AI Governance Reference
Ten Laws. Ten Different Triggers.
A list of which states have chatbot laws is close to useless. What determines whether you are compliant is what switches each duty on, and no two of these agree.
A disclosure banner on your website satisfies two of the laws below. The rest require something your chatbot does at runtime, or they do not apply to you at all. Sorting by state produces a list you cannot act on. Sorting by trigger produces a build specification.
Every statute below links to the primary source. Where a claim rests on a practitioner summary rather than statutory text, that is stated. Verification dates are August 25 and August 27, 2026. This area has moved repeatedly in the last eighteen months.
Correction to an earlier version of this page
An earlier version stated that New Jersey has no enacted bot disclosure law reaching real estate. That was wrong, and the error is instructive. New Jersey's law is a bot statute enacted in January 2020, not a chatbot statute, so it does not appear in the AI legislative trackers most of this industry relies on. It is codified, it is in force, and it names real estate expressly. It is now the first entry below.
Group 1. Broad commercial disclosure
These reach ordinary business chatbots. If you operate in these states, assume you are in scope.
New Jersey
N.J.S.A. 56:18-2, L.2019, c.486 · in force since 2020
What switches it on
Using an online bot to communicate or interact with a person in New Jersey in connection with the sale or advertisement of any merchandise or real estate, or to solicit support in an election. No intent element. No company-size threshold. Real estate is named in the statute.
What you must do
Disclose at the outset of the communication, in clear and conspicuous fashion, that the interaction is being conducted by or through a bot. A start-of-conversation disclosure satisfies this.
Enforcement
Codified in Title 56, the unfair trade practices title. Sections 56:18-1 through 56:18-3 carry the definitions, the notification duty, and a provision making these obligations cumulative with other law.
This is the closest statutory fit in the country for a leasing bot. Every other law on this page reaches multifamily by inference. This one says real estate. It has been on the books since before most leasing bots were deployed, and almost nobody in this industry knows it exists, because it was written about ticket bots and election manipulation rather than artificial intelligence.
Maine
10 MRSA section 1500-DD, P.L. 2025 c. 294 · effective September 24, 2025
What switches it on
Using a chatbot in trade or commerce in a manner that may mislead or deceive a reasonable consumer into believing they are engaging with a human being. No intent element. No company-size threshold.
What you must do
Notify the consumer clearly and conspicuously that they are not engaging with a human being.
Enforcement
A violation is a violation of the Maine Unfair Trade Practices Act.
Note the standard. The trigger is not whether you deceived anyone. It is whether the manner of use may mislead. A human name, a human face, and a written personality are the most effective tools available for producing exactly that condition.
Utah
AI Policy Act, SB 149, as amended by SB 226 and SB 332 · amendments effective May 7, 2025
What switches it on
The consumer asks. A supplier using generative artificial intelligence in connection with a consumer transaction owes disclosure if the individual asks or otherwise prompts about whether artificial intelligence is being used. The prompt must be clear and unambiguous. Up-front disclosure without being asked is owed only in a regulated occupation and only in a high-risk interaction, meaning one collecting sensitive personal information or involving significant decisions in health, financial, legal, or mental health matters.
What you must do
Answer truthfully and conspicuously that the individual is interacting with generative artificial intelligence and not a human. This is a runtime behavior, not a banner. Your bot must answer the question correctly every time it is asked, in any phrasing. A safe harbor is available to operators whose system discloses at the outset and throughout.
Enforcement
Division of Consumer Protection. SB 332 extended the repeal date of the Artificial Intelligence Policy Act to July 1, 2027, so the chapter sunsets unless renewed.
Citation warning. SB 149 originally placed this duty at Utah Code 13-2-12. SB 226 repealed that section outright. The live citation is Utah Code Title 13, Chapter 77, Generative Artificial Intelligence, Consumer Disclosures and Enforcement. Compliance records and vendor contracts that still cite 13-2-12 are citing a repealed provision.
Open question for our industry. Real estate is a licensed occupation in Utah. Whether property management performed through a chatbot is a regulated occupation, and whether a leasing conversation is a high-risk interaction under the amended standard, are questions for Utah counsel. The 2025 amendments narrowed this considerably. We are not aware of guidance resolving it.
Group 2. Companion chatbot laws
These target emotional companionship, and each carries a business or customer service exclusion. A leasing bot most likely sits outside all five. Read the exclusions anyway, because the way they are written is the point.
New York
General Business Law Article 47, sections 1700 to 1704 · effective November 5, 2025
What switches it on
A three-part relationship test, and the three prongs are joined by and, not or. Under section 1700(4)(a), an AI companion is a system designed to simulate a sustained human or human-like relationship by retaining information on prior interactions and user preferences to personalize the interaction and facilitate ongoing engagement, and asking unprompted or unsolicited emotion-based questions that go beyond a direct response to a user prompt, and sustaining an ongoing dialogue concerning matters personal to the user. All three must be present.
The exclusion, in the statute's own words
Section 1700(4)(c)(i) excludes any system used by a business entity solely for customer service or to strictly provide users with information about available commercial services or products provided by that entity. Subsections (ii) and (iii) exclude systems primarily designed and marketed for efficiency improvements, research, or technical assistance, and systems used solely for internal purposes or employee productivity.
What you must do
Disclose at the start of interaction and every three hours of continued use, plus operate a crisis detection and referral protocol. Both duties run to every user, not only known minors.
Enforcement
Attorney General only, civil penalties reported at up to 15,000 dollars per day. No private right of action.
Note the first prong. Retaining information on prior interactions and user preferences to personalize the interaction is the same capability Colorado lists as evidence of simulated companionship and Oregon writes into its definition. Three states, drafted independently, reached for memory as the marker.
Read the exclusion words carefully. Solely and strictly are doing the work. A bot that provides information about available apartments sits comfortably inside the phrase about information on available commercial services or products. A bot that also asks how someone's day is going, remembers them across visits, and keeps the conversation going is no longer doing that solely. New York did not write a customer service exemption. It wrote an exemption for a system that does nothing else.
California, companion chatbots
SB 243, signed October 13, 2025 · effective January 1, 2026 · annual reporting from July 1, 2027
What switches it on
Operating a system that simulates human companionship for California users, regardless of where the operator sits. Bots used only for customer service, business operational purposes, productivity, and analysis are expressly excluded. Disclosure is owed only where a reasonable person would be misled into believing they are interacting with a human.
What you must do
AI disclosure, suitability warnings, crisis prevention protocols, and for minors, recurring break reminders and content restrictions.
Enforcement
Private right of action. Section 22605 authorizes recovery of the greater of actual damages or 1,000 dollars per violation, plus attorney fees.
Two California bills to watch, doing different things. AB 410, titled Bots, disclosure, would amend SB 1001 to require disclosure without the current intent element, which would reach customer service contexts directly and move that law out of Group 3 and into Group 1. AB 1609, the Right to Human Customer Service Act, is not a disclosure bill at all. It would establish a right to reach a live agent and limit hold times. Both remain pending and neither is enacted. Track them by subject rather than by number, because the numbers get confused in trade coverage.
Washington
ESHB 2225, Chapter 168, 2026 Laws, approved March 24, 2026 · effective January 1, 2027
What switches it on
A system using a natural language interface that provides adaptive human-like responses and sustains relationships across multiple interactions. Business-oriented bots, video game dialogue, general virtual assistants, consumer electronics interfaces, and narrow educational tools are excluded.
What you must do
Disclose that the chatbot is artificially generated and not human, repeated every three hours for adults and every hour for minors, plus a protocol for detecting and addressing suicidal ideation or expressions of self-harm.
Enforcement
Violations are deemed to affect the public interest and constitute an unfair or deceptive act in trade or commerce under the Consumer Protection Act, carrying a private right of action. Full bill history.
Read this exclusion carefully. The business exclusion does not apply if the chatbot sustains a relationship across multiple interactions and generates outputs likely to elicit emotional responses. Washington wrote the conditionality directly into the statute. The business carve-out is something you can build yourself out of.
Oregon
SB 1546, enrolled, passed both chambers March 5, 2026 · effective January 1, 2027
What switches it on
Operating an artificial intelligence companion, meaning a system that simulates a sustained human-like relationship and retains contextual information across interactions to personalize engagement. The definition of operator reaches anyone who controls or makes available a covered system in Oregon, which includes systems licensed from a vendor.
What you must do
Detect expressions of suicidal ideation or self-harm, interrupt the conversation, and refer to crisis resources. Avoid reward schedules that maximize engagement time, avoid simulated distress or guilt when a user tries to leave, and make no material misrepresentation about whether the user is interacting with artificially generated output, including when directly asked. Report crisis referral counts publicly by December 31 each year.
Enforcement
Private right of action for individuals who suffer loss or injury. Statutory damages reported at 1,000 dollars per violation. Confirm the damages figure against the enrolled text.
The misrepresentation clause reaches further than the title suggests. Making a material misrepresentation about whether a user is interacting with artificially generated output, including when the user directly asks, is prohibited conduct in the enrolled bill. That is the same runtime behavior Utah requires, arriving through a companion statute.
Colorado, Chatbot Safety Act
HB 26-1263, signed May 29, 2026 · operator duties begin January 1, 2027
What switches it on
Operating an AI system accessible to the general public that primarily simulates human conversation through adaptive text, visual, or aural communication. Twelve exemptions apply at 6-1-1701(3.5)(b), including one for commerce-related and transactional assistance and one for output relating to a narrow and discrete topic.
What you must do
Estimate user age, disclose AI status to users, operate a suicide and self-harm protocol, apply minor protections, avoid representing outputs as equivalent to licensed professional services, and report annually to the Attorney General beginning July 1, 2027.
Enforcement
Attorney General under the Colorado Consumer Protection Act. Proposed implementing rules were filed with the Secretary of State August 11, 2026 and are open for comment through October 26, 2026.
A note on the signing date. The General Assembly bill record shows May 29, 2026. The Attorney General's rulemaking page states July 1, 2026 in one paragraph and May 2026 in another. The legislative record controls. Expect to encounter the July date in secondary summaries that trace back to that page.
The anthropomorphism factors live here. In determining whether a service is designed to simulate emotional companionship under 6-1-1701(3.5)(b)(XI) and (XII), Proposed Rule 8.2 directs the Department to weigh a totality of the circumstances, including whether the service includes anthropomorphic design features such as personalized dialogue and the ability to assign a chatbot a name, gender, avatar, or fictional backstory; whether its training, production, and deployment prioritized, promoted, or failed to address sycophantic behavior or outputs that simulate empathy and offer users nonjudgmental responses and continual validation; and whether it has the ability to recall and respond to users' characteristics, preferences, and past conversations.
The bounded task exemption is conditional. Rule 8.2 also addresses the narrow and discrete topic exemption at 6-1-1701(3.5)(b)(III). It reaches menu-based, button-based, and rule-based chatbots, but only as long as those chatbots cannot generate outputs related to sexually explicit conduct or engage in a dialogue or conversation related to suicidal ideation or self-harm. A general purpose model sitting behind an open text field can do both. This exemption is something you build for. It is not something you receive.
The comment window is open right now
Written comments on the proposed Colorado rules are accepted through October 26, 2026, the date of the formal rulemaking hearing. Comments submitted by September 4, 2026 will be considered for a revised draft the Department expects to circulate no later than September 23, 2026.
Rental housing has a direct stake in how the commerce exemption and the narrow topic exemption are finally worded. That record is being built now, and it will close before most of the industry knows the rulemaking happened. Proposed rules and comment portal.
Group 3. Intent and decision standards
Neither of these is a disclosure law in the ordinary sense.
California, bot disclosure
Business and Professions Code 17940 to 17943, SB 1001 · operative July 1, 2019
What switches it on
Using a bot online with the intent to mislead about its artificial identity, for the purpose of knowingly deceiving a person about the content of the communication, in order to incentivize a purchase or sale of goods or services. This is an intent standard, and the hardest on this page to trip accidentally.
What you must do
Nothing, if you disclose. Disclosure that is clear, conspicuous, and reasonably designed to inform is a complete safe harbor.
A common misreading. The ten million monthly visitor threshold in section 17940 governs what platforms must do about reports. It does not limit the prohibition on the party operating the bot. Your disclosure duty is not gated by traffic volume.
Colorado, ADMT Act
SB 26-189, signed May 14, 2026 · effective January 1, 2027
What switches it on
Not conversation. Automated decision-making technology that processes personal data and materially influences a consequential decision, which includes housing. A chatbot is in scope only if it feeds a decision.
What you must do
Developer documentation, consumer notice at the point of interaction, explanation of adverse outcomes, correction rights, meaningful human review where commercially reasonable, and record retention. This is a logging and explanation regime, not a banner.
Two Colorado laws, one rulemaking. SB 26-189 and HB 26-1263 are separate statutes with separate triggers, and the August 11 rulemaking covers both in a single package. SB 26-189 repeals and reenacts what was originally passed as SB 24-205. A summary that describes only one of these is describing half of what arrives on January 1, 2027.
What this means for how you build
Read the triggers together and a specification falls out. It does not require picking a state.
- Disclose at the start of every conversation, in plain words. This satisfies New Jersey and Maine outright and puts you inside California's safe harbor.
- Make the bot answer the question correctly. When a person asks whether they are talking to a human, in any phrasing, the answer must be accurate. Utah requires this. Oregon prohibits the misrepresentation. Test it adversarially, because people ask in ways your script does not anticipate.
- Know what your bot remembers. Retaining contextual information across sessions to personalize engagement is a trigger prong in New York, part of the definition in Oregon, and a listed factor in Colorado. If you do not need it, turn it off.
- Do not tune for warmth and validation. Colorado lists sycophantic behavior and outputs that simulate empathy and offer continual validation as a factor. Washington asks whether outputs are likely to elicit emotional responses. Oregon prohibits reward schedules designed to maximize engagement.
- Keep it bounded, and prove it. Colorado's narrow topic exemption reaches menu-based and rule-based chatbots only where they cannot generate sexually explicit content or hold a conversation about suicidal ideation or self-harm. An unconstrained model attached to a leasing website fails both conditions, and the failure is demonstrable by anyone who types into the box.
- Name it what it is. Every trigger above resolves to the same question: did the person know what they were talking to. A human name argues against you under every one of them.
Bills that are not law, and are cited as though they are
Two patterns worth knowing, because both produce coverage that reads like an obligation.
New Jersey has pending bills on top of its enacted law. A4730 would require notice when generative artificial intelligence is used in trade or commerce. A4732 would address companion chatbots. A4728 would regulate deceptive use of artificial intelligence in photo advertising of a dwelling for sale, rent, or lease, and was referred to Appropriations in May 2026. A4728 is written directly at our industry and is worth tracking. None of the three is law. The enacted obligation in New Jersey today is N.J.S.A. 56:18-2, described above.
Utah House Bill 438 failed. It would have created a Companion Chatbot Safety Act with an August 1, 2026 effective date. It passed the House, cleared a Senate committee, reached a fifth substitute, and then failed in the Senate on March 5, 2026 and was filed as not passed the following day. A bill that advances that far generates a great deal of coverage. Utah's obligation remains the AI Policy Act as amended, nothing more.
Also In Force, Outside This Scope
The Federal Trade Commission Act reaches deceptive practices nationwide. The Commission announced five enforcement actions under Operation AI Comply in September 2024. A state without a chatbot statute is not a state without exposure.
Mental health impersonation laws in Tennessee, Illinois, Nevada, and Utah restrict AI presenting itself as a licensed professional. Utah addressed this in HB 452 in 2025. Relevant to any bot that might be asked a mental health question, which is any bot with an open text field.
Oregon HB 2748, effective January 1, 2026, is a nursing title protection act. It prohibits an artificial intelligence agent from using professional nursing credentials. It does not reach general commercial chatbots, so a leasing bot is outside it. Included here only because it is sometimes cited as a broad Oregon AI impersonation law, which it is not.
State wiretapping statutes are producing a separate wave of class actions over chat sessions recorded and shared with third-party vendors without consent. If your chat vendor processes transcripts, this is a distinct exposure from anything on this page and worth a conversation with counsel.
Primary Sources
New Jersey, N.J.S.A. 56:18-2
New Jersey Revised Statutes, Title 56. Enacted as L.2019, c.486. See also Title 56 index for sections 56:18-1 and 56:18-3.
Maine, 10 MRSA section 1500-DD
Office of the Revisor of Statutes. Reallocated from section 1500-Y. The exact effective date in September 2025 could not be confirmed at the Revisor and is stated here only to the month.
Utah, Utah Code Title 13, Chapter 77
Generative Artificial Intelligence, Consumer Disclosures and Enforcement. The live citation. See also the SB 226 enrolled copy, which repeals 13-2-12 and enacts this framework.
California, SB 1001
California Legislative Information. Codified at Business and Professions Code 17940 to 17943.
California, SB 243
California Legislative Information. Companion chatbot requirements.
New York, General Business Law section 1700
New York State Senate. Definitions for Article 47, Artificial Intelligence Companion Models, sections 1700 through 1704, enacted as Part U of the 2025-26 Executive Budget. A mirrored version of the full article is easier to browse section by section.
Washington, ESHB 2225 session law
Washington State Legislature. Chapter 168, 2026 Laws. Bill history.
Oregon, SB 1546 enrolled
Oregon Legislative Information System. Measure overview.
Colorado, HB 26-1263, Chatbot Safety Act
Colorado General Assembly. The twelve exemptions appear at 6-1-1701(3.5)(b).
Colorado, SB 26-189, ADMT Act
Colorado General Assembly. Repeals and reenacts the provisions originally passed as SB 24-205.
Colorado, proposed ADMT and Chatbot Safety Rules
Colorado Department of Law. Filed with the Secretary of State August 11, 2026. This page carries the rules document, the notice of rulemaking hearing, the statement of basis and purpose, and the comment portal. Rule 8 governs the exemptions.
Verification. Every statute described on this page was checked against the linked statutory or session law text. The New York definition and exclusions are quoted and paraphrased from section 1700 itself. The Colorado Rule 8.2 factors and narrow topic conditions were read directly from the rules document filed with the Colorado Secretary of State on August 11, 2026. Two items remain unconfirmed against statutory text and are labeled as such in place: the Oregon SB 1546 statutory damages figure, and the status of the two pending California measures, both of which were pending and unenacted as of this writing. Verification dates August 25 and August 27, 2026.
This reference is written for general information and is not legal advice. Whether a specific conversational AI service falls inside or outside any exemption is a determination for your own counsel.
