AI Disclosure Laws: What Your Business Has to Say Now
If a customer talks to your chatbot, your voice agent or your DM flow, disclosure rules may already apply to you. Here is what to say and where to say it.
Most operators adopting AI tools have not thought about disclosure at all, because nobody selling the tools raises it. If a customer of yours talks to a chatbot, a voice agent or an automated DM flow, there is a growing set of rules about telling them so, and the first consequence usually arrives from a platform rather than a regulator.
Three separate layers, not one
Operators treat this as a single legal question. It is three, and they bite in a different order.
Platform rules bite soonest and hardest. Meta's Messenger Platform policy requires automated chat experiences to disclose that the person is interacting with an automated service. That applies to a simple keyword autoresponder, not just a model. Breaking it risks the account, which for a business running on Instagram is the whole channel.
Regional law is the second layer. Article 50 of the EU AI Act sets transparency obligations including informing people when they are interacting with an AI system. Several US states have bot-disclosure provisions aimed at commercial interactions. If you serve customers across borders, the strictest rule you touch is effectively your rule.
Advertising law is the third and the one people forget. Claims about what your AI does are subject to the same truth-in-advertising rules as any other claim. "Our AI never misses a call" is a factual claim you have to be able to support.
This is a moving area. Treat anything you read, including this, as a prompt to check the current position for your jurisdiction rather than a settled answer.
What a disclosure actually looks like
It is one sentence, at the start, in the customer's path.
For a chat widget: a line in the opening message saying this is an automated assistant and a person is available. For a voice agent: the first thing said on the call. For DMs: the first automated message, which is also where the platform rule applies most directly.
What does not count is a mention in your privacy policy, a line in the footer, or a disclosure that appears after the customer has already answered three questions. The test is whether a reasonable person knew what they were dealing with before they invested anything in the conversation.
A workable pattern, in plain words:
You are chatting with the automated assistant for Northside Plumbing. I can book, quote and answer the usual questions. Say "person" at any point and I will pass you to Dana.
That does three jobs in two sentences. It discloses. It sets expectations about capability. And it gives an exit, which is the part that keeps the interaction from feeling like a trap.
The handoff is part of the obligation
Disclosure without an escape route is a half measure, and platform rules tend to require both. Meta's policy expects bots to respond to all user input rather than ignoring what they cannot parse.
So the practical requirement is an automation that knows its own edges. When a customer types something outside the flow, the correct behaviour is to hand off, not to repeat the menu. A flow built only on buttons fails this the moment somebody types a real question, which they will.
This is the single most common gap we see in automations built from templates. The disclosure line gets added because someone read the policy. The handoff does not, because it requires knowing who is on the other end during business hours.
Why early disclosure is a commercial advantage
The reflex is to see this as friction. In practice it is the opposite for a service business.
Customers have adjusted faster than most operators expect. Being told at the start that an assistant is handling intake, with a named human one word away, reads as a business that has its act together. Being caught pretending is what damages trust, and it damages it in public, in a review.
There is also a search argument. Content and systems that are clear about what they are tend to be treated better by the platforms ranking them, and Google's own guidance on creating helpful content is built around whether a person is well served. Transparency is cheap insurance in both directions.
Two places operators get it wrong
Treating the website chat as the only surface. The chat widget usually gets a disclosure because it is the thing that looks like AI. The voice agent answering the phone, the DM autoresponder and the missed-call text are the ones customers actually meet first, and they are routinely silent about what they are.
Disclosing and then undermining it. An assistant that introduces itself as automated and then signs off with a first name, uses typing indicators to simulate thinking, and claims to be "checking with the team" has disclosed and then spent the rest of the conversation implying the opposite. Pick one. If the assistant is automated, let it be competently automated.
There is a related judgement call about names. Giving an assistant a human first name is common and is not itself deceptive, provided the disclosure is clear and the handoff is real. Giving it a name and then letting customers believe it is staff is the version that turns up in complaints.
If you are starting from zero on any of this, how to start with AI automation without the hype is the sequencing piece, and the disclosure work belongs near the front of it rather than after launch.
The checklist worth running this week
Walk your own customer paths and answer one question at each: would someone know?
- The chat widget on your site, opening message
- The voice agent, first ten seconds of the call
- Instagram and Facebook DM flows, first automated reply
- SMS auto-replies, including missed call text back
- Review request and follow-up sequences
For each one that fails, the fix is a sentence. It is an hour of work in total for most operators, and it closes the platform risk, which is the one that can take a channel away from you. Write the line once, in your own voice, and reuse it everywhere so the wording stays consistent across channels. Then record the date you checked, because these rules are changing fast enough that an annual review is the minimum sensible cadence.
Our piece on AI automation mistakes service businesses make covers the adjacent failures, and your first 30 days with AI automation puts this in the order it should be tackled. If you would rather have the disclosure, the handoff and the platform-policy surface handled as a standing concern, that is what Compliance Guardian does.
If you want a second pair of eyes on which of your customer paths currently fail that test, the AI Strategy Call is built for exactly that review.
Frequently asked questions
Do I legally have to tell customers they are talking to AI?
It depends on where your customer is and what the AI is doing. The EU AI Act requires people be informed when interacting with an AI system, several US states have bot-disclosure rules, and the platforms you run on impose their own. The practical answer is to disclose everywhere, because the cost of doing so is close to zero.
Where does the disclosure have to appear?
At the start of the interaction, before the customer has given you anything. A line at the top of a chat, the opening sentence of a voice call, and the first automated DM. Burying it in a privacy policy does not count.
Does this apply to a simple keyword autoresponder?
Platform rules usually apply regardless of sophistication. Meta requires automated chat experiences to disclose that the person is dealing with automation, and that covers a keyword flow as much as a model.
What happens if I do not disclose?
The platform risk arrives soonest, because a policy violation can restrict the account you sell from. Regulatory exposure varies by jurisdiction and is still developing, which is a reason to be early rather than a reason to wait.
Does disclosure hurt conversion?
Less than being caught. Customers mind being deceived far more than they mind automation that is useful and hands off cleanly to a person when asked.