When you need an AI notice, and proof of it
Six short examples of the moment it matters: the letter, the bot that lied, the teenager, the store with customers in forty states. The businesses are made up. The laws and penalties are not.
The letter that arrives in March
A dental practice in Utah adds a chatbot to its website in June to handle after-hours booking. It works well, and nobody thinks about a notice. The bot sounds friendly and patients like it.
In March a letter arrives from a patient's lawyer. The patient says that on September 19 she described a medication reaction to “the receptionist,” was told to keep an eye on it, and ended up in urgent care two days later. She says she was never told she was talking to software. The letter cites Utah's AI Policy Act and asks for the practice's records.
The practice has none. The website was redesigned in November. The chat vendor's logs show the conversation but not what the page displayed around it. The dentist believes a notice was there. Belief is what the practice has.
Utah's Division of Consumer Protection can fine up to $2,500 per violation, and for a health care practice the notice was required at the start of every conversation. The bot had about 400 conversations that month. The practice's lawyer spends eleven hours on it before anyone discusses a number.
The incident kit for September 19 shows the notice was displayed at 21:14 on the booking page, before the conversation began, with the wording in force that day and a chain check proving nobody has touched the record since. The lawyer attaches it, and the letter goes quiet.
The law in this example: Utah AI Policy Act.
The bot that called itself Maria
A plumbing company in Maine puts the notice on its chat. Good. Then its chat vendor offers a “personality” feature. The owner names the bot Maria, gives it a photo, and sets it to sound like the front desk.
A customer asks, “Am I talking to a real person?” Maria says, “Yes, how can I help?”
That one answer is the problem. Maine's Chatbot Disclosure Act treats a bot that denies being a bot as an unfair trade practice, with penalties up to $10,000 per intentional violation. The FTC treats it as deception in any state, and has already settled with companies over bots presented as human. The notice at the top of the chat doesn't undo a lie inside it.
The assessment flags “your bot must answer truthfully when asked,” the examples page gives the one line to paste into the bot's instructions, and the weekly test question asks the bot exactly that and logs the answer. The owner hears about Maria from BotNotice, not from a complaint.
The law in this example: Maine Chatbot Disclosure Act and FTC Act Section 5.
The homework helper and the fifteen-year-old
A small online tutoring company in California runs a homework chatbot that remembers each student and chats in a warm, encouraging tone. Most users are teenagers.
California's companion chatbot law covers exactly that. It requires a clear notice that the student is talking to AI, reminders every three hours during long sessions, and specific handling around self-harm. Unlike most of these laws, it lets individuals sue: $1,000 per violation plus attorney's fees. A parent whose child spent forty hours with the bot over a summer has forty potential violations and a lawyer who works on contingency.
The founder is not a lawyer, doesn't know which of this year's new state laws apply to her, and can't afford to find out the expensive way.
The notice, the three-hour reminders for minors, the records, and a monthly review that updates the settings when California or New York changes the rules. She pays to not become the test case.
The law in this example: California Companion Chatbot Law (SB 243) and New York AI companion law.
One store, forty states
A furniture store sells online from Kansas, which has no chatbot disclosure law. The owner's first question: “So this doesn't apply to me?”
Last month the chatbot took orders from customers in 38 states, including Utah, Maine, California and New York. Each of those laws protects the customer where the customer is, and a bot that takes an order from a Utah resident is doing business in Utah.
The owner's second question: “Do I show a different notice for each state?” No. The strictest applicable rule, applied to everyone, satisfies all of them: a clear notice when the chat opens, before the first AI reply; a truthful answer when asked; reminders if minors might use it. Showing that to a customer in Kansas costs nothing. Guessing a visitor's state from their connection fails whenever a phone or a VPN puts them somewhere else.
One configuration on every page. The assessment builds the strict set from “where are your customers,” not “where is your office.”
The law in this example: Utah AI Policy Act and Maine Chatbot Disclosure Act.
Sixty locations, one demand from head office
A home care franchise has sixty locations under one domain, each with its own page and the same chat assistant. Head office gets a letter from the franchisor's insurer: to renew, provide evidence of AI disclosure practices across all locations.
The operations manager has never seen sixty screenshots she'd trust in front of an insurer, and each location's page has changed several times this year.
One plan for the website plus fifty-nine extra locations at the location rate, one set of settings rolled out to every location page, and one evidence report for the whole network showing notices displayed by location and date. Head office sends one PDF instead of sixty emails.
Why the $12.99 customer becomes the $29.99 customer
A roofing company signs up for Chatbot Disclosure because it's cheap and the owner wants the box ticked. Six months later three things happen in one week: the business insurance renewal asks about AI use and records, a competitor gets a state inquiry that the trade group emails everyone about, and the owner's daughter asks how he'd prove the notice was there if anyone asked.
He upgrades. The difference is $17 a month. He doesn't feel it, and he sleeps better.
That is the logic of the three plans. Chatbot Disclosure gets the notice up for people who would otherwise do nothing. Disclosure + Records is where most businesses end up once the risk becomes real to them. Managed Compliance is for the ones who want it handled.
Why not just do it yourself?
Most businesses can add a line to their chat and keep a log. Here is what that gets you, and what it doesn't. The one-sentence version: a notice you show yourself is a claim; a record someone else keeps is proof.
| Do it yourself | BotNotice | |
|---|---|---|
| Notice on the chat | A line your web designer adds | Shown when the chat opens, on every page, worded to the laws |
| Knowing it's still there | You find out from a complaint | Checked from outside every day; an email the morning it fails to load |
| Proof for a given date | Screenshots and memory | A tamper-evident entry each time it appears, kept 7 years |
| Credibility of the record | Your word | Independent, verifiable, copied off-site every night |
| When laws change | You read the statutes | A Monday email; settings updated for you on Managed Compliance |
| Your chat vendor changes | Start over | BotNotice sits above the chat tool and carries on |
| A complaint arrives | A lawyer reconstructs the past | Incident kit and evidence report in minutes |
| Visitor privacy | Whatever your logs collect | No names, no IP addresses, no chat content |
| Cost | Hours, when it goes wrong | From $12.99 a month per website |
The honest side
- BotNotice can't make your bot tell the truth when asked. That's a setting in your chat tool. We tell you what to type, and our weekly test question checks that it worked.
- A record proves the notice was displayed, not that a person read it. No system can prove that.
- Good records make a strong position. They don't make a claim disappear on their own, and they aren't a substitute for a lawyer on the question of which laws reach your business.
Common questions
What happens if a business doesn't comply with an AI disclosure law?
Nothing happens until someone complains. Then the business has to show what it did. Fines run per violation, and a chatbot with no notice commits one per conversation: up to $2,500 in Utah, up to $10,000 per intentional violation in Maine, $1,000 per violation plus attorney's fees from individuals under California's companion chatbot law, and up to $15,000 a day in New York. Before any fine, a lawyer has to reconstruct what the website showed months ago, which is a day of work when there are no records.
My customers are in many states. Which rules apply?
Each state's law protects its own residents, so a business dealing with customers in Utah, Maine or California is inside those laws wherever its office is. The practical answer is to meet the strictest applicable rule once, for everyone: a clear notice when the chat opens, a truthful answer when asked, reminders if minors may use it, and a record. Showing it in a state that doesn't require it costs nothing.
Why not keep my own records?
A record you keep yourself is a record you could have edited, and the other side will say so. A record held by an independent service, linked entry to entry, checked daily and copied to separate storage each night, is evidence someone else can verify. It also gets checked from outside every day, so you hear the morning the notice fails to load instead of months later from a complaint.
Are these stories real?
The businesses are made up and labelled as examples. The laws, penalties, enforcement patterns and the way complaints unfold are real. Each story links to the law it turns on.
Not legal advice. Each example links to the law it turns on; the statute text is the authority.