State Chatbot Disclosure Laws 2026: SaaS Checklist

TL;DR: Two settings cover the core of most state chatbot rules: say the bot is AI at the start, and never deny it when asked. California SB 243 adds crisis protocols for companion chatbots only; an ordinary sales or support bot answers to California's older bot law, SB 1001.

If your SaaS product includes a customer support bot, a sales assistant, or any AI-powered chat interface, you are now operating in regulated territory in at least 12 US states. The rules are not uniform, and the consequences for ignoring them range from AG enforcement actions to class action lawsuits filed directly by your users.

California SB 243 took effect January 1, 2026, and it's the state chatbot law with a private right of action: a person who suffers injury in fact from a violation can sue for an injunction, damages of at least $1,000 per violation and attorney's fees. Read its scope before you panic, though. It covers companion chatbots, bots that can meet a user's social needs and sustain a relationship across interactions, and it expressly leaves out a bot used only for customer service or technical assistance. A typical SaaS support bot sits under California's older bot law, SB 1001, which bans a bot that misleads people about being a bot to push a sale.

The compliance picture is further complicated because different states define "disclosure" differently. Some require proactive disclosure at the start of every session. Others only require it when the user asks. A few prohibit deceptive denial without mandating any affirmative statement at all. This guide breaks down what each major state requires, how the most common chatbot platforms handle it, and what your team needs to do before your next deployment.

What Chatbot Disclosure Laws Actually Require

Before reviewing the state-by-state breakdown, it helps to understand the two distinct legal obligations that these laws create. They are not the same thing, and many compliance guides conflate them.

The first obligation is proactive disclosure: telling users up front that they're talking to an AI. California SB 243 works this way for companion chatbots. If a reasonable person could be misled into thinking the bot is human, the operator must show a clear and conspicuous notice that it's artificially generated and not human. Nobody has to ask first.

The second obligation is truthful response on direct inquiry: answering honestly when a user asks whether they're talking to a human. Utah's AI Policy Act is the main example since its 2025 amendments (SB 226). A business using generative AI with consumers must disclose it when the consumer makes a "clear and unambiguous request"; up-front disclosure is required only for high-risk interactions in regulated occupations, meaning licensed or state-certified work regulated by Utah's Department of Commerce. Utah also gives a safe harbor to a bot that clearly says it's AI at the outset and throughout the interaction. More in our Utah guide.

These two obligations overlap but aren't identical. A support bot that opens with "Hi, I'm Aria, your support assistant!" and confirms it's AI when asked meets Utah's on-request rule, and SB 243 doesn't reach it if it only does customer service. It still sits outside Utah's safe harbor and relies on every "are you human?" being answered correctly. A bot that opens with "Hi, I'm Aria! I'm an AI assistant here to help." and keeps that label visible is the safer version in both states.

The practical compliance floor for multi-state SaaS companies is proactive disclosure. If your chatbot states clearly that it is an AI at the start of every session, you satisfy the proactive states, and you make it structurally impossible to violate the deny-on-inquiry states.

One more threshold question: what counts as a "chatbot" covered by these laws? The statutes generally reach any automated system that communicates with consumers via text, voice, or interactive interface in a way that could be mistaken for human communication. If your product has a live chat widget powered by an LLM, it is covered. If it has a phone IVR that uses AI-generated voice responses, it is likely covered. A static FAQ page with no interactive element is not. A basic rules-based decision tree that routes tickets without generating natural language responses likely sits in a gray zone, but the safe answer is to disclose anyway.

State-by-State Requirements

The following table covers the eight states with the most active chatbot disclosure requirements as of mid-2026. Several additional states have bills pending.

A few notes on the states in the table that warrant additional explanation.

California SB 243 gets the most attention because of its private right of action, so check whether you're in scope before anything else. A "companion chatbot" is an AI system with a natural language interface that gives adaptive, human-like responses and can meet a user's social needs, including by sustaining a relationship across multiple interactions. The law excludes a bot used only for customer service, a business's operational purposes, productivity, internal research or technical assistance. If you are in scope, the duties go well past a label: a published protocol for responding to suicidal ideation and self-harm, with referrals to crisis services, and annual reports to California's Office of Suicide Prevention starting July 1, 2027. The 2025 text also set extra duties for users the operator knows are minors (an AI disclosure, a break reminder at least every three hours, measures against sexually explicit content); SB 1119 (Adam's Law), signed September 10, 2026, deletes those from Section 22602 and replaces them with its own child-safety regime (our Adam's Law guide).

For an ordinary sales or support bot, the California rule is SB 1001 (Business and Professions Code 17941). It's unlawful to use a bot to mislead someone in California about its artificial identity in order to incentivize a purchase or sale or influence a vote, and a person who discloses that it's a bot isn't liable. So a bot named "Alex" with a generic greeting isn't automatically a problem. A bot that claims to be a human sales rep to close a deal is exactly what the law targets.

Texas TRAIGA applies narrowly compared to California. Its AI disclosure duty covers government agencies and health care providers, not private SaaS companies generally. Agencies must disclose before or at the time of the interaction; health care providers disclose by the date the service or treatment is first provided, or as soon as reasonably possible in an emergency. Penalties range from $10,000 to $12,000 for curable violations up to $200,000 for uncurable ones, plus up to $40,000 per day for continuing violations. If your company falls into TRAIGA's scope, the exposure is serious; if you are a typical private SaaS company outside health care, TRAIGA's disclosure provisions likely do not reach you directly.

Georgia SB 540, signed May 11, 2026 and effective July 1, 2027, applies specifically to AI companion chatbots rather than all chatbot interactions. If you are building compliance infrastructure now, you should build it to handle disclosure for companion-style AI products before the Georgia deadline. Enforcement is through the AG.

Utah's AI Policy Act has been in effect since May 2024 and was narrowed in 2025. The practical takeaway is its safe harbor: a bot that clearly and conspicuously says it's AI (or an AI assistant) at the outset and throughout the interaction isn't subject to enforcement under the disclosure rules.

New York enacted the AI Companion Models Law, effective November 5, 2025, requiring clear disclosure that users are interacting with AI rather than a human. The state legislature also passed a broader generative AI disclosure bill (A3411B) in March 2026, which awaits the governor's signature as of mid-2026. Even before these laws, the state AG has treated AI chatbot impersonation as a deceptive practice under existing consumer protection statutes. New York's regulatory posture toward chatbot disclosure is aggressive relative to most states.

Colorado's AI law was substantially rewritten in May 2026. SB 24-205 was replaced by SB 26-189, signed May 14, 2026, which eliminated the high-risk AI systems framework in favor of narrower rules around automated decision-making that affects consequential decisions. The new law takes effect January 1, 2027. For chatbot disclosure specifically, SB 26-189's requirements apply when the AI is involved in consequential decisions about a person, not to all customer-facing chatbot interactions. A support bot answering FAQs is lower risk than an AI system that determines loan eligibility or insurance coverage.

Which Platforms Handle Disclosure and Which Leave It to You

The chatbot platform you use matters, but not in the way most teams assume. None of the major platforms provide automatic legal compliance out of the box. They provide the tools to achieve compliance; your team has to configure those tools.

Intercom is the most widely used platform among SaaS companies in this audience. Intercom's Fin AI Agent does not automatically identify itself as AI in its greeting. The platform provides an option to customize the bot's introductory message, which is where you insert the disclosure. If you've deployed Fin without changing the default greeting, you're outside Utah's safe harbor and depend on the bot answering correctly every time someone asks. Intercom also allows you to configure a fallback response if the user asks whether they are talking to a human. That configuration is your responsibility.

Drift (now part of Salesloft) similarly does not require AI disclosure in its default configuration. The platform's bot builder lets you set an opening message and define responses to specific question patterns. You can configure a response to "Are you a bot?" that confirms AI status, but that routing rule must be explicitly built. There is no default compliance behavior.

Zendesk AI (formerly Answer Bot) operates within the Zendesk Support ecosystem and surfaces as an AI suggestion layer or a standalone bot depending on your configuration. Zendesk does not inject any disclosure into default bot flows. The platform's bot builder, now branded as Zendesk AI agents, allows custom introductory messages. Compliance requires a manual change to the greeting template.

Crisp is common among smaller SaaS teams and bootstrapped companies. Its bot feature, Crisp Bot, is a rules-based system that can be extended with AI. The platform provides no default AI disclosure, and its documentation does not reference state chatbot disclosure requirements. If you are using Crisp with an AI integration, you need to add a disclosure to the conversation opener manually.

HubSpot's chatbot builder, part of HubSpot Service Hub, gives you a customizable welcome message in the bot flow builder. By default it does not include an AI disclosure. HubSpot has published general guidance about AI transparency but does not configure disclosure for you. The compliance gap is in the setup, not the platform's capability.

Tidio is used by e-commerce and small SaaS teams. Its Lyro AI agent does not include a default AI disclosure. Tidio's setup flow does not prompt you to configure one. The gap is the same as the others: the tool supports compliance but does not enforce it.

The pattern is consistent across all six platforms: disclosure settings exist, but none are enabled by default, and the legal responsibility remains with you regardless of what the platform does or does not do. Platform terms of service explicitly place compliance obligations on the deploying company, not the platform vendor.

The one partial exception is if you are using a platform that has obtained specific legal certification or contractual representation that its default configuration is compliant in named jurisdictions. As of mid-2026, none of the major platforms have done this. If a vendor tells you their default setup is "compliant," ask them to put that in writing in the contract with indemnification. You will likely find the representation disappears.

6-Step Compliance Checklist

Work through these steps before your next deployment. Each step is discrete and can be assigned to a specific team member.

Step 1: Identify every AI-powered chat interface in your product. This includes customer support bots, sales qualification flows, in-app help assistants, onboarding wizards that use LLM responses, and voice AI if applicable. Create a simple inventory: interface name, platform used, geographic reach, and whether it currently discloses AI status. If you do not have this list, you cannot run a gap analysis.

Step 2: Map your user geography. If your product serves US users without geographic restriction, assume you have California, Texas, Utah, and Colorado users. You do not need to geo-fence for compliance purposes; the simpler path is to apply the strictest requirements to all users. If you have hard data showing you have no users in certain states, you can take a narrower approach, but user geography tends to shift faster than compliance configurations.

Step 3: Add a proactive AI disclosure to every chatbot greeting. The disclosure does not need to be prominent or lengthy. "I'm an AI assistant" in the first message gives a companion bot the up-front notice SB 243 asks for, and keeping it visible through the conversation puts you in Utah's safe harbor. Colorado's chatbot law (HB 26-1263) asks for more from January 1, 2027: the disclosure at the start of each day's first interaction and at least every three hours, or a persistent notice. It does not need to name the model, the vendor, or the training data. It needs to clearly communicate that the user is interacting with an AI, not a human.

Step 4: Configure a deny-on-inquiry prevention rule. In your chatbot platform, add a routing rule that catches direct inquiry about AI status ("Are you a bot?", "Am I talking to a real person?", "Are you human?", "Is this automated?") and responds with a confirmation of AI status. Do not route these questions to a fallback that says "I didn't understand that" or escalates to a human without answering the question first. In Utah a clear and unambiguous request is what triggers the duty to disclose, and in California a bot that dodges the question while selling looks like the deception SB 1001 bans.

Step 5: Review your bot's persona configuration for deceptive signals. A bot named "Alex" is not inherently non-compliant. A bot named "Alex" that claims to be a human customer success manager, uses "I've been with the company for three years" language, or is configured to deny its nature when asked is a compliance problem. Audit the bot's configured responses, persona instructions, and any LLM system prompt to confirm that nothing instructs the system to claim human status or deny AI status.

Step 6: Document your configuration and date-stamp it. If a user or a regulator complains, your ability to show you had a compliant disclosure configuration in place at the time of the alleged interaction is your primary defense. Screenshot or export your bot configuration, store it in your compliance documentation, and note the effective date. Do this after every material configuration change.

Sample Disclosure Language

These three variants cover the most common deployment contexts. Copy and adapt them to your product's voice.

Brief variant (recommended for most SaaS support bots):

"Hi! I'm an AI assistant. I can help with account questions, billing, and troubleshooting. Type your question to get started."

This variant gives the up-front notice the proactive rules above ask for and does not require the user to do anything to trigger the disclosure. It is suitable for any customer support or in-app help context.

Detailed variant (recommended for high-stakes interactions involving payments, account changes, or eligibility decisions):

"Hi! I'm an automated AI assistant, not a human support agent. I can help you with [specific use cases]. For anything outside those topics, or if you prefer to speak with a person, type 'human' at any time and I'll connect you."

This variant is appropriate where Colorado SB 26-189's consequential-decision rules may apply, or where your product touches decisions that have significant consequences for users. The explicit "not a human support agent" language is more protective than a general AI disclosure.

EU-friendly variant (for products with EU users, covering EU AI Act Article 50 obligations alongside US state requirements):

"I'm an AI chatbot. This conversation is handled by an automated system, not a human. You can ask to be transferred to a person at any time by typing 'connect me to a human.' Your conversation may be used to improve the service in accordance with our privacy policy."

This variant satisfies both US state proactive disclosure requirements and the EU AI Act Article 50 transparency obligation for AI systems interacting with natural persons. The privacy policy reference is required for GDPR compliance if conversation data is processed.

Before Your Next Chatbot Deployment

If you are shipping a new chatbot feature or upgrading an existing one, the compliance review should happen before the feature goes to production, not after. The checklist above takes two to four hours to complete for a single-platform deployment. Defending one lawsuit or AG inquiry costs far more.

The three things that create the most risk right now are: chatbots configured with a human persona that are not disclosing AI status proactively, chatbots that route "are you a bot?" questions to a deflection or escalation flow without answering, and teams that assume their chatbot vendor handles compliance.

None of the major platforms handle it for you. The disclosure configuration is always your responsibility. Run through the six steps above, add the disclosure language to your opening message, configure the deny-on-inquiry rule, and document what you did. That covers the minimum viable compliance posture for multi-state operations in 2026.

For the EU AI Act Article 50 chatbot and deepfake disclosure requirements, the obligations are parallel but technically distinct from the US state framework. If your product serves EU users, both frameworks apply and the EU requirements layer on top of the US ones. The EU-friendly disclosure variant above satisfies both.

Georgia SB 540 takes effect July 1, 2027 and applies specifically to AI companion chatbots. If your compliance configuration is solid now, adding Georgia to your covered states before that deadline is a five-minute configuration check, not a rebuild. Build once, cover all states.

For a broader view of the multi-state AI compliance strategy that goes beyond chatbot disclosure to cover data governance, model documentation, and consumer rights, that guide covers the full 2026 regulatory stack for SaaS companies operating across multiple US jurisdictions.

Correction (October 16, 2026): Earlier versions said a single "I'm an AI assistant" greeting satisfies Colorado's disclosure rules. Colorado's chatbot law requires the disclosure each day and at least every three hours, or a persistent notice (HB 26-1263).

Correction (October 20, 2026): An earlier version said TRAIGA's disclosure duty also covers "certain other regulated entities" and applies at the start of any AI-driven interaction. HB 149 Section 552.051 covers government agencies (before or at the time of interaction) and health care providers (by the first date of service) only (enrolled text).

Correction (October 20, 2026): An earlier version said California SB 243 covers every customer support chatbot, requires disclosure only when a user "sincerely asks," and lets any user sue over a denial. SB 243 (Business and Professions Code 22601-22606) covers companion chatbots, excludes bots used only for customer service, requires an up-front notice when a reasonable person could think the bot is human, and gives a civil action to a person who suffers injury in fact. The "mislead about its artificial identity" rule for sales bots is SB 1001 (Section 17941). We also corrected Utah: since the 2025 amendments, disclosure is required on a clear and unambiguous request, and up front only for high-risk interactions in licensed professions.

Related Reading

• Ambriz v. Google: AI Call Recording Consent Checklist
• Florida Safe Screens Act: AI Chatbot Rules for Minors
• NYC Chatbot Doom Loop Rule: Customer Service Checklist
• EU AI Act Article 50 chatbot and deepfake disclosure
• Georgia SB 540 AI chatbot compliance 2027
• California SB 942 AI transparency act compliance
• Texas TRAIGA compliance checklist
• AI acceptable use policy template
• FTC AI enforcement actions 2026
• New York AI synthetic performer ad disclosure law, effective June 9 2026
• Italy Fines Character.AI €158K: Age Verification and Child Safety Failures
• California Adam's Law SB 1119: 3 Chatbot Compliance Deadlines Starting July 2027
• State AG AI chatbot lawsuits tracker: Florida v. OpenAI update
• Utah Pro-Human AI Executive Order 2026-08: Vendor Answer Sheet
• Pennsylvania SB 806 AI Ad Disclosure: Text, $3,000 Fine, Checklist