US chatbot disclosure laws in 2026: California yes, Colorado not yet
Updated June 11, 2026
US state AI laws moved fast in 2025 and 2026, and a lot of summaries online are now wrong. Here is the actual mid-2026 status of the four laws that matter for chatbot disclosure, in plain language.
California: two laws, one that probably applies to you
The B.O.T. Act (Business and Professions Code §§ 17940–17943) has been in force since 2019. If a bot communicates with a person in California to push a sale or influence a vote, hiding that it is a bot is unlawful without a clear, conspicuous disclosure. For commercial chatbots this remains the most relevant US rule, and the fix is the same disclosure pattern the EU expects.
SB 243, the companion chatbot law, took effect January 1, 2026 and got a lot of headlines. Read the scope before panicking: it targets companion chatbots that simulate ongoing human relationships, and it expressly excludes bots used only for customer service, business operations, or productivity. Its disclosure duty triggers when a reasonable person would be misled into thinking they are talking to a human, with stricter rules for known minors. If you run a support bot, SB 243 is most likely not your law. If your bot leans social or emotional, it might be.
Utah: narrower duty, and a safe harbor worth having
Utah's AI Policy Act has been in force since May 2024 and was amended in May 2025. Today it works like this: every supplier must disclose generative AI use when a consumer clearly asks. A prominent up-front disclosure is required only for high-risk interactions, meaning the bot collects sensitive personal information while providing advice someone could rely on for significant financial, legal, medical, or mental-health decisions.
The amendment also added the interesting part: a safe harbor. Disclose clearly and conspicuously at the outset of the interaction and throughout it, and you are shielded from state fines under the section. A persistent AI badge plus a first-message notice is precisely that posture.
Colorado: nothing in force in 2026
The Colorado AI Act was set to be the big one, then it unravelled. Its start was already pushed from February to June 30, 2026 by the legislature, it drew a constitutional challenge in April 2026 (xAI sued to block it, with the US Department of Justice intervening), and in May 2026 the legislature repealed and replaced it with a much narrower law, SB 26-189, focused on notice and disclosure duties for automated decision-making technology. The new framework takes effect January 1, 2027. If a vendor or an article tells you Colorado requires chatbot disclosure today, they are working from last year's news.
The pattern across all of them
Every one of these laws, and Article 50 in the EU, converges on the same mechanic: tell people clearly, at the moment of interaction, that they are talking to AI, and be able to show you did. One honest disclosure pattern with logging satisfies the strictest version of the requirement everywhere, which is considerably easier than tracking four statutes separately.
Is your chatbot actually ready?
Six questions, an instant verdict, free.
Just need the deadline handled? The one-time EUR 129 compliance pack covers a single chatbot with no subscription.
Disclosed provides compliance tooling and records; this document is not legal advice. Review it with your counsel before relying on it.