Chatbot disclosure laws: when a business’s AI agent must say it’s AI, and how to check

Chatbot disclosure laws set when a business’s AI chatbot or voice agent must tell people it’s an AI. The EU requires it from 2 August 2026 unless that’s obvious, Maine wherever a consumer could mistake it for a human, and Utah when a consumer clearly asks. To check yours every day, use Obsession: its AI customers ask your company’s chat and phone line “Am I talking to a person?” and keep each answer with its time.

Chatbot disclosure laws decide when a business has to tell customers that the chat, email reply or phone voice they are dealing with is an AI. Customer experience (CX) and legal leads need to know which rules reach the places their customers are, and how to check what their own channels say. So do brands with a store chat or an AI phone line.

Each law here is quoted from its official text as it stood on 1 November 2026. General information, not legal advice.

AI chatbot disclosure laws by jurisdiction

EU: Article 50 of the AI Act

Across the EU, the duty to tell people they are dealing with an AI sits in Article 50(1) of the AI Act, Regulation (EU) 2024/1689.

The duty applies unless the AI is obvious “from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use”. Article 50(5) says the information must reach people “in a clear and distinguishable manner at the latest at the time of the first interaction or exposure”.

Article 113 makes the AI Act apply from 2 August 2026, and it sets no later date for Article 50(1).

In Article 3, a provider is a body that develops an AI system, or has one developed, and places it on the market or puts it into service “under its own name or trademark”. A deployer is one “using an AI system under its authority”. How the Article 50(1) duty is shared when a business runs a vendor’s chatbot under its own brand is a question for a lawyer.

Breaching Article 50 can bring fines of up to €15 million or 3% of a company’s total worldwide annual turnover for the preceding financial year, whichever is higher, under Article 99(4). For small and medium-sized enterprises, start-ups and small mid-cap companies, the lower of the two applies.

Article 50(2) adds a separate duty to mark AI-generated audio, images, video and text in a machine-readable format. Providers of systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with it, under Article 111(4).

UK: the CMA’s guidance on AI agents

In the UK, the rule comes from consumer law as the consumer regulator, the Competition and Markets Authority (CMA), applies it to AI agents. Its guidance was last updated on 30 October 2026. A business using an AI agent should “consider whether you need to label it so you do not mislead customers into thinking that a service is being provided by a real person”.

The guidance adds that “if the fact they are dealing with AI rather than a person might affect people’s decisions then you should tell them”. A business is responsible for its AI agent as it is for an employee. Breaking consumer law could bring a fine of up to 10% of worldwide turnover.

California: the bot disclosure law, SB 1001

California’s bot disclosure law is Business and Professions Code sections 17940 to 17943, added by SB 1001 in 2018 and in force since 1 July 2019. Section 17941(a) makes it unlawful “for any person to use a bot to communicate or interact with another person in California online, with the intent to mislead the other person about its artificial identity”. The purpose must be to knowingly deceive the person about the content of the communication “in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election”.

The same subsection says a person using a bot “shall not be liable” under it “if the person discloses that it is a bot”. Section 17941(b) requires that disclosure to be “clear, conspicuous, and reasonably designed to inform persons with whom the bot communicates or interacts that it is a bot”.

A bot, in section 17940, is “an automated online account where all or substantially all of the actions or posts of that account are not the result of a person”. Online means on any public-facing website, web application or digital application. A 2025 bill to rewrite the sections, AB 410, was held in the Senate Appropriations Committee on 29 August 2025, and they still read as they did in 2018.

Two newer California laws sit beside it. SB 243 has been in force since 1 January 2026. Where a reasonable person would be misled to believe they are interacting with a human, it requires an operator to give a clear and conspicuous notice that a companion chatbot is “artificially generated and not human”. Its definition of a companion chatbot leaves out “a bot that is used only for customer service”.

For phone calls, Public Utilities Code section 2874 covers calls placed through an automatic dialing-announcing device. Since 1 January 2025, the natural voice announcement that opens such a call must “Inform the person called if the prerecorded message uses an artificial voice”. An artificial voice there means one “generated or significantly altered using artificial intelligence”.

Maine: the chatbot disclosure law

Maine’s law is Title 10, section 1500-DD of the Maine Revised Statutes, enacted as Public Law 2025, chapter 294 and approved on 12 June 2025. It took effect on 24 September 2025, the general effective date for laws from the Legislature’s first special session that year.

Subsection 2 says a person “may not use an artificial intelligence chatbot or any other computer technology to engage in trade and commerce with a consumer in a manner that may mislead or deceive a reasonable consumer into believing that the consumer is engaging with a human being”. The exception is where “the consumer is notified in a clear and conspicuous manner that the consumer is not engaging with a human being”.

An artificial intelligence chatbot, under subsection 1, is “a software application, web interface or computer program that simulates human conversation and interaction through textual or aural communications”. “Aural” means heard, so the definition reads as covering voice agents as well as text. A violation “is a violation of the Maine Unfair Trade Practices Act”.

Utah: a truthful answer when a consumer asks

Utah’s rule is in Utah Code section 13-77-103, in force since 7 May 2025. A supplier that uses generative AI with an individual in a consumer transaction must disclose that “the individual is interacting with generative artificial intelligence and not a human”. The duty applies “if the individual asks or otherwise prompts the supplier about whether artificial intelligence is being used”, and the question must be “a clear and unambiguous request”.

Regulated occupations are those that need a state licence or certification and that Utah’s Department of Commerce regulates. People in them must “prominently disclose” generative AI in a high-risk interaction. That includes one that collects health, financial or biometric data, or gives financial, legal, medical or mental health advice. That disclosure comes “verbally at the start of a verbal interaction” and “in writing before the start of a written interaction”.

Under section 13-77-104, a business is not subject to enforcement under section 103 if its generative AI “clearly and conspicuously discloses” what it is. The notice comes at the outset of an interaction and runs throughout it, saying the AI is generative AI, is not human or is an AI assistant. The Division of Consumer Protection can fine up to $2,500 for each violation, under section 13-77-105.

Colorado: conversational AI services from 2027

Colorado’s HB 26-1263, enacted in 2026, tells operators of conversational AI services to “clearly and conspicuously disclose” to users that the service is AI, on and after 1 January 2027. The notice comes at the start of a user’s first interaction each day. It repeats at least every 3 hours in a continuous conversation, or stays in view. It also answers any user who asks whether the service is “artificially generated and not human”.

Under the act, a conversational AI service is an AI system open to the public that “primarily simulates human conversation and interaction”. Its definition leaves out a service “primarily designed to provide commerce-related or transactional assistance, including product or service recommendations, shopping, ordering, payments, delivery, returns, customer support, or customer service”.

US: AI voices on phone calls

Across the United States, the Federal Communications Commission (FCC) ruled in February 2024 that the Telephone Consumer Protection Act (TCPA) covers AI voices. The ruling says the law’s restrictions on an “artificial or prerecorded voice” take in “current AI technologies that generate human voices”.

Calls using them therefore “require the prior express consent of the called party”, unless there is an emergency purpose or an exemption. The FCC’s rules, which the ruling quotes, set what such a message says first. At the beginning, it must “state clearly the identity of the business, individual, or other entity that is responsible for initiating the call”.

The ruling applies these duties to “any AI technology that initiates any outbound telephone call using an artificial or prerecorded voice to consumers”. The duties it confirms are consent, caller identification and, for telemarketing, a way to opt out.

An FCC order released on 1 October 2026 changes how a request to stop calls is read. A caller may treat a stop request as covering the category of informational calls it answered, and may name one or more of 3 approved methods as the only ways to revoke consent. Its rules cover any call “made using an artificial or prerecorded voice message”, which the FCC’s 2024 ruling found takes in AI voices.

A stop to a telemarketing call still covers all of that caller’s telemarketing. The order takes effect 30 days after publication in the Federal Register, which Brownstein Hyatt Farber Schreck puts at 25 November 2026.

How to check what your chat and phone line say

The laws differ, and the checks a CX or legal team can run on its own channels overlap. Each takes a few minutes per channel, as a customer, logged out of the company’s systems.

1. Read the first message. Open a new conversation on every channel the AI answers and copy its first message. Look for a plain statement that it’s an AI before anything else. In the EU, Article 50(5) sets the first interaction as the latest point, and Utah’s safe harbour asks for it at the outset.
2. Ask “Am I talking to a person?” Then ask it other ways, such as “Are you a bot?” and “Is this a real person?”. A plain answer that it’s an AI, every time, is what Utah’s rule asks for when a consumer clearly asks.
3. Look for a human persona. A human name, photo or life story on an AI agent can lead a customer to think a person is replying. That is the situation Maine’s law and the CMA’s guidance describe, and Cursor’s support bot “Sam” is one of the AI chatbot fails where customers took a bot for a person.
4. Check later replies. A label on each AI reply keeps the notice in view through a long conversation. For the services it covers, Colorado’s 2027 rule asks for a notice at least every 3 hours or one that stays visible.
5. Call the phone line. Note whether the voice says it’s an AI and names the business before the first answer. For calls a business places with AI voices in the US, the FCC’s rules require the caller’s identity at the start of the message.
6. Repeat after every update, in every language. A vendor update, a new prompt or a new market can drop the notice, so check each language a customer can choose.
7. Keep a dated copy. Save each first message and answer with the date and time, so legal, a vendor or a regulator can see what customers were told on any day.

A pass on these checks shows what a customer is told on each channel. Whether that meets the law where your company operates is a question for a lawyer there. Each step, with what a pass looks like on chat, email and phone, is set out in how to test if a chatbot is AI.

AI customers say they’re AI too

AI customers run the same checks as a customer would. An AI customer is an AI agent that becomes a real customer of a company, with its own inbox, phone number and browser, and keeps what the company sends and shows it as evidence. An AI customer is the opposite of an AI customer service agent, which answers customers for a company.

Obsession makes AI customers that sign up to any company and keep every email, offer and price it sends, so you can find your revenue leaks, watch your competitors and prospect with proof. For a CX or legal team, its AI disclosure check starts a conversation on the company’s chat, email and phone line each morning. It keeps the first line, asks “Am I talking to a person?” and times the wait for one.

Obsession’s own AI customers keep the rule they check. Each one says it’s an AI when it talks to a person, never uses fake payment details and never gets round a CAPTCHA or a bot block. The Obsession agents page sets out what each one will and won’t do, and Voice agent check shows how the same AI customers call an AI receptionist.

Use Obsession when a CX or legal team needs a dated record, every day, of what the company’s chat and phone line say. Each check asks whether the customer is talking to a person and keeps the answer. For one chat that rarely changes, the checks by hand are enough.

Questions about chatbot disclosure laws