Compliance

AI chatbot disclosure laws in 2026: what your business actually has to say

August 5, 2026 · 8 min read · Pedro Paucar

Every business owner who installs a chat assistant eventually asks the same question, usually a week after it goes live: "Do I have to tell people it's a bot?"

Until recently the honest answer was "probably not, but you should." In 2026 that changed. Eight states have passed laws that touch conversational AI, two of them already apply to ordinary commercial chatbots, and two more take effect in 2027 with language broad enough to cover the assistant on a plumber's website. This is a plain-English map of what applies to a small business — and what to do about it in an afternoon.

This article is general information from a practitioner who builds these systems, not legal advice. If your bot touches health, finance or legal matters, have a lawyer in your state read your setup.

The short answer

There is no single federal rule that says "chatbots must identify themselves." Instead there is a patchwork, and it breaks into three layers:

• Deception rules — it is illegal to actively mislead someone into thinking your bot is human in order to sell them something. This already applies in California.
• Answer-honestly rules — if a customer asks whether they are talking to AI, you must say yes. This already applies in Utah.
• Always-disclose rules — the bot must announce itself whether or not anyone asks. This is the direction the newest laws are heading.

If you build for layer three, you are compliant with all three. That is the whole strategy, and it costs one sentence.

California: the rule that already covers sales chatbots

California's Bolstering Online Transparency Act — the B.O.T. Act, on the books since 2019 — makes it unlawful to use a bot to communicate with a person in California while misleading them about its artificial identity, when the purpose is to incentivize a purchase or sale of goods or services.

Two things matter here for a normal business. First, the trigger is intent to mislead, not the mere existence of a bot; an assistant that never pretends to be a person is not the target. Second, and more usefully, the statute contains a built-in escape hatch: you cannot be held liable if you disclose that it is a bot, and the disclosure has to be clear, conspicuous and reasonably designed to inform the person.

That is unusually friendly drafting. It means the entire question is settled, in the largest consumer market in the country, by a visible line of text at the top of the chat.

Utah: you must answer honestly when asked

Utah's Artificial Intelligence Policy Act took effect in May 2024 and was amended in 2025. As amended, a business using generative AI to interact with consumers must disclose that fact when the consumer clearly and unambiguously asks — the 2025 amendment narrowed a broader earlier duty down to that.

It also requires an up-front disclosure in high-risk interactions: conversations where the AI collects sensitive personal information and is involved in significant decision-making, specifically in financial, legal, medical and mental health contexts. And, like California, it offers a safe harbor for businesses whose tools make clear and conspicuous disclosures at the start of and during the conversation.

The practical consequence is small but real: if a customer types "wait, am I talking to a real person?", your bot must not dodge. Many off-the-shelf assistants, told to "sound human and friendly," will deflect that question. That is a configuration problem you should test for directly.

The 2026 wave is mostly about companion bots — for now

The laws that generated headlines this year are aimed at a different animal: companion chatbots, the ones designed for ongoing emotional or personal relationships, especially with minors.

• California SB 243 — in effect since January 1, 2026. Requires operators of companion chatbots to disclose non-human status, run crisis protocols and protect minors. Notably, it was the first state AI law with a private right of action.
• New York — AI companion rules effective November 5, 2025, requiring clear and regular disclosure that the user is talking to AI.
• Oregon and Washington — companion chatbot laws effective January 1, 2027, both with private lawsuits available; Oregon sets damages at $1,000 per violation.
• Tennessee — effective July 1, 2026, prohibits AI systems from presenting themselves as licensed mental health professionals.

If your assistant books appointments, answers pricing questions or qualifies leads, none of these describe it. But watch Nebraska and Idaho. Both take effect July 1, 2027 and both are written around "conversational AI" generally rather than companions specifically — that is the drafting style most likely to sweep in an ordinary business assistant. The trend across every one of these statutes points the same way: disclosure moves from optional, to required-on-request, to required-always.

The six-point checklist

Here is what I actually configure on every assistant I build, regardless of the client's state. It takes about an hour and it front-runs every law above.

1. Disclose in the first message. Not in a tooltip, not in the privacy policy — in the greeting the customer actually reads. "Hi, I'm the automated assistant for [business]" is enough.
2. Answer the direct question straight. Test it yourself: type "are you a real person?" If the bot says anything other than a clean no, fix the instructions.
3. Give a visible path to a human. A phone number or a "talk to a person" option in the chat, available at any point — not only after the bot fails three times.
4. Never let it claim credentials. No "as a doctor," no "as your attorney," no diagnosis, no legal opinions. Tennessee made this explicit; it was always a bad idea.
5. Disclose up front before sensitive data. If the conversation is going to collect health, financial or identity information, the disclosure comes before the first question, not after.
6. Keep the transcripts. If a complaint ever arrives, the conversation log is the evidence that your disclosure appeared. It is also, incidentally, the best product feedback you will ever get.

Disclosure does not cost you sales

The objection I hear most is commercial, not legal: won't people leave if they know it's a bot?

The evidence from the inbox says the opposite. What produces angry messages is not the bot — it is the reveal. A customer who spent eleven minutes explaining a problem to what they thought was a person, and then realizes it was software, does not just abandon the chat; they tell people. Whereas a customer who is told in line one that they are talking to an assistant, and gets a correct answer in twenty seconds, is simply a satisfied customer.

Speed is what wins the interaction, not the illusion of humanity. That is also why the quality of the escalation matters more than the quality of the small talk: the bot's job is to resolve what it can resolve and hand over the rest cleanly. If you want to see how that plays out on the phone rather than in chat, that is the whole subject of what to automate on business calls — and what never to.

What to do this week

Open your own website, start a chat with your assistant, and run three tests: does it identify itself before you ask, does it admit it is AI when you ask directly, and can you reach a human in one step? If any answer is no, that is your afternoon.

Compliance here is not a burden — it is the same design that makes the assistant trustworthy in the first place. The businesses that will have a problem in 2027 are the ones that spent 2026 trying to make a bot sound like a person.

Frequently asked questions

Does my business chatbot legally have to say that it is AI?

It depends on where your customers are and what the bot does. California's B.O.T. Act makes it unlawful to use a bot to mislead someone about its artificial identity in order to incentivize a sale, and a clear, conspicuous disclosure removes that liability. Utah requires disclosure whenever a consumer clearly and unambiguously asks, and up front in high-risk interactions involving financial, legal, medical or mental health matters. The 2026 companion-chatbot laws target emotional companion bots rather than booking or support assistants. The practical answer for a small business is to disclose in the first message everywhere.

Which states have chatbot laws in 2026?

California, Utah, New York, Oregon, Washington, Nebraska, Idaho and Tennessee have all enacted chatbot or conversational AI rules with different scopes and effective dates. California SB 243 took effect January 1, 2026 for companion chatbots. Oregon and Washington take effect January 1, 2027 and both allow private lawsuits. Nebraska and Idaho take effect July 1, 2027 with broader conversational AI transparency duties — the ones most likely to reach an ordinary business assistant.

Does telling customers it is a bot hurt conversions?

In practice the damage comes from the opposite situation: a customer who assumed they were talking to a person and finds out later feels deceived, and that is the interaction that produces complaints and lost sales. A short, plain disclosure in the first message plus a fast, visible path to a human keeps trust intact — and is also the cheapest form of compliance available.