Say It's a Bot: Disclosure Laws Are Reaching the AI That Sells and Serves

Revenue teams have spent two years putting AI in front of buyers and customers: website chat that qualifies leads, AI SDRs that answer replies, voice agents that book meetings, and service bots that field renewal questions. Most of that rollout was governed by product decisions and brand guidelines. It is now being governed by statute. A growing set of state laws requires a bot to say it is a bot, and the newest of them no longer stops at companion apps. At the same time, fresh consumer data shows the commercial penalty for staying quiet arrives well before any regulator does.

The Law Is Moving From Companions to Commerce

The first wave of chatbot statutes targeted companion and mental health bots, and most of them carve out business tools. As a June analysis from Wiley Rein notes, many of these laws exempt chatbots used solely for operational purposes such as customer service or technical assistance. Connecticut's SB 5, which took effect October 1, 2026, follows that companion-focused pattern, with disclosure at the start of each interaction and every three hours during continued use.

The laws that matter to a CRO are the ones without that carve-out. Maine's Act to Ensure Transparency in Consumer Transactions Involving AI, in force since September 2025, requires disclosure whenever a chatbot could lead a reasonable consumer to think a human is on the other side, and treats a violation as a breach of the Maine Unfair Trade Practices Act. Utah's SB 226 takes a lighter approach: a bot must disclose when a consumer clearly asks, with a safe harbor for companies that disclose "at the outset of and throughout the interaction," and a prominent disclosure is required regardless of request in regulated high-risk interactions such as financial services.

Colorado goes further. HB26-1263, signed on May 29, 2026, defines a conversational AI service as any AI system accessible to the general public that primarily simulates human conversation, and it applies to anyone who makes such a service publicly available or offers one to a consumer. Operators must tell users the service is artificial intelligence, alongside protections for minors and a self-harm protocol. The legislature's summary lists no exemption for customer service or sales use, and the operator requirements take effect January 1, 2027. A lead-capture bot on a public website, an AI agent answering inbound chat, or a voice agent fielding calls all look like conversational services under that definition.

Customers Are Enforcing It First

For most revenue teams the more immediate pressure is commercial. Ping Identity's 2026 survey of 11,000 consumers across 12 countries, conducted by Talker Research and published October 7, found that 56% say knowing whenever AI is used matters more to them than getting the fastest result. In the US, 63% want to know when AI is used. The penalty for getting it wrong is blunt: 20% would leave a website immediately if they suspected undisclosed AI, and 20% would never use that brand again.

The same survey shows how little latitude customers grant AI that acts on their behalf. Globally, only 5% are comfortable with AI acting with their approval, and 3% with routine transactions without final approval. Buyers who will not let an agent spend money for them are unlikely to forgive one that pretended to be a person.

Disclosure alone is not the whole answer. A Five9 survey of 3,000 consumers, reported by CX Dive, found that 41% of customers are less likely to use a company that uses AI for customer service, rising to 53% when there is no way to reach a human. Offer a clear path to a person and the picture flips: about four in five are willing to use AI service, and 55% trust it, against about one quarter when no human option is available. Five9's separate survey of 600 contact center and CX decision-makers ranked consumer consent and notification among their top three AI implementation challenges, behind only data security and privacy, and reliability.

Why This Lands on the Revenue Org

Disclosure rules tend to get filed under legal or the contact center, but the bots in question increasingly sit in the revenue funnel. The AI that greets a website visitor, qualifies an inbound lead or handles a renewal question is the first impression a buyer forms of the company, and it is now an impression with a statutory script. Gartner's Christopher Sladdin put the standard plainly: "Every AI use case needs to be labeled, disclosed and explained, with opt-outs and ease of escalation or recourse."

The patchwork makes a single, conservative standard the cheapest option. Building to Utah's ask-and-answer rule in one state and Colorado's always-disclose rule in another means maintaining two versions of every conversational flow, and a public website does not know which state its visitor is in. Disclosing at the start of every interaction satisfies the strictest current requirement and, according to the survey data, costs nothing with customers who mostly want to know anyway.

The CRO Playbook: Disclose Early, Escalate Fast

• Inventory every bot that talks to buyers. List each chat, email, voice and SDR agent across marketing, sales and service, who owns it, and which states its users are in.
• Disclose at the start, every time. Adopt the Colorado standard everywhere so no flow depends on a visitor asking the right question or on knowing which state they are in.
• Make the human handoff obvious. Put a visible route to a person in every AI conversation, since that single option roughly doubles customer trust in Five9's data.
• Audit AI-written outreach. Review whether AI SDR emails and voice agents could lead a reasonable buyer to believe a person wrote or spoke them, the test Maine already applies.
• Measure the reaction, not just the deflection. Track satisfaction, drop-off and escalation rates on AI-handled conversations before and after disclosure changes, and report them alongside pipeline metrics.
• Put the January 2027 date on the roadmap. Treat Colorado's effective date as a hard deadline for script, vendor contract and audit trail changes rather than a legal footnote for later review.

The temptation with customer-facing AI has been to make it sound as human as possible and hope nobody asks. That strategy is running out on both fronts. State law is beginning to require the answer before the question, and a fifth of customers say they will walk the moment they suspect it. The revenue teams that label their bots plainly and keep a person one click away will lose nothing to the new rules, and may win trust their quieter competitors are spending.