Since ChatGPT became publicly available in November 2022, individuals and small law firms have been inundated with ethics opinions from the ABA and 20 states regarding the use of artificial intelligence and client disclosure obligations. While these ethical considerations are important, the actual disclosure requirements that companies should be concerned about are new state laws that require certain AI disclosures and impose specific penalties for noncompliance.
State AI disclosure laws
Currently, three states – Utah, New Jersey, and Maine – have laws requiring companies, including law firms, to disclose when they use AI to interact with consumers. What makes these laws particularly important for private and small businesses is their potential extraterritorial impact and specific penalties for violations.
Utah’s Artificial Intelligence Policy Act (AIPA) was originally passed in 2024 as SB149. The 2025 amendments to SB226 amended the mandatory disclosure to only apply to “high-risk artificial intelligence interactions” that include “financial, legal, medical, or mental health advice or services.” This means that private practices that use AI chatbots or call receptionists to respond to initial customer inquiries, schedule consultations, or provide preliminary legal information must clearly disclose the involvement of AI.
New Jersey’s bot law makes it illegal to use online bots to communicate with other people in the state and encourage business transactions, including engagements with attorneys, “for the purpose of misleading the other party as to the artificial identity of the bot.” Fines for violations are steep: $2,500 for the first violation, $5,000 for the second violation, and $10,000 for each subsequent violation. Similarly, Maine’s AI law prohibits the use of AI bots to encourage transactions unless users are notified that they are not interacting with a human. Civil penalties of up to $1,000 per violation apply.
Challenge to extraterritoriality
Many individual businesses and small businesses may believe that these laws do not apply to them if they are not physically located in Utah, New Jersey, or Maine. This assumption can be costly. Modern digital marketing and client acquisition means law firms regularly interact with potential clients across state lines. A company’s website, online advertising, or AI-powered intake system can reach residents in any state and potentially trigger that state’s disclosure requirements.
Consider the following practical scenario. A small Texas immigration law firm uses an AI-powered chat system on its website to answer frequently asked questions about visa applications. If a potential customer in Salt Lake City visits a website and interacts with a chatbot, the company must comply with Utah’s disclosure requirements, even though the company itself is based in Texas. A connection to Utah through a customer’s location could trigger application of the law.
The reality is that if a company’s AI tools interact with someone in a regulated state, the company can be subject to penalties regardless of its location. This is especially difficult for small businesses that may use third-party AI services for customer onboarding, document reviews, and legal research without fully understanding where potential customers are at the time of initial contact.
Actual compliance procedures
To navigate this regulatory environment, private businesses and small businesses need to take several safeguards. First, include clear AI disclosure language at the beginning of automated interactions such as chatbots, email automation, and phone systems. Second, don’t rely on vendor guarantees for compliance. Please check the facts for yourself. Third, maintain (or insist that your vendor maintain) documentation showing when and how AI disclosures were provided to protect against potential enforcement actions.
I’m looking forward to it
Although important, the focus on ethics codes has been overshadowed by more pressing legal requirements imposed by state law. These laws do more than just suggest best practices; they mandate specific disclosures with real penalties if violated. The patchwork of requirements will only become more complex as more states consider similar bills.
Solo and small firms need to be aware that AI regulations go far beyond bar association guidelines. State consumer protection laws, disclosure requirements, and new AI-specific laws create multiple layers of compliance obligations that require immediate attention. Companies that succeed in this new environment will be those that proactively address both the ethical and legal aspects of using AI, ensuring that they meet not only professional standards but also the ever-growing regulatory requirements of their states.
Carolyn Elephant is one of the nation’s most recognized advocates for solo and small firm attorneys. She founded MyShingle.com in 2002. MyShingle.com is the longest-running blog for solo practitioners and has published thousands of articles, resources, and guides on starting, running, and growing an independent law firm. She is the author of Solo by Choice, widely considered the definitive handbook for starting and sustaining a law practice, and has spoken at countless bar events and law conferences about technology, innovation, and regulatory reforms impacting solo and small-time lawyers. Mr. Elephant has also developed practical tools such as AI Teach-In to help small and medium-sized businesses adopt AI, and is a consistent advocate for reforms to level the playing field for independent lawyers. Alongside this work, she operates the Carolyn Elephant Law Office, a national energy and regulatory practice that handles selectively complex and high-stakes matters.
