The wording is also wide: "any other computer technology", which reaches beyond chat windows. Treat an AI voice answering your phone the same way. The remedy is the same too: tell people clearly and conspicuously that they are not talking to a person. For a phone line, that can be as short as "You're through to the automated assistant for Coastline Heating. I can book a visit or take a message. Say 'person' at any time to reach the office."

A breach counts as a violation of Maine's Unfair Trade Practices Act, the same law that covers other unfair dealing with consumers. If you serve customers in Maine, treat the notice as required and put it where nobody can miss it.

California: two narrow laws

The 2019 bot law turns on intent. It is unlawful to use a bot to talk to someone in California online with the intent to mislead them about its artificial identity, to push a purchase or influence a vote. Most business chatbots never come close. But the law also says that disclosing it is a bot removes the liability, so the notice is your cheapest protection.

The 2025 health care law is narrower and stricter. If a California clinic or physician's office uses generative AI to write messages about a patient's clinical information, each message needs an AI notice and instructions for reaching a person. In a chat the notice stays on screen throughout. A message that a licensed provider reads and reviews before it goes out is exempt, and so are messages about appointments and billing. A clinic chatbot that only takes booking requests sits outside it. One that discusses symptoms or results is likely to sit inside it. HIPAA and AI chatbots covers the rest of a clinic's checklist.

California also has a law on companion chatbots, the kind built for ongoing social conversation, in force since 1 January 2026. It excludes bots used only for customer service or a business's operational purposes.

Colorado: a new rule that skips most business bots

Colorado rewrote its AI laws in 2026. Its 2024 AI Act, which many older articles still describe, was repealed and replaced in May 2026 by a law on automated decision-making technology used in consequential decisions. Its notice rules apply when a business uses such a system to materially influence a consequential decision about someone, which a website question-and-answer bot does not do.

A separate 2026 law covers conversational AI services from 1 January 2027, with the disclosure rules in the list above. Its exclusions matter more to a small business than its rules. It does not cover a bot designed mainly for commerce or transactions, including product or service recommendations, shopping, ordering, payments, delivery, returns, customer support or customer service, nor one used by a HIPAA covered entity or its business associates. A plumber's quote bot or a dental practice's booking chatbot is likely to fall outside it.

Wording that works

Put the notice in the first message and in the chat window's title bar. Plain words beat clever ones. First messages to adapt:

• A dental practice: "Hi, I'm the automated assistant for Brookside Dental, an AI. I can answer questions about appointments, prices and parking, or take a booking request. If you're in severe pain, please call the number at the top of this page."
• A plumbing firm: "You're chatting with our AI assistant. I can take the details for a quote and answer questions about our services. A person reviews every quote request."
• A law firm: "This is an automated assistant, not a lawyer. I can't give legal advice, and chatting here doesn't make you a client of the firm."

Words such as "virtual agent", or a first name on its own, can sound like a person's job title. Say "automated assistant" or "AI assistant". If the visitor asks "Am I talking to a real person?", the chatbot answers truthfully, every time.

The AI chatbots we build introduce themselves as an automated assistant, and a visitor can ask for a person at any point. On our own site, the privacy notice says the same of the assistant in the corner: it is an AI assistant.

Where and when to show it

• In the first message, before the visitor types anything.
• In the chat window's header, so it stays visible as the conversation scrolls.
• For clinical messages from a California clinic, on screen throughout the chat.
• On the phone, in the first sentence the caller hears.
• In a messaging app such as WhatsApp or Messenger, in the first reply the bot sends.
• In text that a screen reader announces, as well as any robot icon.

When a person takes over, say so, with their name and role: "You're now chatting with Maria from reception." When the person hands back, say that too. A visitor should never have to guess which one they are talking to. A customer service chatbot hands over many times a day, so get this wording right once and use it everywhere.

Disclosure mistakes

• A human name and a stock photo for the chatbot. Visitors who work it out halfway through feel misled.
• A notice only in the privacy policy or the terms, where nobody reads it during a chat.
• Typing pauses added to make replies look human.
• "Connecting you to an agent" at 11pm, with nobody there.
• A chatbot that dodges "Are you a bot?" or answers it with a joke.
• A notice in English on a chat that also answers in Spanish or German. Put it in every language the chatbot speaks.

Our guide on adding an AI chatbot to your website covers the rest of the first message: what it can help with and what to do if something is urgent.

Disclosure is one rule among several

A notice that it is an AI does not cover the other things a chat window has to say or do:

• What happens to messages: one line in the chat window with a link to your privacy notice, and a section about the chat in the notice itself. See what a privacy policy needs.
• Professional limits: a law firm's chatbot gives no legal advice, and a clinic's no clinical advice.
• Accuracy: the business answers for what its chatbot tells customers, AI notice or not. Who is responsible when your chatbot gets it wrong explains the Air Canada case.
• Consent for marketing, if the chatbot collects numbers or emails for offers.

In the US, general consumer protection law, including the FTC Act's ban on deceptive practices, applies on top of the state laws above.

Check your own chatbot in five minutes

• Open your site on a phone, in a private window, and start a chat.
• Read the first message. Does it say it is automated, in plain words, before you type?
• Ask "Are you a real person?" and read the answer.
• Check the header of the chat window, and every language it answers in.
• Ask for a person, and see what it says when nobody is available.
• If you run a clinic in California, check whether it ever discusses symptoms, results or treatment.

If the first message fails, fix that today. Everything else on this list can wait for the next change to the chatbot.