AI Transparency Rules Are Changing in 2026: Is Your Business Compliant?

Most Business Owners Haven't Heard of Half These Laws

Four different laws touching AI transparency are either already active or about to be this year, and most business owners have never heard of at least two of them. Worse, the ones getting the most press coverage right now aren't necessarily the ones that apply to a typical small or midsize business. The European Commission only published its final guidance on one of these rules on July 20, 2026, giving companies serving EU customers 11 days to get ready before enforcement began.

This post breaks down what each law actually requires, who it actually applies to, and what to fix first. No law degree required.

The Quick Answer: What Applies to Your Business

Before the detail, here's the fast version:

If your business runs a chatbot, sells to customers in California, or serves customers in the EU, at least one of these already applies to you, and probably more than one.

EU AI Act, Article 50. Applies to any business whose chatbot, AI generated content, or AI edited media reaches users in the EU, regardless of where your company is based. Effective August 2, 2026.

California's Bot Disclosure Law (SB 1001). Applies to any business using a bot to communicate with someone for a commercial purpose, like influencing a sale, if that person is in California. This one has been active since 2019, and most businesses still don't comply with it.

Colorado AI Act. Applies if your business uses AI to help make consequential decisions about people, specifically around employment, lending, housing, healthcare, insurance, or education. Effective June 30, 2026.

California AI Transparency Act (SB 942). Applies mainly to large generative AI providers with over one million monthly users, so most small and midsize businesses are not directly covered. Worth knowing about if you build or host a public AI tool at scale. Effective August 2, 2026, after being delayed from its original January 2026 date.

Now let's go through each one.

EU AI Act Article 50: The Chatbot and Content Disclosure Rule

This is the one with the most immediate reach, because it's based on who your customers are, not where your business is registered. If a chatbot on your site interacts directly with EU users, Article 50 requires you to make clear they're talking to AI, unless that's already obvious from context. The same section covers AI generated or manipulated media depicting real people, which must be labeled as artificially generated, and AI generated text published for matters of public interest.

The exception is narrow. "Obvious from the circumstances" is judged from the perspective of a reasonably informed, observant person, not from what your team assumes customers already know.

Enforcement began August 2, 2026. Penalties can reach €15 million or 3 percent of worldwide annual turnover, whichever is higher. That percentage is calculated on global revenue, not EU revenue, which is why this law reaches far beyond companies physically based in Europe.

California's Bot Disclosure Law: The One Most Businesses Already Violate

SB 1001, sometimes called the B.O.T. Act, has been in effect since 2019, and it's the law most relevant to a typical business with a website chatbot, yet it gets the least attention. It prohibits using a bot to communicate with someone online with the intent to mislead them about the fact that they're talking to a bot, when the purpose is to incentivize a purchase or influence a vote.

The disclosure requirement is specific: it has to be clear, conspicuous, and inside the conversation itself. A mention buried in your privacy policy or terms of service doesn't satisfy it. If a customer in California can reach your chatbot, this law applies, regardless of where your company operates.

This is worth fixing first. It's the lowest effort, highest exposure gap for most businesses reading this, since a one line disclosure inside the chat window closes it.

Colorado AI Act: When AI Helps Make a Decision About Someone

The Colorado AI Act takes effect June 30, 2026, and it targets a specific category: "high risk" AI systems used to make or materially influence consequential decisions about people. That covers employment (hiring, promotion, termination), lending, housing, healthcare, insurance, and education.

If your business uses AI anywhere in that list, for example an AI tool that screens job applicants or scores loan applications, you have two disclosure obligations. Before the decision is made, you must notify the person and explain the system's purpose, the nature of the decision, and how to get more information. If the decision goes against them, you must also disclose the main reasons, including how much the AI contributed and what data it used.

Records need to be kept for at least three years, and the Colorado Attorney General can request them within 90 days. Violations are treated as consumer protection violations, with penalties up to $20,000 per violation.

This one has nothing to do with company size. It's triggered entirely by what the AI is being used to decide, not how big the business is.

California's AI Transparency Act (SB 942): The One That Mostly Doesn't Apply to You

This is the law that gets cited most often in AI compliance content, and it's also the one most likely to be misapplied to a business it doesn't cover. SB 942 targets "covered providers," meaning companies that build generative AI systems with more than one million monthly visitors or users accessible in California. It requires those providers to offer free AI content detection tools and to embed both visible and hidden disclosures marking AI generated content.

Its operative date was originally set for January 1, 2026, then delayed to August 2, 2026 by a later amendment. Starting January 1, 2027, the same requirements extend to generative AI hosting platforms.

If your business uses a third party AI tool rather than builds one at that scale, this law is one to be aware of, not one you're likely obligated under directly. Don't let a blog post convince you otherwise without checking whether you're actually a covered provider.

What to Actually Fix This Week

In order of effort versus exposure:

Add a clear, in-conversation disclosure to any chatbot or automated messaging tool that talks to customers, this closes the California SB 1001 gap and most of the EU Article 50 gap at the same time. Confirm whether your business uses AI in hiring, lending, insurance, housing, or healthcare decisions, and if so, start drafting the pre-decision and adverse-decision notices the Colorado AI Act requires before its June 30 deadline. Publish a plain language AI usage policy on your site that covers all of the above in one place, which is exactly what we covered in Why Every Company Needs an AI Policy in 2026.

FAQ

Does the EU AI Act apply to my business if I'm based in the US? Yes, if your chatbot, AI content, or AI edited media reaches users in the EU. The law is based on who your users are, not where your company is registered.

Is my chatbot legally required to disclose it's a bot in California? Yes, if it's used for a commercial purpose like encouraging a purchase and it reaches anyone in California. This has been required since 2019 under SB 1001, independent of any of the newer 2026 laws.

Does the Colorado AI Act apply to small businesses? Size isn't the qualifier. What matters is whether the business uses AI to help make consequential decisions about people in categories like employment, lending, housing, healthcare, insurance, or education.

Am I covered by California's AI Transparency Act (SB 942)? Only if you build or host a generative AI system with more than one million monthly users accessible in California. Most businesses using third party AI tools are not directly covered by this one.

What's the fastest way to reduce exposure across all of these? Add a visible disclosure anywhere customers interact with AI, and publish a clear AI usage policy. Our free 10 minute quiz generates one built around how your business actually uses AI, ready to publish immediately.