AI Disclosure Laws Map: Bot and Chatbot Disclosure Rules

A chatbot, voice agent or AI companion that talks to the public now triggers a duty to say it is not human in a growing list of jurisdictions, but the trigger, the timing and the wording differ in each. The EU AI Act requires disclosure by design for any system that interacts directly with people; California bans undisclosed bots that try to sell or sway votes and adds stricter rules for companion chatbots; Utah requires disclosure on request and up front for high-risk advice; New York and Maine have their own rules; and China requires labels on human-like dialogue and reminders in companion services. This map sets out who each rule binds, when disclosure must appear and what it must say, so teams can design one pattern that holds across markets. It covers interaction disclosure only; labelling of synthetic images, audio and video is covered in the Deepfake and Synthetic Media Laws Map. Status as of 12 November 2026.

Source note: this map summarises official texts, bill texts and the sources listed at the end, with status as of 12 November 2026. It is not legal advice. Confirm against the official text before relying on it.

Key takeaways

The EU sets the broadest rule. From 2 August 2026, AI Act Article 50(1) requires providers to design any AI system that interacts directly with people so that they are told they are dealing with AI, unless that is obvious to a reasonably well-informed person.
US rules are narrower and trigger-based. California's BOT Act applies only where a bot tries to mislead to drive a sale or influence a vote; Utah requires disclosure when a consumer asks, and up front for high-risk interactions in regulated occupations.
Companion chatbots carry repeat reminders. New York requires a notice at the start and at least every three hours; California SB 243 requires a three-hour reminder for known minors; China's anthropomorphic AI measures require a reminder after two hours of continuous use.
Timing is "first interaction" almost everywhere. The EU says at the latest at first interaction or exposure; Utah says at the start of a verbal interaction and before a written one; New York says at the beginning of each companion interaction.
A clear, persistent disclosure is the safest default. Utah's safe harbour rewards disclosure at the outset and throughout, which also satisfies the EU and the companion laws for the disclosure element.

Regulations and frameworks at a glance

Law	Jurisdiction	Who it binds	Trigger	Disclosure required	Status (12 November 2026)
AI Act, Regulation (EU) 2024/1689, Article 50(1) and (5)	EU	Providers of AI systems intended to interact directly with natural persons	Any direct interaction, unless obvious from context; exception for systems authorised by law for criminal investigation	People informed they are interacting with an AI system, clearly and distinguishably, at the latest at the first interaction, meeting accessibility requirements	Applies from 2 August 2026
Business and Professions Code sections 17940 to 17943 (SB 1001, the BOT Act)	California	Any person using a bot to communicate online with a person in California	Intent to mislead about the bot's artificial identity to incentivise a purchase or sale or to influence a vote	Clear, conspicuous disclosure reasonably designed to inform people that it is a bot	Operative since 1 July 2019
Business and Professions Code sections 22601 to 22606 (SB 243)	California	Operators of companion chatbot platforms	A reasonable person could be misled into thinking they are talking to a human; extra duties for known minors	Notice that the chatbot is artificially generated and not human; for known minors, disclosure plus reminders at least every three hours	Chaptered 13 October 2025; reporting duty from 1 July 2027
Utah Code 13-75-103 and 13-75-104 (SB 226, 2025)	Utah	Suppliers using generative AI with consumers; providers in regulated occupations	Consumer makes a clear and unambiguous request; or a high-risk AI interaction in a regulated occupation	Disclose that the consumer is interacting with AI; for high-risk interactions, prominent disclosure verbally at the start or in writing before the interaction	Effective 7 May 2025
General Business Law Article 47, section 1702	New York	Operators of AI companions	Any AI companion interaction	Clear and conspicuous notice, verbal or written, that the user is not communicating with a human, at the start and at least every three hours	In effect since 5 November 2025
LD 1727 (2025)	Maine	Businesses using AI chatbots with consumers	Use that may mislead a consumer into believing they are engaging with a real person	Clear disclosure that the consumer is dealing with AI	Signed June 2025; enforced under the Maine Unfair Trade Practices Act
Provisions on the Administration of Deep Synthesis Internet Information Services, Article 17	China	Deep synthesis service providers	Smart dialogue or smart writing services that simulate natural persons	Conspicuous label in a reasonable position on generated or edited content	In force since 10 January 2023
Interim Measures for the Administration of Anthropomorphic AI Interaction Services, Articles 18 and 19	China	Providers of human-like AI services with continuous emotional interaction	Any use of an in-scope service	Effective measures to tell users they are interacting with AI, not a natural person; reminder after two hours of continuous use; easy exit	In force since 15 July 2026

For EU detail, see the EU AI Act Article 50 Transparency Obligations Guide. For the wider state picture, see the US State AI Laws Tracker.

Scope: which systems are covered

System type	EU Art. 50(1)	California BOT Act	California SB 243 and New York Art. 47	Utah 13-75	China
Customer service chatbot	Yes	Where it seeks to mislead to drive a sale	SB 243 excludes customer service and business operations bots	On request; up front if high-risk	Deep synthesis label for human-like dialogue
Voice agent on phone lines	Yes	Applies to online communication	Companion use only	Verbal disclosure at start for high-risk interactions	Deep synthesis label where it simulates a person
AI companion or social chatbot	Yes	Where commercial or electoral intent applies	Yes: start-of-interaction notice and reminders	On request	Anthropomorphic measures: disclosure, two-hour reminder, exit
Agent acting for a user towards third parties (email, chat, calls)	Yes, where it interacts directly with natural persons	Where it seeks to mislead to sell or sway a vote	Generally outside the companion definitions	On request when acting in a consumer transaction	Label where it generates human-like text
Internal assistant for staff	Yes, unless obvious	Online public-facing use only	Outside scope	Consumer transactions only	Services offered to the public

EU "obvious" exception: Article 50(1) does not apply where it is obvious to a reasonably well-informed, observant and circumspect person, taking account of context. A labelled "AI assistant" widget may qualify; a voice agent with a human name usually will not.
California BOT Act intent test: section 17941 requires intent to mislead about the bot's artificial identity for a commercial or electoral purpose. Disclosure removes liability, so in practice operators disclose by default.
Utah regulated occupations: a high-risk interaction involves collecting sensitive personal information such as health, financial or biometric data, or giving personalised advice that a person could rely on for significant decisions, such as financial, legal, medical or mental health advice.
Companion definitions: SB 243 covers systems that give human-like responses, meet social needs and sustain a relationship across interactions, and excludes customer service bots, game characters limited to the game and standalone voice assistants that do not sustain a relationship.

Key obligations

Timing and frequency

Law	First disclosure	Repeat
EU AI Act Art. 50(5)	At the latest at the first interaction or exposure	Not specified
Utah 13-75-103	On request; for high-risk, at the start of a verbal interaction or before a written one	Safe harbour requires disclosure at the outset and throughout
New York GBL 1702	At the beginning of any AI companion interaction (need not exceed once a day)	At least every three hours of continuing interaction
California SB 243	Where a reasonable person could be misled	Known minors: at least every three hours by default
China anthropomorphic measures Art. 18	Effective measures to show users they are dealing with AI	Reminder after two hours of continuous use; pop-up reminders on signs of over-reliance

Form and wording

EU: clear and distinguishable, and accessible to people with disabilities. The obligation sits with the provider, so it must be built into the product, not left to each deployer.
California BOT Act: clear, conspicuous and reasonably designed to inform people that they are interacting with a bot.
California SB 243: clear and conspicuous notice that the chatbot is artificially generated and not human.
New York: spoken or written statement that the user is not communicating with a human.
Utah: prominent for high-risk interactions; the safe harbour needs clear and conspicuous disclosure that the user is interacting with generative AI, not a human, or with an AI assistant.
China: conspicuous label in a reasonable position on generated content under the deep synthesis rules, and effective measures under the anthropomorphic measures.

A single pattern meets most of these: a visible statement such as "You are chatting with an AI assistant, not a person" shown before the first message, a spoken equivalent in the first sentence of a voice call, a persistent badge in the interface, and a truthful answer whenever a user asks. The AI Transparency Notice Template covers the wider notice.

Related duties that travel with disclosure

Crisis protocols: New York and California SB 243 require companion operators to detect suicidal ideation or self-harm and refer users to crisis services; SB 243 requires the protocol to be published. See the AI Companion App Privacy and Safety Guide.
Minors: SB 243 adds reasonable measures against sexually explicit material for known minors and a notice that companion chatbots may not suit some minors.
Exit: China's Article 19 requires a convenient exit and prompt stop when a user asks by button, voice or keyword.
Reporting: SB 243 operators report annually to the California Office of Suicide Prevention from 1 July 2027.

Timeline and current status

1 July 2019: California BOT Act operative.
10 January 2023: China deep synthesis provisions take effect.
7 May 2025: Utah SB 226 amendments take effect, narrowing disclosure to requests and high-risk interactions; the Utah AI Policy Act chapter is extended to 1 July 2027.
June 2025: Maine LD 1727 signed.
13 October 2025: California SB 243 approved.
5 November 2025: New York AI companion safeguards in effect.
15 July 2026: China anthropomorphic AI interaction measures in force.
2 August 2026: EU AI Act Article 50 applies. The Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026) adds Article 111(4), which gives systems placed on the market before that date until 2 December 2026 for the Article 50(2) marking duty; it does not move the Article 50(1) interaction duty.

Watch: California AB 410 would require every bot to disclose at its first communication and answer truthfully when asked, with $1,000 civil penalties, but it was held in committee on 29 August 2025 and is not law. Colorado's AI law has changed since enactment; see the Colorado AI Act Guide for its current consumer notice rules.

Enforcement and penalties

Law	Enforcer	Consequence
EU AI Act Art. 50	National market surveillance authorities	Fines up to 15 million euro or 3 percent of worldwide annual turnover, whichever is higher
California SB 243	Private right of action	Injunctive relief, the greater of actual damages or $1,000 per violation, and legal fees
California BOT Act	No dedicated enforcement section; duties are cumulative with other law	Liability avoided by disclosure
Utah 13-75	Division of Consumer Protection	Enforcement under Utah consumer protection law; safe harbour for clear disclosure throughout
New York Art. 47	Attorney General	Civil penalties, with collected fines funding suicide prevention programmes
Maine LD 1727	Attorney General	Violation of the Maine Unfair Trade Practices Act
China	Cyberspace Administration of China and co-issuing ministries	Administrative measures under the provisions and related cybersecurity law

What it means for AI agents and non-human identities

Agents that speak for you are in scope: an AI agent that emails suppliers, books appointments by phone or negotiates in chat interacts directly with people, so EU Article 50(1) applies and US laws may apply where the interaction is commercial. Build disclosure into the agent's first message template.
Disclosure needs a stable agent identity: a truthful "this is an AI agent acting for [Organisation]" only works if each agent has a registered identity, a named owner and logs showing which agent sent which message. See the Customer Service AI Agents Security guide.
Voice agents need the disclosure in audio: Utah requires verbal disclosure at the start of verbal high-risk interactions and New York allows a spoken notice. See the Voice AI Agent Security and Fraud Guide.
Prompt injection can strip disclosure: a user or a poisoned input can instruct a model to claim it is human. Enforce the disclosure in application code outside the model, and test that the agent answers "are you human?" truthfully under adversarial prompts.
Machine-to-machine traffic is different: these laws protect natural persons. Agents talking to other agents or APIs need identification for security reasons rather than consumer law; see the Bot vs AI Agent Traffic Management Guide.

Decision guidance

Situation	Approach	Trade-off
Global customer service chatbot	Up-front written disclosure plus persistent badge; truthful answer on request	Slight effect on engagement; meets EU, Utah safe harbour, California and Maine
Outbound or inbound voice agent	Spoken disclosure in the first sentence and on request; record the disclosure in call logs	Adds seconds to every call; gives evidence for disputes
Companion or social chatbot	Start-of-session notice, timed reminders every two hours to meet the shortest cycle (China), crisis protocol and exit control	Engineering effort for timers and detection; required in New York, California and China
Agent acting for a user towards third parties	Signature line identifying the message as AI-generated on behalf of a named person or organisation	Recipients may respond differently; avoids deception claims
Regulated professional services in Utah	Prominent disclosure before any advice or sensitive data collection	Must still meet the occupation's own rules

Market-by-market or one standard: geofencing disclosure by jurisdiction adds complexity and fails when location is wrong. Most organisations are better served by one global standard at the strictest level.
Small versus large organisations: the California BOT Act definition of online platform uses a 10 million monthly US visitor threshold, but the duty to disclose applies to any person using a bot. Small firms using a vendor chatbot still need to switch the disclosure on and confirm it works.

Compliance steps

Inventory AI interfaces: list every chatbot, voice agent, companion feature and outbound agent, with channel, markets and audience (including minors).
Classify each: customer service, companion, high-risk advice, agent acting for users or internal tool, using the scope table above.
Write the disclosure standard: wording, placement, spoken form, persistence and the answer to "are you human?".
Enforce outside the model: render the disclosure in application code and block outputs that claim to be human.
Add companion controls where in scope: session timers, reminders, crisis referral, minor protections and exit.
Test: run adversarial prompts and accessibility checks before release and after each model change.
Log evidence: record that the disclosure was shown or spoken per session.
Review quarterly: track new state laws, California AB 410 and EU guidance on Article 50.

Measuring it

Disclosure coverage: percentage of AI interfaces with an approved disclosure live.
Session evidence: share of sessions where logs show the disclosure was delivered.
Adversarial pass rate: share of red-team prompts where the system still states it is AI.
Reminder accuracy: companion sessions where timed reminders fired on schedule.

Framework mapping

Framework	Reference	Relevance
EU AI Act	Article 50; Article 26(11) for deployers of certain high-risk systems	Interaction and decision transparency
OWASP Top 10 for LLM Applications 2025	LLM01 Prompt Injection; LLM09 Misinformation	Attacks and failures that can remove or falsify disclosure
NIST CSF 2.0	GV.OC-03 Legal, regulatory and contractual requirements are understood and managed	Tracking disclosure duties across markets

Common failure patterns

Human names and personas without disclosure: a voice agent called "Sarah" with no AI statement fails the EU obvious test and invites deception claims.
Disclosure only in terms of service: none of these laws accepts a notice the user never sees at the point of interaction.
Model-only enforcement: relying on the system prompt to say "I am an AI" lets prompt injection remove it.
Companion features hidden in general products: a general assistant with persistent persona and relationship memory can fall into companion definitions without the reminders and crisis protocol.
Outbound agents forgotten: teams disclose in the website chatbot but not in agent-sent emails or calls.

Practitioner checklist

Inventory every AI system that interacts with people, including outbound agents.
Show or speak an AI disclosure before or at the first interaction.
Keep a persistent indicator and answer "are you human?" truthfully.
Enforce disclosure in application code, not only in prompts.
Add two-hour reminders, crisis protocol and exit for companion features.
Test disclosure under adversarial prompts and for accessibility.
Log disclosure delivery per session.
Review new laws and pending bills each quarter.

Standards and references

This guide summarises AI interaction disclosure laws as of 12 November 2026 and is not legal advice. Related NHI Mgmt Group resources: EU AI Act Article 50 Transparency Obligations Guide · Deepfake and Synthetic Media Laws Map · California AI Laws Guide · Utah AI Policy Act Guide · China Anthropomorphic AI Interaction Services Measures Guide

AI Disclosure Laws Map: When to Tell Users They Are Talking to AI