AI Conversation Disclosure: What to Tell Customers and When

AI conversation disclosure means telling a person, at the right moment and in plain terms, that they are talking to an AI system and not a human. The EU makes this a legal duty for most customer-facing chatbots. In the United States the duty depends on the state, the context and whether the AI use could affect a purchase decision. This guide sets out what each regime requires, how to word and place the notice, what a disclosure policy should contain, and how to confirm that the notice is delivered in real conversations.

Lexic AI

Strengthen oversight of AI conversations

Lexic Compass independently assesses conversational AI agents and provides evidence to help you govern them in production.

Explore Lexic Compass

TL;DR

Under EU AI Act Article 50, people must be told they are interacting with AI unless it is obvious. The notice is due from the start of the first interaction, and the obligation applies from 2 August 2026.
US rules are a patchwork. The federal baseline turns on whether AI use is unexpected and material, and states such as Utah, California, New Jersey and Colorado each set different triggers.
A notice buried in terms of service or behind a link does not meet the standard. It must be clear, distinguishable and visible at the first message.
Disclosure alone is not enough. Regulators also expect accurate answers and a working route to a human.
A policy is only as good as its verification. Reviewing real conversations is the only way to know the notice is actually given.

What AI conversation disclosure means
EU AI Act Article 50: the strictest baseline
United States: federal baseline and state variations
Other jurisdictions that shape the standard
Does disclosure change customer behavior?
How to present the disclosure so customers notice it
What an AI disclosure policy should cover
Verifying that disclosure happens in real conversations
Auditing disclosure with Lexic
Our perspective: disclosure is a conversation-level control
FAQ
Sources

What AI conversation disclosure means

AI conversation disclosure is the practice of informing customers that they are interacting with an AI system. The European Commission describes the purpose as enabling informed decisions and calibrated trust. A customer who knows a chatbot is on the other end can adjust what they share, how much they rely on its answers, and whether they ask for a person.

The topic goes by several names: AI usage disclosure, AI disclosure policy, AI disclosure requirements. They describe three layers of the same subject:

The notice. The words and placement customers see at the start of a conversation.
The policy. The internal rules that decide when a notice is required, who owns it and how it is reviewed.
The evidence. Proof, drawn from actual conversations, that the notice was shown and that the agent behaved as the policy says.

Most companies write the first two and skip the third. That gap is where compliance risk sits.

This article covers customer-facing disclosure: voice agents, chat assistants, email responders and ticket bots. It does not cover the separate question of whether the conversations people hold with public AI tools remain confidential.

EU AI Act Article 50: the strictest baseline

Article 50(1) of the EU AI Act requires providers of AI systems that interact directly with natural persons to ensure those people are informed they are dealing with AI, unless that is obvious. The Commission’s guidance states the obligation applies from 2 August 2026. A shorter grace period running to 2 December 2026 concerns specified content-marking duties, not the chatbot-interaction notice.

The main elements are:

Timing. The notice must be provided from the start of the first interaction.
Form. It must be clear and distinguishable, and it must follow accessibility requirements.
Scope. Background processing, machine-to-machine exchanges and interactions with no direct contact with people fall outside this obligation.
The “obvious” exception. It is assessed from the perspective of an average person who is reasonably well informed, circumspect and observant. The Commission says it should be interpreted restrictively because it removes a transparency safeguard.

The practical reading is simple. If a customer could plausibly think a human is typing or speaking, disclose. Legal analysis from Stibbe adds that realistic, human-like interfaces make the exception harder to defend. A named avatar, a natural voice or conversational phrasing all push toward a visible notice.

US companies are affected too. A US business that deploys a customer-service agent for customers in the EU should assume Article 50 applies to that deployment and design the notice accordingly.

The privacy layer

Disclosure that an agent is AI is separate from disclosure about personal data. GDPR Articles 12 to 14 require concise, transparent, intelligible and easily accessible information about processing, and Microsoft’s GDPR guidance notes that chatbot deployments may require updated privacy notices. Where an AI makes automated decisions, a CJEU ruling analyzed by Bristows indicates that the explanation owed to a person must describe the procedure and principles actually applied, not just a mathematical formula, and that trade secrets do not automatically remove that duty.

United States: federal baseline and state variations

The US has no single AI conversation disclosure statute. DLA Piper’s January 2026 analysis says the federal baseline under the FTC Act generally calls for disclosure when chatbot use is unexpected and material. Material here means likely to affect a consumer’s choice or conduct in a commercial context. State laws can then be broader or narrower.

The same analysis describes how the states differ:

State	What the law targets
New Jersey	Sales or advertising of merchandise or real estate; disclosure at the start
California	Intent to mislead someone about a bot’s artificial identity in order to deceive them about content and encourage a transaction
Colorado	High-risk, consequential interactions, unless the AI is obvious
Utah	Question-triggered disclosure, plus rules for high-risk professional services

Maine is also among the states covered in that analysis.

Utah in detail

Utah’s statute is useful because it shows two distinct models in one section. Under Utah Code §13-77-103, effective 7 May 2025, a supplier using generative AI in a consumer transaction must disclose AI use when the individual clearly and unambiguously asks whether AI is being used. The same section separately requires regulated professionals to prominently disclose generative-AI use in high-risk regulated services: verbally at the start of a verbal interaction, and in writing before a written interaction.

Two lessons follow. First, an agent must answer the question “Are you a real person?” truthfully, every time, in every channel. Second, a company operating in regulated sectors cannot rely on question-triggered disclosure alone.

Because these laws change often, confirm the current text of each state statute before launch. A single national deployment will meet several of these regimes at once, so the safest design is to disclose at the first message everywhere.

Other jurisdictions that shape the standard

Several non-EU regulators have published guidance that US companies with international customers should know.

United Kingdom. UK consumer law requires businesses to give consumers the information they need to make informed decisions and not to mislead them. The Department for Business and Trade’s March 2026 guidance says businesses should tell customers when AI use might lead them to believe a real person is providing the service and the distinction could affect their decisions. It also says businesses remain responsible for what their AI agents do, even when another provider supplies the system, and that they must not overstate AI capabilities.

Netherlands. On 2 October 2025 the Dutch data protection authority (AP) and consumer authority (ACM) said organizations using chatbots must make the chatbot nature clear, prevent incorrect, evasive or misleading information, and keep offering an option to speak with an employee. Their position, set out in a joint statement on chatbots in customer service, is that transparency alone is insufficient.

Alberta, Canada. The province’s guidance takes a lighter line. Businesses are not generally required to tell consumers they are interacting with AI, but AI agents must not present themselves as real people and must clearly identify the business they represent. AI errors and representations are treated like those of human agents.

The pattern across these regimes is consistent. Even where a blanket notice is not mandated, nobody permits an AI to pass as a human, and the business owns what the agent says.

Comparison of AI disclosure guidance in three jurisdictions

Does disclosure change customer behavior?

Some teams hesitate to disclose because they fear customers will disengage. The evidence is more nuanced than that fear suggests. A peer-reviewed study in AI & Society, published in January 2024, combined eight interviews with an experiment involving 194 participants. It found no significant experimental effect from disclosing versus not disclosing a customer-service chatbot.

The same study reports that users cared more about the agent’s willingness to help and its friendly tone than about its artificial status. It also warns that a disclosure may be missed, or that the word “chatbot” may not be understood, so merely identifying a bot may not produce meaningful transparency.

Three conclusions follow for practitioners:

Disclosure is unlikely to be the reason a conversation fails. Poor help is.
Wording matters. Plain statements such as “You are chatting with an AI assistant” work better than a label customers may not parse.
Showing a notice and having the customer register it are different things. That is a reason to check what actually happens in conversations.

How to present the disclosure so customers notice it

The Commission’s requirement is that the notice be clear and distinguishable, delivered from the start of the first interaction and compliant with accessibility requirements. Stibbe’s July 2026 analysis adds that Article 50 does not mandate one format, but that burying the notice in terms, behind a URL or in technical documentation is inadequate, and that vulnerable users should be considered.

Applied by channel:

Chat. Put the statement in the first message or a persistent banner, not only in a footer. Make sure screen readers can read it.
Voice. State it in the opening seconds of the call, in spoken words. A text notice on a website does not cover a phone line.
Email and tickets. Add a visible line at the top of automated replies, not only in the signature.
Messaging apps. Use the first automated message, since there is no landing page where a customer would see a banner.
Handoffs. When a conversation moves between AI and a person, say which one is now responding.

Good wording is short, specific and paired with a path forward: “You are speaking with an AI assistant. Type ‘agent’ at any time to reach a person.” It avoids vague labels, avoids a human first name for an AI persona unless the AI status is stated next to it, and does not claim abilities the agent lacks.

What an AI disclosure policy should cover

A written policy turns the legal requirement into repeatable practice. The UK guidance gives a workable outline: assign business responsibility, tell customers when AI use could affect their decisions, test agents before deployment, monitor performance regularly and provide human oversight. Based on that and the regulatory material above, a policy should contain these elements:

Ownership. One named role is accountable for AI agent conduct across vendors. Because the business stays responsible even when a third party supplies the system, vendor contracts do not move the accountability. Frameworks for assigning AI team roles help define who approves, who monitors and who escalates.
Scope and triggers. List every channel and use case where an AI agent talks to customers, and state which rule set applies in each market served.
Notice standard. Approved wording by channel, placement rules, accessibility checks and the languages covered.
Truthful-answer rule. The agent must answer honestly when asked whether it is an AI, and must not claim to be human.
Human escalation. A defined route to a person, with conditions that trigger it, consistent with the Dutch expectation that a human option remain available.
Accuracy and claims. Controls that stop agents from giving incorrect, evasive or misleading information or overstating what the AI can do.
Privacy notice alignment. Links between the disclosure and the data-processing information required under GDPR where it applies.
Records and review. What is logged, how long, who reviews it and how often the policy is revisited.

Keep the policy short enough that operations teams actually use it. A twenty-page document that no agent designer reads protects nobody.

Verifying that disclosure happens in real conversations

A policy states intent. Verification shows outcomes. The UK guidance says businesses should monitor AI agents regularly for correct results, intended behavior and consumer-law compliance: test performance before deployment, review customer exchanges and complaints, and have humans check decisions and outputs.

A practical verification program has four parts:

Pre-launch testing. Run scripted conversations across channels and check that the notice appears at the first message, that “are you human?” is answered truthfully, and that escalation works.
Sampling is not enough. Reviewing a handful of transcripts misses the long tail. Conversations that go off-script, such as a frustrated customer demanding a person, are where disclosure and escalation fail.
Vendor independence. Logs and dashboards supplied by the agent’s own vendor describe what the vendor chooses to report. A compliance team that must defend its position to a regulator is better served by evidence gathered independently of the system being assessed.
Complaint loops. Treat complaints that mention “I thought I was talking to a person” as compliance signals and route them to the policy owner.

Escalation is the weakest point in practice. Lexic’s audits of conversational AI agents found that 85% of audited agents failed to escalate issues properly to human representatives. A notice that promises a human option is worthless if the agent does not deliver one.

Auditing disclosure with Lexic

Lexic provides an independent audit and governance platform for conversational AI agents. It audits agents from any vendor, without building or operating agents itself, and checks real-world behavior: regulatory compliance, security vulnerabilities, escalation handling and customer disclosure in AI-driven conversations.

Lexic Compass is the audit product. Engagements are available as a Flash Preview, an Audit Sprint or Enterprise Continuous Trust, described on the Compass audit page. For ongoing visibility, Lexic Pulse analyzes 100% of customer conversations across calls, chats, emails and tickets, adding sentiment, churn and opportunity insights for CX, product, QA and operations teams. More about the company is at lexic.ai.

Our perspective: disclosure is a conversation-level control

We see the same pattern when we examine AI agents in production. Companies write a disclosure line, approve it once and assume the question is closed. Then the agent is retrained, a vendor updates a model or a new channel is added, and the line disappears or the agent answers a direct question evasively.

We hold that disclosure should be treated as a control that is tested continuously, not a sentence in a launch checklist. Three principles guide our work:

Independence matters. An auditor that does not build or run the agent has no reason to soften findings, and a compliance team can show a regulator evidence that does not come from the vendor under review.
Coverage matters. Disclosure failures are rarely in the average conversation. They are in the unusual ones, which only full coverage of conversations reveals.
Human and AI interactions belong in one view. Customers experience a single service. When AI hands off to a person, or fails to, the gap shows up in both transcripts.

Our 85% escalation finding points to the same conclusion: stating that a human is available and delivering one are separate tasks, and only the second protects the customer.

— Sergio Llorens

FAQ

Do US companies have to disclose that a chatbot is AI?

There is no single federal rule. The FTC Act baseline generally calls for disclosure when chatbot use is unexpected and material to a consumer’s decision, and states such as Utah, California, New Jersey and Colorado set their own triggers. A US company serving EU customers should also plan for Article 50. The simplest approach is to disclose at the first message in every market.

What can a customer ask that must trigger disclosure?

In Utah, a supplier using generative AI in a consumer transaction must disclose AI use when the person clearly and unambiguously asks whether AI is being used. Regardless of state, an agent should never deny being an AI when asked. Build and test this answer for chat, voice and email.

Can AI use be considered obvious so no notice is needed?

Under the EU AI Act, the exception is judged from the viewpoint of a reasonably well-informed, observant person and is interpreted restrictively. Human-like voices, names and phrasing weaken the argument. If there is doubt, disclose.

Is disclosure enough to comply?

No. The Dutch regulators expect accurate, non-misleading answers and a continuing option to reach an employee. UK guidance holds the business responsible for its AI agents’ conduct even when a vendor supplied them, and recommends testing, monitoring and human oversight.

How can a company check whether its agents actually disclose?

Review real conversations across all channels, not only test scripts, and include escalation requests and direct questions about whether the customer is talking to a person. Independent audits of agents from any vendor give compliance teams evidence that does not depend on the vendor’s own reporting.