Telling Customers They Are Talking to AI: Disclosure Rules and Practice

By Linh Ngo · Updated Oct 11, 2026

AI disclosure means telling a customer, at the start of an interaction and in plain words, that they are dealing with an AI system and not a person. It is a legal duty in some places and a trust practice everywhere. The rules differ by jurisdiction, and they differ on a key question: do you have to say it up front, or only when someone asks?

This guide covers three sets of rules (the EU AI Act, California's bot disclosure law and Utah's AI Policy Act), then moves to what works in practice: wording for chat, email and voice, a rollout plan, and the mistakes that undo a good disclosure. It sits inside the AI for Customer Service collection, so if you want the wider picture first, read the overview of AI in customer service. This article is general information, not legal advice. Have counsel confirm which rules reach your business.

Key Facts

• Article 50(1) of the EU AI Act requires AI systems that interact directly with people to be designed so those people are informed they're dealing with AI, unless that is obvious to a reasonably well-informed, observant and circumspect person (EU AI Act, Article 50).
• The Act applies generally from 2 August 2026, so the chatbot disclosure duty is already live (EU AI Act, Article 113).
• The EU information must be given at the latest at the time of the first interaction, in a clear and distinguishable manner (EU AI Act, Article 50).
• California's law became operative on 1 July 2019 and treats a clear, conspicuous disclosure that a bot is a bot as the way to avoid liability (Cal. Bus. & Prof. Code 17943, 17941).
• Utah's rule, as amended in 2025, triggers when a consumer makes a clear and unambiguous request to know whether they're talking to a human or an AI (Davis Polk).
• Disclosing up front satisfies all three, which is why it's the simplest policy for a team that serves customers in more than one place.

What the Law Requires, Jurisdiction by Jurisdiction

Three rules matter most for a support team. They overlap, but they're not the same, and the differences decide how you design your opening message.

The EU AI Act, Article 50

Article 50(1) puts the main duty on providers. In plain terms, an AI system meant to talk directly to people has to be built so that those people are told they're dealing with AI. The exception is narrow: it doesn't apply where the fact is obvious from the point of view of a reasonably well-informed, observant and circumspect person, given the circumstances and context of use (EU AI Act, Article 50).

Two details from the same article matter operationally. First, timing: the information must be provided in a clear and distinguishable manner at the latest at the time of the first interaction or exposure. Second, it must meet applicable accessibility requirements. A tiny grey footer line fails both tests (EU AI Act, Article 50).

The Act applies from 2 August 2026, and that date has now passed (EU AI Act, Article 113). One related change is worth knowing. Law-firm reporting on the Digital Omnibus on AI says that the separate machine-readable marking duty in Article 50(2), which falls on providers of systems that generate synthetic content, was postponed to 2 December 2026, while the other transparency duties, including those that apply to deployers, continued to apply from 2 August 2026 (JD Supra). The chatbot disclosure duty in 50(1) is not the one that moved.

If you buy a support bot rather than build one, the design duty sits mainly with your vendor. But you still decide how the bot is deployed, so ask the vendor how the disclosure is built in and whether you can edit its wording. If you build your own bot or modify a bought one substantially, assume you may be treated as the provider and own the duty. Counsel can tell you which side of that line you're on.

Article 50(3) adds a separate duty for deployers of emotion recognition systems: they must inform the people exposed to the system of its operation (EU AI Act, Article 50). If your voice analytics scores customer sentiment from audio, that is a second disclosure to plan, and it connects to the questions raised in empathy in AI customer service.

California: Bus. & Prof. Code 17940-17943

California's rule is narrower in what it punishes and clearer in how it lets you off the hook. The statute makes it unlawful to use a bot to communicate or interact with another person in California online, with the intent to mislead them about its artificial identity, in order to incentivize a purchase or sale of goods or services in a commercial transaction, or to influence a vote in an election. A person using a bot isn't liable if they disclose that it's a bot, and the disclosure must be clear, conspicuous, and reasonably designed to inform the people the bot interacts with that it's a bot (Cal. Bus. & Prof. Code 17941).

The definitions narrow the scope. A "bot" is an automated online account where all or substantially all of the actions or posts of that account are not the result of a person, and "online" means a public-facing website, web application or digital application, including a social network or publication (Cal. Bus. & Prof. Code 17940). The chapter does not impose a duty on service providers of online platforms, such as web hosting and internet service providers (Cal. Bus. & Prof. Code 17942). It became operative on 1 July 2019 (Cal. Bus. & Prof. Code 17943).

Whether a pure support bot falls inside the law is debated. One law-firm analysis argues that retailers using bots for customer service have a reasonable argument that the law doesn't apply, because customer service functions don't incentivize a purchase or sale (Steptoe). That argument gets thinner the moment your support bot recommends upgrades, plans or add-ons. A bot that mixes service and selling should be treated as in scope.

Utah: the Artificial Intelligence Policy Act

Utah took a different approach: disclose when asked. Under the 2025 amendments, the trigger for the general consumer rule is a clear and unambiguous request to find out whether the interaction is with a human or with AI. Separately, people in regulated occupations must prominently disclose at the start of a high-risk interaction, meaning one that involves collecting sensitive personal information such as financial, health or biometric data, or giving personalized advice that could reasonably be relied on for significant personal decisions (Davis Polk).

The same source reports that the amendments took effect on 7 May 2025 and that the Act's repeal date was extended to July 2027. The practical lesson for support teams is the "on request" part: if a customer types "are you a real person?", the answer must be true, every time, immediately.

Why Disclose Even When the Law Doesn't Make You

Legal minimums describe the floor. Customers set the real standard. The question isn't only "must we?" but "what happens to trust if they find out later?" A customer who feels tricked has little reason to trust anything the bot said, including the correct answers. What customers expect from AI service covers the expectation side in more depth.

There's also an operational reason. A customer who knows the bot is a bot is more willing to ask for a person, which is the escape hatch you want them to use early, not after three rounds of frustration.

Finally, disclosure is cheap compared with unwinding a mistake. A single sentence in the first message costs almost nothing. Reversing a reputation for pretending to be human costs far more.

Disclosure by Channel: Chat, Email and Voice

The principle is the same everywhere (say it early, say it plainly, give an exit), but each channel needs its own mechanics. How AI behaves across support channels covers the broader channel differences.

Chat

Chat is the easiest channel because you control the first screen. Put the disclosure in the opening message itself, not only in a settings page, and make the bot's name and avatar signal what it is. Avoid human names and stock photos of smiling agents. Keep a visible "talk to a person" option in the window for the whole conversation.

Sample opening: "Hi, I'm the virtual assistant. I'm an AI, not a person. I can help with orders, billing and account questions, and I can pass you to a teammate any time."

Email

Email has no live "first message" moment, so disclose in two places: the sender identity and the body. A sender name like "Support Assistant (AI)" tells people before they open the message. Then add one line near the top of each AI-written reply, not buried in a signature block.

Sample line: "This reply was written by our AI assistant. Reply to this email and ask for a person any time, and a teammate will take over."

When a human reviews and edits an AI draft before it goes out, think about what you're claiming. A message sent under a person's name that was largely written by AI sits in a gray area, so decide your policy in advance. The automate or assist decision matters here: assist-mode drafts reviewed by a human are a different disclosure case from fully automated replies.

Voice

Voice is where the risk is highest, because a natural-sounding synthetic voice can pass as human with no visual cues at all. Under Article 50, the "obvious from context" exception is judged from the point of view of a reasonably well-informed person, and a convincing voice is exactly the case where it may not be obvious (EU AI Act, Article 50). So don't lean on it.

Say it in the first seconds, before the customer starts explaining their problem. And say it in speech, not only in a text message sent afterward.

Sample greeting: "Thanks for calling. You're speaking with an automated AI assistant. I can help with most account questions, or I can transfer you to a person at any time. How can I help?"

If you record or analyze the call, that's a separate notice, covered under customer data privacy in AI support.

How to Implement Disclosure Step by Step

Here's a sequence that works for most teams. It takes days, not months, because the wording is short and the checks are simple.

1. List every place an AI speaks to customers. Include the obvious ones (chat widget, voice line) and the forgotten ones (email auto-replies, in-app help, social messaging, AI-written drafts that agents send under their own names).
2. Map where your customers are. Note whether you serve people in the EU, California or Utah, and whether your bot ever promotes products. This tells you which rules might apply.
3. Pick one disclosure standard for everyone. Don't build region-by-region exceptions. A single up-front disclosure satisfies the timing language in Article 50 and the "clear and conspicuous" standard in California, and it makes Utah's on-request rule trivial.
4. Write the wording. Short, plain, no jargon. Say "AI," not "virtual agent" alone, since a label like that can read as a human title.
5. Add the truthful-answer rule. If a customer asks whether they're talking to a person, the bot must say it's AI, even if the system prompt tells it to sound friendly or stay in character. Test this with several phrasings, including "are you human?", "is this a real person?" and questions in other languages.
6. Build the exit. Every disclosure should come with a way to reach a person. Implementing AI in customer service covers handoff design.
7. Check accessibility. The EU text requires the information to meet applicable accessibility requirements (EU AI Act, Article 50). Make sure screen readers pick up the label and that the spoken version isn't the only one for deaf or hard-of-hearing users.
8. Log it. Keep a record that the disclosure was shown or spoken in each conversation.
9. Retest after every change. Run the "are you human?" script after each prompt change and vendor update.

Pitfalls to Avoid

Disclosing only in the terms of service. A link in a footer is not a clear and distinguishable notice at the time of first interaction. Put it where the customer is looking.

Letting the bot deny being AI. This is the most damaging failure. A bot instructed to "be warm and natural" that answers "I'm a real person" to a direct question can create legal exposure in Utah, undermines the safe harbor in California, and defeats the purpose in the EU.

Human-sounding personas. A name like "Sarah" with a headshot sends the opposite signal from your disclosure line. If you want a friendly name, pick one that is obviously not a person's, and let the label do the work.

Hiding the exit. Disclosure without a route to a human feels like a trap. Tie them together, and decide which topics go to people by default using the automate or assist framework.

Ignoring the risk register. Disclosure is one control among several. AI customer service risks shows where it fits alongside accuracy, privacy and escalation controls.

Sample Wording You Can Adapt

These are templates. Adjust the tone to your brand and have counsel review them for your markets.

The last line is a placeholder: whether you can offer an opt-out, and what the law requires for that kind of analysis, depends on your markets and your tooling, so get a legal read before you ship it.