Do You Have to Tell Customers Your Chatbot Is AI? 2026 Laws

If a chatbot answers your customers, someone will eventually type "am I talking to a real person?" What the bot may say back is now a legal question. Between 2024 and 2026 the EU switched on the AI Act's transparency rules, Utah rewrote its disclosure law, Maine passed a chatbot statute, Texas added a duty for public agencies and health care, and Colorado replaced the AI law it had passed two years earlier.

This guide is for businesses running a customer-facing chatbot or AI support agent in the US, the EU or both. It covers what each law requires and what a breach costs, then turns that into copy you can paste into a widget. Every legal statement was checked against the statute or an official government page on 1 October 2026. It is general information, not legal advice; these rules change often, so confirm your position with counsel.

Do you have to tell customers they are talking to an AI chatbot?

In the EU and several US states, yes, and elsewhere general rules against deception still make a bot that pretends to be human a risk. Here are the rules as of October 2026.

The EU, Maine and Texas ask whether the visitor knows they are talking to AI; California and Utah focus on moments such as a sale, a direct question or a high-risk conversation. One design choice fits all of them.

What does the EU AI Act require for customer service chatbots?

The EU AI Act requires that a chatbot be designed so people know they are talking to an AI system, unless that is obvious, and the duty has applied since 2 August 2026. Article 50(1) of the AI Act says providers "shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system". A customer service chatbot is the textbook case.

Who carries the duty. Article 50(1) is addressed to the provider, whoever develops an AI system, or has one developed, and puts it on the market or into service under its own name. The business using it is the deployer. A chatbot vendor is usually the provider, but if you build your own bot or launch one under your brand, you may be the provider yourself. Either way, you control the name and greeting that make the disclosure clear or bury it.

Who is covered outside Europe. Article 2 reaches providers placing AI systems on the EU market wherever they are established, and providers and deployers in third countries "where the output produced by the AI system is used in the Union". A US store whose chatbot answers shoppers in France is likely in scope.

How the disclosure must look. Article 50(5) requires the information "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure", conforming to accessibility requirements. A label that appears only after the third message, or only as an icon a screen reader cannot announce, is hard to square with that.

What a breach costs. Article 99(4) sets fines for breaching Article 50 of up to €15 million or 3% of total worldwide annual turnover, whichever is higher; for SMEs and start-ups, Article 99(6) applies whichever is lower. National authorities and the EU's AI Office enforce it.

Did the digital omnibus delay the chatbot disclosure rules?

No. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved the high-risk rules to 2 December 2027 for areas such as employment and education, and to 2 August 2028 for AI built into regulated products. For Article 50 it gave only one grace period: providers of generative systems already on the market have until 2 December 2026 to add machine-readable marking to AI-generated content under Article 50(2). The duty to tell people they are talking to an AI kept its date.

When is it obvious that a customer is talking to AI?

The EU exception applies only when it is obvious "from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use". Recital 132 adds that people who are vulnerable because of age or disability should be taken into account where the system is meant to reach them. Maine's statute frames the same test from the other side: the problem is a chatbot that "may mislead or deceive a reasonable consumer".

Little about a modern chat widget is obvious, because language models write the fluent, typo-free sentences a good human agent writes. Compare two widgets:

• A window titled "Acme AI assistant", a logo avatar, a status line reading "AI assistant · online" and a first message that says "I'm an AI assistant". A reasonable visitor knows what they are talking to.
• A window titled "Emily", a stock photo of a smiling woman, a typing indicator before every reply and no mention of AI. Nothing says bot, and several things suggest a person.

Do not build compliance on the "obvious" exception: it is an argument you make after a complaint, and it turns on how carefully a tired customer reads a phone at midnight. Texas drops the exception entirely for public agencies and health care.

California's bot disclosure law: when must a bot say it is a bot?

California bans using a bot to mislead people about its artificial identity in order to sell something or sway a vote, and a clear disclosure removes the risk. Since 1 July 2019, Business and Professions Code sections 17940 to 17943 have made it unlawful to use a bot, an automated online account whose actions are substantially not those of a person, to communicate with people in California with intent to mislead them about its identity, to incentivize a sale or influence a vote.

The law needs intent to mislead and a commercial or electoral purpose, so a support bot that never pretends to be a person is an unlikely target. Once a bot sells or upsells, the commercial purpose is there, and the way out is simple: a person using a bot "shall not be liable" if it discloses that it is a bot in a "clear, conspicuous" way. The duty sits with the business using the bot, not with web hosts, and the chapter sets no penalty of its own.

Do California's newer chatbot laws apply to support bots?

Mostly not. SB 243, approved on 13 October 2025, regulates companion chatbots, systems that meet a user's social needs and sustain a relationship, and expressly excludes "a bot that is used only for customer service". The exception is health care: AB 489, approved on 11 October 2025, bars AI systems from using terms that imply their advice comes from a licensed health care professional, and existing law already requires health facilities that use generative AI for patient clinical communications to add a disclaimer and a way to reach a human.

Utah's AI disclosure law: an honest answer when asked

Utah requires any business using generative AI in a consumer transaction to admit it is AI when a customer clearly asks, and licensed professionals to disclose up front in high-risk conversations. The rules are in Title 13, Chapter 77 of the Utah Code, in force since 7 May 2025.

On request, for everyone. A supplier using generative AI in a consumer transaction must disclose that the person is interacting with generative AI "and not a human" if the person asks with "a clear and unambiguous request". "Am I talking to a real person?" qualifies; a vague "who is this?" may not, but your bot should answer both honestly.

Up front, for licensed occupations. A person in a regulated occupation, one that needs a state license or certification, must "prominently disclose" generative AI in a high-risk interaction: collecting health, financial or biometric data, or giving financial, legal, medical or mental health advice someone could rely on for significant decisions. The disclosure comes in writing before a written interaction starts, or verbally at the start of a spoken one.

The law covers systems that generate "non-scripted outputs" with "limited or no human oversight", so a language-model support agent is very likely covered. Utah also offers a safe harbor: no enforcement action if your AI "clearly and conspicuously discloses", at the outset and throughout the interaction, that it is generative AI, not human, or "an artificial intelligence assistant". A widget with "AI assistant" in its name and first message matches that wording closely.

The Division of Consumer Protection can fine up to $2,500 per violation, and breaching an order costs up to $5,000 per violation. Utah's original Artificial Intelligence Policy Act is set to be repealed on 1 July 2027, but the disclosure rules now sit in their own chapter, so check the current code rather than assuming they lapse with it.

Maine, Texas and Colorado: three newer state approaches

Maine wrote a short rule for every business, Texas a strict rule for government and health care, and Colorado replaced a general chatbot rule with one aimed at automated decisions.

Maine: a chatbot must not pass as human

Public Law 2025, chapter 294, now 10 MRSA §1500-Y, bars using an AI chatbot in trade and commerce "in a manner that may mislead or deceive a reasonable consumer into believing that the consumer is engaging with a human being", unless the consumer is notified "in a clear and conspicuous manner". The definition covers any program that simulates conversation "through textual or aural communications", so voice bots count. A breach is a violation of the Maine Unfair Trade Practices Act. The law was approved on 12 June 2025 and took effect on 24 September 2025.

Texas: public agencies and health care must disclose, even when it is obvious

The Texas Responsible Artificial Intelligence Governance Act, HB 149, in effect since 1 January 2026, requires a governmental agency offering an AI system to consumers to disclose it "before or at the time of interaction", even if obvious, in plain language; a link to a separate page is allowed. Health care providers that use AI in a service or treatment must disclose no later than the date the service is first provided. Private businesses outside health care have no general labelling duty under that section. The attorney general enforces the act after a 60-day cure period, with civil penalties from $10,000 per uncured violation up to $200,000 for one that cannot be cured.

Colorado: from chatbot labels to automated decisions

Colorado's 2024 AI Act, SB 24-205, would have required any business deploying an AI system meant to interact with consumers to disclose it. Its start date slipped to 30 June 2026, and before then the governor signed SB 26-189 on 14 May 2026, which "repeals and reenacts those provisions" around automated decision-making technology used in consequential decisions about education, employment, housing, lending, insurance, health care and government services. The official summary describes notice "at the point of interaction with a covered ADMT" and developer duties from 1 January 2027, not a general chatbot label. A bot that explains your returns policy is unlikely to be covered; one that screens tenants or loan applicants could be.

Is it illegal for a chatbot to pretend to be human under US federal law?

At the federal level, the rule that matters is older than chatbots: the FTC Act empowers the Federal Trade Commission to prevent "unfair or deceptive acts or practices in or affecting commerce". A bot that claims to be a person, or answers "yes" to "are you human?", is the clearest version of that risk. Announcing its Operation AI Comply sweep in September 2024, the FTC's then-chair said "using AI tools to trick, mislead, or defraud people is illegal" and "there is no AI exemption from the laws on the books." Phone bots add consent rules for AI-generated voices, covered in the guide to AI voice agents.

Edge cases: AI-drafted replies, the handoff, voice bots and AI-written emails

Four situations sit at the edges of these laws.

A person sends a reply AI helped draft. A reply a person reads, edits and sends is that person's message; Utah's definition, for example, covers outputs made with "limited or no human oversight". PepoChat's Enhance button works this way: it polishes an operator's draft, and the operator decides what is sent. If the AI starts sending replies on its own, the chatbot rules apply.

The moment a human takes over. When a person joins, the visitor should see it, and when the AI returns, they should know that too. The human handoff guide shows the switch, and the comparison of live chat and chatbots explains why the hybrid model depends on it.

Voice bots. Article 50 does not distinguish text from speech, Maine's definition includes aural communication, and Utah wants verbal disclosure at the start of a spoken high-risk interaction. Put it in the first sentence the caller hears.

AI-written emails. If an AI sends emails without review, treat it like a chatbot and say so in the signature. The AI Act's separate labelling duty for AI-generated text in Article 50(4) covers text published to inform the public on matters of public interest, not customer emails.

How to disclose that your chatbot is AI without hurting the experience

Good disclosure is short, early and always visible. It also helps the conversation, because visitors who know they are talking to a bot can calibrate their expectations and wording; our guide to chatbot instructions summarises the usability research.

1. Put "AI" in the name. "Acme AI assistant" works; "Emily" does not.
2. Say it in the first message, which lines up with the EU's "first interaction" and Utah's "at the outset".
3. Keep it visible. Put the label in the chat header too, not only in the first message, so it is still there after the greeting scrolls away.
4. Answer honestly. "Yes, I'm an AI assistant" is the only acceptable reply to "are you a bot?"
5. No human disguise. Skip stock portraits, bare human first names and fake typing delays.
6. Mark the handoff, and let the person who joins say hello.
7. Use real text. Icons alone fail screen readers and translation tools.

How to set up AI disclosure in PepoChat

PepoChat has no separate disclosure banner; the disclosure is the name, greeting, status line and instructions you set.

Assistant name. Set under Widget Customization: required, up to 40 characters, default "Support", shown in the chat header and the Messages list. Rename it to something like "Acme AI assistant" so the AI label appears in the chat header and the Messages list.

Status line. On the chat-first home screen, used when you have no published Help Center articles, the header reads "AI assistant · online", or with business hours on, "AI assistant · team online" or "team offline, back Mon 9:00 AM".

Greeting and suggestions. The greeting is the first message in every new conversation, so make it say the bot is AI. Without configured suggestions, one default chip on the chat-first screen reads "I'd like to talk to a person".

Agent instructions. Add the honest answer to How to sound and behave ("If someone asks whether they are talking to a person, say you are an AI assistant and offer to bring in the team") and a rule to Never do this ("Never say or imply that you are a human"). The agent instructions guide explains both fields. The base rules already escalate when a visitor asks for a person.

The handoff. Your team's replies appear under the operator's display name with an initials avatar, while the agent keeps the logo avatar. Escalation is quiet by design, so a one-line hello from the person makes the change unmistakable. Outside your business hours, the agent gives your away message instead of promising a quick reply.

Voice and languages. Voice runs on your own Vapi assistant, so the spoken disclosure is that assistant's first message, set on Vapi; see the voice setup page. Your name and greeting appear exactly as written whatever language the visitor uses, so pick a label such as "AI" that reads clearly everywhere; see multilingual AI customer support.

Then open Test the agent and ask "Am I talking to a real person?" before you go live; test chats are free. Your privacy notice should also name the chat service and its AI model provider, as the privacy notes and the GDPR guide for chatbots explain.

What to do next

Add the AI label, the greeting line and the two instructions today, then run the honesty questions as part of the AI chatbot launch checklist. If your bot takes actions or reads customer data, the guide to AI chatbot security risks covers the next controls. Every feature is on the free plan, including the settings above, so you can create a free workspace and launch a clearly labelled AI support agent without a credit card.