How to signal that you use AI and AI agents — the EU and US rules, done right

If a machine is talking to your customer, the customer should know it is a machine. That is the shared idea behind the AI rules in Europe and the United States. The wording differs. The instinct does not.

Most of this is not hard. Most of it is one sentence at the top of a conversation and a label on a picture. What follows is what the law asks, what good disclosure looks like, and what it costs to skip.

One caveat before the detail: this is a map, not legal advice. For your exact obligations, that is what counsel is for — and getting the article numbers, turnover percentages and dates right is precisely their job to hold strictly. What follows is the shape of the rules, and who owns making them real.

Do you have to tell people they are talking to a bot?

In the EU, yes. Article 50(1) of the EU AI Act says systems built to interact directly with people must be designed so the person knows they are dealing with an AI — unless that is obvious to a reasonably observant person. The notice has to arrive at the first interaction. For a chatbot, that means before or at the very start of the conversation, not three screens deep in a policy.

The US has no single federal version of this. California does. The California Bot Disclosure Act (SB 1001), operative since July 2019, makes it unlawful to use a bot to mislead someone about its artificial identity in order to sell them something or sway a vote. Disclose the bot clearly and conspicuously and you are on the right side of it.

What does the EU AI Act make you disclose beyond chatbots?

More than the chat window. Article 50(2) tells providers to mark AI-generated audio, images, video and text in a machine-readable format, detectable as artificial, where that is technically feasible. Article 50(4) tells deployers to disclose deepfakes as generated or manipulated, and to flag AI-written text published to inform the public on matters of public interest. If your marketing operations produce copy, images or video at scale, this is the clause that touches you. Article 50(3) says if you point an emotion-recognition or biometric-categorisation system at someone, you have to tell them.

Article 50(5) ties it together: the disclosure must be clear, distinguishable, given no later than the first interaction or exposure, and accessible. These transparency duties apply from 2 August 2026. That is not far away.

What about AI that makes a decision about a person?

Different regime, older, and it bites harder. GDPR Article 22 gives people the right not to be subject to a decision based solely on automated processing — including profiling — when it has legal or similarly significant effects on them. Credit, hiring, pricing, who gets flagged. It is allowed only under narrow conditions, and even then you owe safeguards: the right to human review, to state your case, to contest the outcome.

On top of that, GDPR Articles 13, 14 and 15 require you to tell people that solely automated decision-making is happening and to give meaningful information about the logic involved and the consequences. Not a vague “we use AI.” The logic. If you deploy scoring or routing models, how you build them and how you explain them is part of the compliance surface, not an afterthought.

What do the US rules actually require you to signal?

In the US the floor is the FTC Act, Section 5, which bans unfair or deceptive practices. There is no AI-specific federal statute, so the FTC reads the old rule onto new tools: do not pretend a bot is a person, and do not make “AI-powered” claims you cannot back up. Its staff guidance is blunt — the 2023 “Luring Test” note says businesses should make sure consumers know when they are communicating with a machine rather than a person.

States fill in the rest, unevenly. Utah’s AI Policy Act (SB 149) requires you to disclose generative-AI use to consumers, proactively if you are in a licensed profession like law or healthcare. California’s AI Transparency Act (SB 942) makes large generative-AI providers label their output with visible and hidden markers and offer a free detection tool. Colorado passed a broad AI act (SB 24-205) requiring people be told when they interact with an AI system, then rewrote it more than once before it took effect. The map is a patchwork. The direction is one way.

What does compliant AI disclosure look like in practice?

Concretely, a handful of moves cover most of it.

A support chatbot opens with one line: “You are chatting with an automated assistant. Ask any time to reach a person.” That single sentence goes a long way toward both Article 50(1) and SB 1001.

An AI-written article or generated image carries a label, and the file carries machine-readable provenance underneath it. A synthetic voice or deepfake in an ad says it is synthetic, in a way a normal viewer cannot miss.

When an automated system declines an application or sets a price, the person is told a decision was made about them by an automated system, given a plain explanation of what drove it, and offered a real route to a human who can look again. That is Article 22 and Articles 13–15 working as intended, not as legal ornament.

What does it cost to ignore this?

Enough to matter. Breaching the AI Act’s transparency duties can bring fines up to €15 million or 3% of worldwide annual turnover, whichever is higher. The Act’s top tier, for outright prohibited practices, reaches €35 million or 7%. GDPR sits alongside it, not instead of it: transparency and automated-decision breaches fall in its top band, up to €20 million or 4% of global turnover. One AI system deciding about people can trip both regimes at once. If you want that as a number against your own revenue, our calculator will show you.

The US shows the enforcement is not theoretical. In September 2024 the FTC launched Operation AI Comply and named five companies. ‘AI’ turned out to be a great phrase for adding credibility to a scam. DoNotPay, which sold a “world’s first robot lawyer,” settled for $193,000, plus consumer notices and a ban on claims it could not support. Three AI “passive income” store schemes in the same sweep — Ascend Ecom, Ecommerce Empire Builders and FBA Machine — were tied to alleged consumer losses of at least $25 million, up to $35,000 taken per person, and over $15.9 million, respectively.

Not every action stuck. The FTC’s case against Rytr, over an AI tool that generated fake reviews, ended in a final order in December 2024, then was reopened and set aside a year later, in December 2025. Enforcement is real and it is also contested. Both things are true.

Whose job is compliance, really?

Here is the part that gets outsourced and should not be. Legal owns the letter: which article, which turnover percentage, which effective date. They should hold that line strictly, and the dates above are why.

But legal does not deploy the chatbot — marketing does. Legal does not pick the scoring model or write the onboarding flow — strategy and operations do. The people who choose the tools and ship the campaigns decide whether a disclosure is a clear opening sentence or a buried footnote. That is a leadership question, not a legal one. We keep our own answer in the open on how we use AI, and we build systems that disclose themselves by design.

Because the real test is not the fine. It is whether the AI serves the person on the other end or works them. You can memorize every article number and still fail the only one that matters — whether the person on the other end is allowed to know a machine is there.