Do I have to tell users they're talking to an AI?

When US state laws and the EU AI Act require an AI disclosure, what a good disclosure looks like, and how to check your product for it.

Short answer

Often yes, and the safest design is to disclose every time. No single US law requires it everywhere, but several state laws do in common situations, the EU AI Act does for products used in the EU, and a clear disclosure costs almost nothing. The risk comes from products that let users reasonably believe they are talking to a person.

Laws that commonly apply

• California's bot disclosure law requires a bot that communicates with people in California to disclose that it is a bot when it is used to encourage a purchase or influence a vote.
• California's companion-chatbot law (SB 243), in effect since January 1, 2026, requires companion-chatbot operators to disclose that the chatbot is AI if a reasonable person could think it is human, and to maintain and publish suicide and self-harm protocols with crisis referrals. For users the operator knows are minors, it adds AI reminders and break prompts at least every three hours, limits on sexual content, and a suitability warning. People injured by a violation can sue for at least $1,000 per violation.
• New York's companion-chatbot law, in effect since November 5, 2025, requires AI disclosure at the start of an interaction and at least every three hours during continued use, plus detection of suicidal ideation and self-harm with crisis referrals. In October 2026, New York enacted further restrictions on companion features considered unsafe for minors, such as simulated human relationships and encouraging emotional dependence. The published statute says they take effect January 1, 2027. The sponsor has announced a move to June 1, 2027 that had not been enacted as of this guide's date.
• Utah amended its AI law in May 2025. In ordinary consumer transactions, a business must disclose that the consumer is dealing with generative AI when the consumer clearly asks. In regulated professional services, high-risk interactions (involving sensitive information or personalized advice on significant decisions) need prominent disclosure up front: spoken at the start of a voice interaction, or written before a written one. A business can't escape consumer-protection liability by blaming the AI. Separate rules for mental health chatbots require disclosure before first use, after seven days without use, and whenever asked.
• Colorado replaced its original AI Act in May 2026. The replacement, the Automated Decision-Making Technology Act, takes effect January 1, 2027 and focuses on notice, explanations of adverse decisions, and human review when automated systems are used in consequential decisions about people. A separate Chatbot Safety Act also takes effect January 1, 2027.
• The EU AI Act's transparency rules (Article 50) have applied since August 2, 2026. People must be told when they are interacting with an AI system unless it is obvious, and certain AI-generated or manipulated content, including deepfakes, must be marked or disclosed. A transition period for some content-marking duties runs to December 2, 2026 for systems already on the market; it does not delay the chatbot disclosure.
• The FTC Act prohibits deceptive practices generally. Passing an AI off as a human, for example in customer service or reviews, can be deceptive even where no AI-specific law applies.

The companion-chatbot laws target AI companions built for sustained personal interaction. They don't automatically apply to every customer-service bot or general assistant, but a product that drifts into companionship can fall within them. Other states have similar bills pending, and requirements for health, legal, and financial conversations are growing fastest.

What a good disclosure looks like

• Clear and early. At the start of the conversation, not in the terms of service.
• Repeated when it matters. In long sessions, in voice calls, and when the AI hands off to or from a human.
• Honest when asked. The product should never deny being an AI, even in a persona or role-play.
• Persistent in the interface. A label on the chat window or the AI's messages works better than a one-time notice.
• Outbound too. When your agent emails, calls, or messages people who are not your users, it should say it is an AI acting for a named person or business.

Checklist an agent can run against the codebase

• Find every surface where users or third parties interact with AI output: chat, voice, email, SMS, notifications, reviews, support.
• For each one, find where the AI disclosure is shown, or note that none exists.
• Check the system prompts and personas for instructions to claim to be human or to avoid saying it is an AI.
• Check what happens when a user asks "Am I talking to a real person?"
• Check outbound messages the agent sends for an AI disclosure and the name of the person or business it acts for.
• If the product is a companion, coach, or confidant, check for crisis-response handling and age safeguards.
• If the product knows a user is a minor, check for recurring AI reminders and break prompts during long sessions.
• Check whether AI-generated images, audio, or video are marked as AI-generated if the product serves EU users.

If this applies to you

An AI feature review covers disclosures with the rest of the AI feature: provider terms, consent, and state and EU requirements. For one surface, such as adding a voice agent, a pre-build feature check covers that change.