Put a chat widget on your website in 2026 and you're no longer just making a design choice — you may be triggering a legal disclosure obligation. Over the past eighteen months, state legislatures have gone from zero laws regulating AI chatbots to more than a dozen, and the requirements aren't identical from state to state. A support bot that's perfectly compliant in Texas can be a violation in Colorado.
If your business uses any kind of AI-powered chat — a sales assistant, a support widget, an appointment scheduler, or a "talk to us" bubble in the corner of your site — this is worth twenty minutes of your time. Here's what actually changed, which states apply to you, and what a reasonable small business response looks like.
Why This Happened So Fast
The wave of chatbot legislation didn't start with customer service bots. It started with tragic cases involving "companion" chatbot apps — AI characters designed to simulate friendship or romantic relationships, some of which were linked to self-harm among teenage users. Lawmakers moved quickly to require disclosure, age verification, and crisis-response protocols for that category of product.
But several states wrote their bills more broadly than "companion apps only," and that's where it gets relevant to an ordinary business. A law aimed at emotionally manipulative AI companions can, depending on its drafting, also sweep in a plain FAQ bot that answers shipping questions — because both are "conversational AI that simulates human conversation." Whether your chatbot is covered depends entirely on how a specific state chose to draw that line.
The States With Laws on the Books (or Nearly There)
As of mid-2026, roughly a dozen states have enacted some form of chatbot regulation, with more pending: California, Colorado, Connecticut, Georgia, Idaho, Iowa, Nebraska, New York, Oregon, Rhode Island, Washington, and Tennessee, with Hawaii's bill awaiting signature. They fall into three rough buckets.
Bucket 1: Broad scope — covers most public-facing conversational AI
Colorado, Idaho, Iowa, and Nebraska took the widest approach. Their laws generally apply to any conversational AI service accessible to the general public that primarily simulates human conversation — not just companion or romance apps. If your website chatbot holds a back-and-forth conversation with visitors, this category is written broadly enough to potentially include it.
Colorado is the clearest example, and it actually has two separate pieces of law that businesses often conflate:
- Colorado AI Act (SB 24-205) — requires "reasonable care" to avoid algorithmic discrimination, but only when a system makes or substantially influences a "consequential decision" (credit, employment, insurance, housing, healthcare, education). A standard product-recommendation or FAQ bot generally doesn't trigger this one. Major provisions take effect June 30, 2026.
- Colorado Chatbot Safety Act (HB 26-1263) — signed May 29, 2026, effective January 1, 2027. This is the broad one: any public-facing conversational AI operator must disclose that users are talking to AI, run a self-harm detection and response protocol, take steps to estimate and protect minor users, never present the bot as equivalent to a licensed professional, and file an annual report with the state Attorney General. Violations are treated as Colorado Consumer Protection Act infractions — up to $1,000 per occurrence.
If you have customers in Colorado and a chatbot on your site, HB 26-1263 is the one to read closely before it takes effect.
Bucket 2: Consequential-decision or high-risk triggers only
Utah took a narrower path. Under its AI Policy Act (SB 149, as amended by SB 226), disclosure is required only when a user directly asks whether they're talking to AI, or during high-risk interactions involving health, financial, or biometric information. A garden-variety "how can I help you today?" bot that never touches those categories has a lighter compliance burden here.
Bucket 3: Companion/romantic chatbots specifically — with a business chatbot debate underway
California's SB 243, in effect since January 1, 2026, is the most-cited law nationally, but it's important to read the fine print: it targets companion chatbots — the reasonable-person-would-be-misled-into-thinking-it's-human standard, plus mental-health crisis protocols and minor protections. Ordinary customer service chatbots are expressly excluded from SB 243.
That exclusion may not last. A separate bill, AB 1609, would specifically regulate customer service chatbots for large private businesses — prohibiting them from being represented as human and imposing penalties of up to $5,000 for a first violation and $10,000 for each subsequent one. It hasn't passed as of this writing, but it signals where California is headed: the "customer service bots are fine" carve-out is not guaranteed to survive.
New York's AI Companion Models statute (Gen. Business Law § 1700 et seq., effective November 2025), Oregon's SB 1546 (signed March 2026, effective January 1, 2027, with a private right of action carrying $1,000 in statutory damages per violation), and Washington's Chatbot Disclosure Act (effective January 1, 2027) all follow this companion-focused pattern with varying levels of private lawsuit exposure. Tennessee's SB 1580, effective July 1, 2026, is narrower still — it just bars AI from presenting itself as a licensed mental health professional.
What This Means If You Run a Small Business
Most small businesses using chatbots aren't running companion apps — you're running a support widget, a lead-qualification bot, or an AI phone assistant. Here's the practical read:
- Know where your customers are. If you sell or serve customers in Colorado, Idaho, Iowa, or Nebraska, assume your chatbot is in scope even if it's a plain support bot — these states wrote the broadest definitions.
- A simple disclosure costs you nothing and covers most bases. A one-line "You're chatting with an AI assistant" notice at the start of a conversation, or a persistent label near the chat widget, satisfies the disclosure requirement in essentially every version of these laws. It's cheap insurance against a law you may not have even known applied to you.
- Never let your chatbot claim to be a licensed professional. Several laws specifically bar AI from presenting itself as a doctor, therapist, or lawyer. If your bot fields health, legal, or financial questions, make sure its scripting doesn't drift into that territory — and route sensitive topics to a human.
- Watch California if you're a "large" business. AB 1609's penalty structure (large private business threshold, $5,000/$10,000 penalties) is aimed at bigger companies, but it's worth tracking if you're scaling toward that size — retrofitting compliance after a bill passes is more expensive than building it in from the start.
- Document your minor-safety approach if your product could reach teens. Age-estimation and content restrictions are recurring requirements across nearly every one of these laws, especially where self-harm content is a risk.
The Bookkeeping Angle: Compliance Costs Are Real Costs
Whether it's a $99/month upgrade to a chatbot platform that adds a disclosure banner, a lawyer's hour reviewing your terms of service, or a support agent's time updating scripts, chatbot compliance work has a dollar figure attached — and it belongs in your books as a real operating expense, not an afterthought buried in "software" or ignored entirely. Businesses that track compliance and legal spend as its own category can actually see, come tax time or a strategy review, how much regulatory overhead a given feature or state market is costing them — information that's easy to lose when everything gets lumped into one vague expense account.
Simplify Your Financial Tracking as You Navigate New Rules
As state AI regulations keep multiplying, the businesses that adapt fastest are the ones with clear, accessible financial records — the kind that make it easy to see exactly what compliance, legal, and software costs are doing to your margins. Beancount.io offers plain-text accounting that's transparent, version-controlled, and easy to audit, so you're never digging through a black-box tool to answer a simple question about your own numbers. Get started for free and keep your books as clear as the rules you're trying to follow.