AI Transparency and Disclosure Requirements: A State-by-State Breakdown

Across the United States, state legislatures have enacted a growing body of laws requiring businesses to disclose when—and sometimes how—they are using artificial intelligence. These disclosure requirements vary significantly by context: disclosing that a chatbot is AI is different from disclosing that a hiring tool uses AI, which is different again from disclosing the training data composition of a generative model.

This breakdown organizes AI transparency and disclosure requirements by category, covering the most consequential laws in effect or taking effect through 2026.

Category 1: Training Data Transparency

California AB 2013 (Effective January 1, 2026)

California's Generative AI Training Data Transparency Act (AB 2013) requires developers of publicly available generative AI systems to publish a high-level summary of their training data on their website. Required disclosures include sources and ownership of training datasets; data volume (as a range or estimate); whether datasets include copyrighted, trademarked, or patented materials; whether datasets contain CCPA-defined personal information; and whether AI-generated (synthetic) data was used in training.

AB 2013 applies to any developer that designs, codes, produces, or substantially modifies a generative AI system for public use in California, covering systems first released or substantially updated on or after January 1, 2022. Exemptions apply for cybersecurity, national security, and aircraft operations. The law does not specify an enforcement agency or penalty amounts. See our AB 2013 page.

California SB 942 + AB 853: AI Watermarking and Detection (Effective August 2, 2026)

California's California AI Transparency Act (SB 942), as amended by AB 853, goes further than training-data disclosure: it requires covered GenAI providers (over 1 million monthly California users) to embed C2PA-compatible latent provenance watermarks in all AI-generated images, video, and audio, and to offer a free public detection tool so anyone can verify whether specific content is AI-generated. The operative date was delayed from January 1, 2026 to August 2, 2026 by AB 853 to align with EU AI Act Article 50 timelines. Violations carry $5,000 per day per violation. For the full compliance guide, see our California AI Transparency Act (SB 942) explainer.

Category 2: Consumer Disclosure When AI Makes Consequential Decisions

Colorado SB 205 (Effective June 30, 2026)

Colorado's AI Act requires deployers of high-risk AI systems to provide consumers with a clear and accessible statement before the AI makes or substantially influences a consequential decision. The statement must include the purpose of the AI system; the nature of the consequential decision; a plain-language description of the AI; and contact information for the deployer. This requirement applies to consequential decisions in employment, housing, education, healthcare, insurance, financial services, government services, and legal services. See our Colorado AI law tracker.

Category 3: Chatbot and Bot Disclosure Laws

California B.O.T. Disclosure Act (Business and Professions Code §17940)

California prohibits any person from using a bot to communicate or interact with another person online with the intent to mislead the other person about its artificial identity, in a commercial transaction or to influence a vote. The law requires disclosure that the communicating party is a bot. It does not apply to content that clearly indicates it is generated by AI through its form or context.

Texas SB 2096 (Bot Disclosure in Political Communications)

Texas prohibits knowingly deploying a bot to interact with people online for political advertising or to influence an election without disclosing the bot's artificial nature. Civil and criminal penalties apply to intentional violations.

Colorado SB 205 (Website Disclosures)

Beyond individual decision notices, Colorado's AI Act requires deployers to maintain publicly accessible website disclosures describing their use of high-risk AI systems and their risk management practices.

Category 4: AI Disclosure in Hiring

Illinois AIVIA (Effective January 1, 2020)

Before conducting an AI-analyzed video interview, Illinois employers must notify applicants that AI will analyze their video; explain how the AI works and what characteristics it assesses; and obtain written consent. See our Illinois AIVIA page.

NYC Local Law 144 (In Effect Since July 2023)

Employers must provide candidates with at least 10 business days' notice before using an AEDT, including information about what qualifications the tool assesses and what data it uses. See our NYC Local Law 144 page.

Category 5: Healthcare AI Disclosure

California AB 3030 (effective January 1, 2025) requires licensed healthcare providers to disclose when generative AI was used to create patient communications, unless the content was substantially reviewed and modified by a licensed professional. California AB 2905 requires operators of AI companion chatbots to clearly disclose the AI identity of the system at the start of each session and at defined intervals. See our AI in healthcare page.

State-by-State Disclosure Requirement Summary

Common Compliance Pitfalls

1. Treating "AI" and "bot" disclosure as interchangeable

Bot disclosure laws (like California's B.O.T. Act) apply to automated account-based online interactions. AI disclosure laws (like Colorado SB 205) apply whenever AI materially influences a consequential decision. You may be subject to both, neither, or just one, depending on your use case.

2. Assuming disclosure is sufficient when consent is required

Illinois AIVIA requires both disclosure and affirmative consent before an AI video interview. Notice alone does not satisfy consent requirements. Your HR software must capture and record consent before the interview process begins.

3. Failing to update disclosures when systems change

California AB 2013 requires updated training data disclosures whenever a generative AI system is substantially modified. Colorado SB 205 requires new impact assessments within 90 days of intentional, substantial changes. Static disclosures become noncompliant as systems evolve.

4. Assuming third-party vendor compliance is sufficient

Deployers remain responsible for disclosure obligations even when using third-party AI tools. Your vendor's disclosures to you are separate from your disclosure obligations to consumers. Review vendor contracts to confirm what documentation they provide.

For an interactive map of AI disclosure requirements by state, visit our AI disclosure requirements tracker.

This article is for informational purposes only and does not constitute legal advice. Consult a qualified attorney for guidance specific to your situation.