State AI disclosure laws, state by state

The short version

No US law says "label everything you make with AI." What exists instead is a patchwork. A few states make a bot identify itself in certain conversations. A few more regulate AI in hiring, health care, pricing or companion apps. Dozens regulate AI in political ads. Most of these laws will never touch a typical bakery, roofing company or design studio, but several reach ordinary customer chat, ordinary ads and ordinary hiring.

If you keep one habit, make it this: when software talks to a customer, say so at the start. That covers the chatbot rules in Maine and New Jersey and, if you also keep a visible "AI assistant" label up for the whole conversation, Utah's safe harbor. It also lines up with what the EU now expects. The sections below show where the specific obligations sit.

Federal law has not replaced any of this. A December 2025 executive order (EO 14365) pushes federal agencies to challenge state AI laws, but the order itself preempts nothing, and Congress has passed no preemption statute. State laws stay enforceable unless a court or Congress says otherwise. The federal rules guide covers that fight.

Quick table: the state laws most likely to reach a small business

Political-ad laws are grouped further down. Each law name links to the official text or the official bill page.

Maine's date follows the state's 90-day rule; some secondary sources give September 16 or 23, 2025. New York's 396-b date is the reported December 11, 2025 signing plus 180 days.

Maine: the closest thing to a general chatbot rule

Maine passed the broadest "tell people it's a bot" rule in the country. If you use an AI chatbot, or any other computer technology, to deal with a Maine consumer in a way that could lead a reasonable person to believe a human is responding, you must tell them clearly and conspicuously that they are not dealing with a human. The law defines a chatbot as software that simulates human conversation by text or by voice, so an AI phone agent counts as much as a chat widget on your website.

There is no size threshold and no industry limit. A two-person shop in Portland and a national retailer selling into Maine are in the same position. Violations are treated as violations of the Maine Unfair Trade Practices Act, which the attorney general enforces and which can also support private suits.

What it means in practice: put the disclosure in the bot's first message, and make it plain. "Hi, I'm an automated assistant" does the job. A line in your terms of service does not, because the test is whether the person in the conversation could be misled.

Source: LD 1727, P.L. 2025, ch. 294 (chaptered text); bill status. Approved June 12, 2025.

New Jersey: bots used to sell must say so

New Jersey's bot law has been in force since July 19, 2020. It makes it unlawful to use an online bot to communicate with a person in New Jersey in connection with the sale or advertisement of merchandise or real estate, or to drum up support for a candidate, party or ballot question, unless you disclose at the outset, clearly and conspicuously, that the communication comes from a bot. A "bot" here is an automated online account where all or nearly all of the posts or actions are not made directly by a live person.

The duty falls on whoever uses the bot. Platforms, web hosts and internet providers are not on the hook. Penalties are $2,500 for a first offense, $5,000 for a second and $10,000 for each one after that, and the attorney general can also seek an injunction plus investigation costs and fees.

Two other New Jersey rules sit nearby but are not disclosure rules. A 2025 deepfake law (P.L. 2025, c. 40, effective April 2, 2025) makes it a crime to create or share deceptive AI audio or video to commit or further a crime, and gives victims a civil claim of at least $1,000 per knowing or reckless violation. And the Division on Civil Rights adopted disparate-impact rules (effective December 15, 2025) under which AI hiring and screening tools are judged by the same standard as human decisions, with the employer responsible for vendor tools. If you use AI to screen New Jersey applicants or employees, read the rule itself (linked above) before relying on this summary.

Source: P.L. 2019, c. 486 (N.J.S.A. 56:18-1 to -5).

Utah: answer honestly when asked, and speak first in high-risk settings

Utah rewrote its AI disclosure rule in 2025. The current version, Utah Code 13-77 (enacted by SB 226), has two parts.

• Ordinary businesses. If you use generative AI to interact with a person in a consumer transaction, you must tell them they are dealing with AI and not a human when they clearly and unambiguously ask. No proactive notice is required. A bot that dodges "am I talking to a real person?" is the problem the law targets.
• Regulated professions. If you work in an occupation regulated by the Utah Department of Commerce, you must disclose generative AI use up front in a "high-risk" interaction. That means one that collects sensitive health, financial or biometric data, or gives personalized financial, legal, medical or mental-health advice someone could rely on for a significant decision. Say it out loud at the start of a spoken interaction, and in writing before a written one begins.

Utah also offers a safe harbor: no enforcement action if the AI tool itself clearly and conspicuously says, at the outset and throughout the interaction, that it is generative AI, not a human, or an AI assistant. And the law adds a line worth remembering: using AI is never a defense to a consumer protection violation. If your bot misleads someone, that is your violation.

Penalties run through the Consumer Sales Practices Act: administrative fines up to $2,500 per violation, court fines up to $2,500 per violation plus injunctions and fees, and up to $5,000 per violation of a resulting order.

Mental health chatbots (HB 452)

A separate 2025 law covers chatbots offered as mental health support. The chatbot must say clearly that it is AI and not a human before the user can access its features, again at the start of any session if the user has not used it in the previous seven days, and any time the user asks. Ads inside the chatbot must be labeled as ads, and sponsorships or affiliations must be disclosed. Same penalty levels. In force since May 7, 2025.

Coming January 1, 2027: content provenance (HB 276)

Utah's Digital Content Provenance Standards Act requires large generative AI providers, those with more than 1,000,000 monthly users and publicly available in Utah, to embed hidden disclosure data in AI-generated or AI-altered images, video and audio. Large social platforms must detect that data, let users inspect it, and not knowingly strip it. Camera and phone makers follow for devices produced from January 1, 2028. A small business that only uses AI tools has no duty here, but the labels you see on platforms will start reflecting it.

The Utah AI Policy Act

The 2024 AI Policy Act no longer holds a disclosure duty; that part was repealed and replaced by 13-77. What remains is the state's Office of AI Policy and a voluntary regulatory sandbox, updated by HB 320 in 2026. The chapter is scheduled to sunset July 1, 2027. Because 13-77 leans on definitions in that chapter, watch for changes before then.

Sources: Utah Code 13-77-103; SB 226 (2025) enrolled; HB 452 (2025); HB 276 (2026); HB 320 (2026).

California: several narrow laws, not one broad one

California has more AI laws than any other state, but each one is aimed at a specific setting. For most small businesses, three matter: the BOT Act, the health care messaging rule, and, if you build AI tools, the AI Transparency Act.

BOT Act (in force since July 1, 2019)

It is unlawful to use a bot to communicate with people in California with the intent to mislead them about its artificial identity, when the goal is to get them to buy something or to influence a vote. You are protected if you disclose clearly and conspicuously that it is a bot, in a way designed to actually inform the people it talks to. Online platforms themselves carry no duty. There is no private right of action in the Act; enforcement comes through California's Unfair Competition Law, where public prosecutors can seek up to $2,500 per violation. A 2025 bill to expand the BOT Act (AB 410) died when the session ended.

Health care messages (AB 3030, in force since January 1, 2025)

Health facilities, clinics, physician offices and group practices that use generative AI to write patient communications about clinical information must include a disclaimer that the message was generated by AI, plus clear instructions for reaching a human. Placement is specific: at the start of letters and emails, throughout a chat, and spoken at the start and end of audio. Messages that a licensed provider reads and reviews before sending are exempt, as are purely administrative messages like scheduling. Enforcement runs through the medical boards and facility licensing. See sample wording.

AI Transparency Act (SB 942, as amended)

This law is aimed at companies that make generative AI tools, not companies that use them. Covered providers must offer a free tool that lets people check whether content came from their system, and must embed a hidden ("latent") disclosure in AI-generated or AI-altered images, video and audio, where technically feasible. That disclosure carries details such as provider name, system version, date and a unique identifier. Licensees must keep that capability turned on.

The core duties became operative August 2, 2026. Urgency amendments in SB 1000, signed September 30, 2026, removed the earlier 1,000,000-monthly-user threshold, so small AI tool makers serving California may now be covered; we found no grace period for them. SB 1000 also deleted the optional visible-label feature and delays the act for tools designed mainly as assistive technology. Hosting-platform and large-platform duties start January 1, 2027, and device makers January 1, 2028. Penalties are reported as $5,000 per violation, with each day a separate violation; that figure comes from summaries, not the official text, so check the source before relying on it.

Training data summaries (AB 2013, in force since January 1, 2026)

Developers of generative AI systems offered to Californians must post a high-level summary of their training data on their website. "Developer" includes anyone who substantially modifies a system, such as by retraining or fine-tuning it, so a business that fine-tunes a model and offers it publicly should read this one. A challenge by xAI lost at the preliminary-injunction stage on March 4, 2026; the Ninth Circuit appeal is set for argument November 18, 2026.

Companion chatbots (SB 243, changed by SB 1119)

Since January 1, 2026, operators of companion chatbot platforms must clearly disclose that the chatbot is AI when a reasonable person could be misled into thinking it is human, and must keep suicide and self-harm protocols. Customer-service bots, limited game characters and basic voice assistants are excluded. SB 243 gives harmed users a private right of action for the greater of actual damages or $1,000 per violation. SB 1119, chaptered September 10, 2026, replaces SB 243's minor-specific rules with a child-safety regime (risk assessments and independent audits) starting July 1, 2027.

Sources: B&P Code 17940-17943; AB 3030; SB 1000 and its chaptered summary (CalMatters, secondary); AB 2013; SB 243; SB 1119 (CalMatters summary, secondary).

Colorado: the big law was replaced before it bit

Many compliance guides still list June 30, 2026 as the start date for the Colorado AI Act (SB 24-205). That is misleading. In April 2026, xAI sued to block the law and the US Department of Justice moved to intervene on its side. On April 27, 2026, Colorado agreed in a stipulated federal court order not to enforce the law until 14 days after the court rules on xAI's injunction request, a request xAI agreed to put off. Colorado then passed a replacement, SB 26-189, signed May 14, 2026. The replacement takes effect January 1, 2027. On a plain reading the old text was technically operative in the gap, but it is not being enforced, and we found no official statement about that window.

SB 26-189: automated decisions (starts January 1, 2027)

This law covers businesses that use automated decision-making technology that materially influences a "consequential decision" about a person in education, employment, housing, lending, insurance, health care or essential government services. There is no small-business exemption. Deployers must:

• give clear and conspicuous notice at or before the point of interaction that such a tool is being used;
• within 30 days after an adverse outcome, give a plain-language explanation of the tool's role and the person's rights;
• offer data access and correction, plus meaningful human review or reconsideration where commercially reasonable; and
• keep records for three years.

Developers of these tools owe documentation to the businesses that use them. Only the attorney general enforces it, and a violation counts as a deceptive trade practice. The AG must give notice and a 60-day chance to cure where a cure is possible (not for knowing or repeated violations); that cure right ends January 1, 2030. The AG must adopt rules by January 1, 2027. Colorado's consumer protection penalties are reported at up to $20,000 per violation, or $50,000 if the victim is elderly, based on an unofficial copy of the statute; confirm the figure in the official Colorado code before relying on it.

HB 26-1263: companion-style chatbots (starts January 1, 2027)

Operators of public conversational AI services that mainly simulate human conversation must clearly disclose that the service is AI at the start of the first interaction each day, then either every three hours in a continuous session or with a persistent notice, and whenever the user asks. Extra protections apply to known minors. The exclusions are broad: services mainly for commerce or customer support, narrow single-topic bots, business productivity and internal tools, device voice assistants, game characters and several others. A normal small-business support bot is outside it, though a disclosure still makes sense under other states' rules.

Sources: SB 26-189 bill page and text; HB 26-1263 bill page and text; DOJ release on intervening in the xAI case.

Texas: disclosure mostly for government and health care

The Texas Responsible Artificial Intelligence Governance Act (TRAIGA), in force since January 1, 2026, gets described as a chatbot disclosure law. It mostly is not, for private businesses. The general "you are talking to AI" duty applies to government agencies. The duty that does reach private businesses is in health care: when AI is used in a health care service or treatment, the patient (or their representative) must be told no later than the date the service is first provided, or as soon as reasonably possible in an emergency.

TRAIGA also bans certain uses outright for everyone: AI built to push people toward self-harm or crime, unlawful discrimination, child sexual abuse material and unlawful sexual deepfakes, and chatbots that sexually impersonate minors. Only the attorney general enforces it, and there is no private right of action. The AG must give written notice and a 60-day cure window. Penalties run from $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for a continuing one.

SB 1188: AI in diagnosis (in force since September 1, 2025)

A Texas health care practitioner who uses AI for diagnostic purposes, including AI suggestions on a diagnosis or treatment plan drawn from a patient's records, must disclose that use to patients. The statute does not set a form or timing, and the practitioner must still review AI-created records under Texas Medical Board standards. One well-written patient notice can satisfy both this and TRAIGA's health care rule. The chapter's penalties reach $5,000 per negligent violation and $25,000 per knowing one.

Sources: HB 149 enrolled text; SB 1188 enrolled text.

Illinois: AI in hiring and employment

Since January 1, 2026, the Illinois Human Rights Act requires employers to notify employees when they use AI for recruiting, hiring, promotion, discipline, discharge, training selection or the terms of employment. It is also a civil rights violation to use AI that has a discriminatory effect on protected classes, or to use zip codes as a stand-in for one. The AI definition expressly includes generative AI. The Act reaches employers with one or more Illinois employees during 20 or more weeks of the year, so this is a small-business law.

The state agency proposed detailed notice rules in May 2026 and then withdrew them in June. Whether new rules have been filed is unclear; check the source. The statutory duty to notify applies with or without rules.

AI Video Interview Act (since 2020)

If you ask applicants for an Illinois-based job to record a video interview and use AI to analyze it, you must first tell them AI may be used, explain how it works and what general characteristics it evaluates, and get their consent. You cannot use AI to evaluate someone who says no. Share videos only with people needed to evaluate them, and delete them within 30 days of an applicant's request. Employers that rely solely on AI to decide who gets an in-person interview must report demographic data to the state each year.

Sources: Public Act 103-0804; Public Act 101-0260 and 102-0047.

New York State and New York City

AI people in ads (Gen. Bus. Law 396-b)

If you create a commercial ad that includes a "synthetic performer" (an AI-made or digitally created figure that looks like a real human performer but is not any identifiable person), and you know it, you must disclose that conspicuously in the ad. This catches the AI-avatar spokesperson that many small businesses now use. Audio-only ads are exempt, as are ads for films, shows and games where the use matches the work, and AI used only to translate a human performer's words. Media outlets that just run the ad are not covered. Penalties are $1,000 for a first violation and $5,000 after that.

AI companions (Gen. Bus. Law Art. 47)

Since November 5, 2025, operators of AI companions (systems designed to simulate an ongoing human-like relationship) must tell users they are not talking to a human at the start of an interaction (no more than once a day) and at least every three hours during a continuing one, and must have a protocol for suicidal ideation. Customer-service bots limited to your own products and services are excluded. The AG can seek up to $15,000 per day.

Personalized pricing (Gen. Bus. Law 349-a)

If a price is set by an algorithm using a consumer's personal data, the business must show, clearly and conspicuously: "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA." This applies to any algorithm, not only AI. Insurers, banks and certain financial institutions are exempt. The AG must first send a cease-and-desist letter with time to cure; after that, up to $1,000 per violation. A trade-group challenge was reportedly dismissed in 2025; whether an appeal has been decided is unclear, so check the source.

NYC Local Law 144: automated hiring tools

An employer or employment agency hiring or promoting for New York City may not use an automated employment decision tool unless it had an independent bias audit within the past year, a summary of the results is public, and candidates who live in NYC get notice at least 10 business days before use. The notice must say a tool will be used, what qualifications and characteristics it assesses, and how to ask for an alternative process or accommodation. There is no small-business exemption. Penalties start at up to $500 and rise to $1,500 for later violations, with each day counted separately. A December 2025 State Comptroller audit found the city's enforcement weak, which is not the same as safe.

Sources: GBL 396-b; GBL Article 47; GBL 349-a; NYC DCWP AEDT page; State Comptroller audit.

Minnesota: bans, not labels

We found no Minnesota statute that requires businesses to tell customers they are dealing with a chatbot or AI. What Minnesota has are three bans.

• Election deepfakes (Minn. Stat. 609.771). It is a crime to share a deepfake of a person without consent, knowing it is fake or recklessly ignoring that, to hurt a candidate or influence an election, within set windows (90 days before a party convention, or once absentee voting has begun). The statute has no labeling safe harbor, though the Eighth Circuit held in Kohls v. Ellison (February 2026) that content clearly labeled as parody is not a "deep fake" under the law. Penalties reach five years and $10,000 for repeat offenses, and a convicted candidate forfeits the office.
• Nudification tools (Minn. Stat. 325E.91, from August 1, 2026). If you own or control an app, site or program, you may not let users "nudify" images or video with it, or do it for them, and no one may advertise such a service. The AG can seek up to $500,000 per access, download or use. xAI's request to block the law was denied at the TRO and preliminary-injunction stages, per news reports; the case continues.
• Sexual deepfakes (Minn. Stat. 604.32 and 617.262). Sharing a realistic sexual deepfake of an identifiable person without consent can bring civil damages including a penalty up to $100,000, and is a crime.

For a Minnesota business, then, disclosure duties come from elsewhere: other states' laws if you sell into them, federal truth-in-advertising rules, and the platforms you post on.

Sources: Minn. Stat. 609.771; 2026 Minn. Laws ch. 72; 604.32; 617.262; Kohls v. Ellison opinion.

Political ad laws: only if you make political or issue ads

A Public Citizen tracker updated October 5, 2026 counts 33 states with laws on AI or deepfakes in election communications. Most follow one of two models. In the first, AI-made or manipulated depictions are allowed if they carry a set label. In the second, deceptive election deepfakes are banned in a window before an election. Nearly all exempt satire, parody and real news coverage. A few examples, each verified against the statute:

California has four election AI laws. AB 2355 (since January 1, 2025) requires committees to state "Ad generated or substantially altered using artificial intelligence." on qualifying ads. The 60-day candidate deepfake rule (Elections Code 20010) allows manipulated media that carries a "has been manipulated" disclosure, and AB 686 (CalMatters bill page) extended it to January 1, 2031. The 2024 deceptive-content ban (AB 2839) was permanently blocked in federal court in August 2025, and a rewrite, AB 502 (CalMatters bill page), took effect September 19, 2026; its constitutionality is untested. A separate law aimed at large platforms (AB 2655) was held preempted by federal law in August 2025, with an appeal pending.

If your business runs ads about a candidate, an election or a ballot question, check each state where the ad will run. Platform rules apply on top: see Google Ads and Meta.

How to use this page for your business

1. List every place AI touches a customer, applicant or patient. Website chat, phone answering, outbound calls, ads, product images, emails, pricing, hiring screens, and any advice your business gives.
2. Match each one to the states you actually sell or hire in. A Minnesota company whose chatbot talks with customers in Maine needs to follow the Maine rule in those conversations.
3. Default to disclosing at first contact. It costs one sentence, meets the core of the customer-chat rules in Maine and New Jersey, and avoids the deception problems the FTC cares about. Utah's safe harbor also needs the notice to stay up throughout the conversation, so keep an "AI assistant" label on screen. Companion-style, mental-health and health care bots have extra repeat-notice rules (see the table and their sections above). Our free examples give you wording.
4. Write it down and date it. A short public page saying where you use AI and where a person reviews the work keeps your staff, your bot and your website saying the same thing. That is what the template pack is for.
5. Check back. Colorado's two laws and Utah's provenance law start in 2027. Several dates on this page will change.