Over the past year, state after state has passed a law regulating AI chatbots — California, New York, Washington, Oregon, Hawaii, Maine, with more drafting. The coverage has been loud, the headlines use the word "chatbot" without qualification, and a reasonable person running a company with a support bot on their website has concluded they're probably now regulated.
We went and read the statutes. The answer is more interesting than either the panic or the shrug.
There are two different families of law here, and they keep getting merged
Nearly every "states are regulating chatbots" story is about companion chatbot laws — and those were written for a specific and genuinely serious problem: AI systems designed to simulate emotional relationships, and what happens when a teenager forms one.
They were not written about the bot that tells your customer whether you're open on Saturday. And the drafters knew it, because they said so, in the text.
The second family is much quieter, almost never makes headlines, and is the one that actually reaches an ordinary business chatbot. We'll get there — it's the part worth your attention.
The companion laws: read the exclusions
California, SB 243 — signed October 13, 2025, in effect since January 1, 2026, and the first of its kind. It carries a private right of action with a $1,000-per-violation floor, which is why it got attention. But the statute defines a "companion chatbot" as a system "capable of meeting a user's social needs," and then explicitly excludes bots used only for customer service, a business's operational purposes, productivity and analysis, or technical assistance.
New York — General Business Law Article 47, in effect since November 5, 2025. The text is blunt about it. An "AI companion" excludes:
"any system used by a business entity solely intended to provide users with information about available commercial services or products, customer account information, or other information related to a user's customer, or potential customer, relationship with such business entity."
That is a description of a business service bot, written into the law as a thing the law is not about.
Hawaii, SB 3001 — signed this week, and the newest AI law in the country. It defines an "AI companion" as a system designed to simulate a sustained human-like relationship by doing three things: retaining information across sessions to drive ongoing engagement, asking unprompted emotion-based questions that go beyond answering what the user asked, and sustaining dialogue about matters personal to the user. All three. A bot that answers billing questions fails every prong on purpose. Hawaii also states plainly that nothing in it creates a private right of action — enforcement runs through the attorney general.
Oregon (SB 1546) uses a near-identical three-part test and takes effect January 1, 2027.
Four states, four drafting committees, same conclusion: they are regulating the thing that simulates a relationship, not the thing that looks up your order.
Washington is the closest call — and it's our home state
We're in Seattle, so we read Washington's HB 2225 more carefully than the rest. It passed in March 2026 and takes effect January 1, 2027. Violations run through the state Consumer Protection Act.
Washington's definition is the broadest of the bunch. An "AI companion chatbot" is an AI system with a natural language interface giving adaptive, human-like responses, "including by exhibiting anthropomorphic features, and is able to sustain a relationship across multiple interactions."
Anthropomorphic features. Our chat assistant is named Ash. Our voice agent is named Aria. They have personalities, because a nameless bot is a worse experience. So let's take the uncomfortable question seriously instead of skipping it.
Here's the exclusion, verbatim, from Section 2(1)(b)(i). A bot is not a companion chatbot if it's:
"used only for a business' operational purposes, productivity and analysis related to source information, internal research, technical assistance, or customer service, if such bot does not sustain a relationship across multiple interactions and generate outputs that are likely to elicit emotional responses in the user"
Read that conjunction closely, because everything turns on it. To lose the exclusion, a business bot has to do both things — sustain a relationship across multiple interactions and generate outputs likely to elicit emotional responses. Not either. Both.
A support bot that remembers your last ticket is doing the first. It is not doing the second, and no amount of naming it Ash makes it do the second. Having a name is not the test; manufacturing feelings is the test.
There's a second, independent reason too. Washington defines "user" as a natural person who interacts with the bot "for personal use." Someone asking a vendor's bot about an invoice is not there for personal use.
So: two separate paths out, on the text of the strictest law in the country on this point. But we'll say the honest part out loud — if you market your bot on emotional engagement, on being a friend, on how much users love talking to it, you are walking toward that line rather than away from it. The exclusion protects a tool. It does not protect a companion you've dressed up as a tool. That's a product decision, not a legal one, and it gets made long before a lawyer sees it.
The law that actually applies to you
Now the part that gets no coverage.
Maine's chatbot disclosure statute (10 M.R.S. §1500-DD) is not a companion law. It defines an "artificial intelligence chatbot" as, essentially, any software that simulates human conversation — and then says:
"A person may not use an artificial intelligence chatbot or any other computer technology to engage in trade and commerce with a consumer in a manner that may mislead or deceive a reasonable consumer into believing that the consumer is engaging with a human being unless the consumer is notified in a clear and conspicuous manner that the consumer is not engaging with a human being."
No customer-service carve-out. No companion requirement. No exemptions at all. Violations are enforced as unfair trade practices.
That statute reaches your support bot. And notice how little it asks: the prohibition is on misleading people into thinking they're talking to a human. Tell them it's a bot, and you're done. The entire compliance burden is one sentence at the top of the conversation.
This is the shape of the whole regulatory picture, honestly summarized: the laws that sound terrifying almost certainly don't apply to you, and the law that does apply asks for the thing you should already be doing.
So: does your chatbot have to say it's a bot?
Legally, in most states, today: no statute forces it for an ordinary business service bot. In Maine, yes — if a reasonable consumer might otherwise think they're talking to a person. And more states are drafting in that direction, not away from it.
But answer it as an operator instead of a lawyer and the question dissolves. The disclosure costs you one line. Concealment buys you nothing — people work out they're talking to a bot within two exchanges regardless, and the only thing you've earned by hiding it is the moment they realize you tried. That moment is more expensive than any statute.
Every deployment we run discloses. Not because Maine says so. Because a customer who knows they're talking to software and gets a fast, correct answer is a satisfied customer, and a customer who feels tricked is a support ticket with a grudge.
What to actually do
- Disclose at the start of the conversation. One clear sentence. Not buried in a tooltip, not in the privacy policy, not on hover.
- Don't let it claim to be human. If someone asks "am I talking to a person?", the honest answer is the only safe answer — and several of these laws specifically require the bot not to refute its own disclosure.
- Don't design for emotional attachment. A name and a personality are fine. Manufactured feelings, guilt about leaving, prompts to come back and talk — that's the behavior these laws target, and it's what moves you from "tool" to "companion" in the text.
- Give people a way to a human. Not legally required in most places. It's the thing that makes the disclosure land as confidence rather than a warning.
- Re-check if you sell into Maine, or in 2027. Washington and Oregon land January 1, 2027. This area is moving fast, and this post is a snapshot dated the day it was written.
That's the entire list. It's shorter than the headlines suggested, and you were probably going to do most of it anyway.
Related reading: Is an AI receptionist even legal? — the call-recording and disclosure rules for voice, including why the “AI robocall” panic is about outbound calling and not about you, and what our own deployed agent sounds like on a real business line.
Related solution: explore our AI knowledge assistant and AI voice agents — built, disclosed, and managed for you.