Yes, if people in the EU can reach your chatbot: since 2 August 2026, EU AI Act Article 50 requires it to tell them they are talking to AI. A Singapore company should assume it is caught when its bot answers someone in the EU. Utah and Maine clearly cover a generative sales or service bot; California and New Jersey have older "online bot" laws. Singapore, Malaysia and Australia rely on voluntary guidance backed by ordinary deception law. The decision for a sales or service team: build one disclosure layer to the EU standard and reuse it in every market and channel.
On 20 July 2026 the European Commission and Singapore's IMDA both published chatbot transparency guidance. They ask for different things.
What does EU AI Act Article 50(1) require from a chatbot?
EU AI Act Article 50(1) requires chatbot providers to tell people they are interacting with an AI system, unless that is obvious. The test for "obvious" is a reasonably well-informed, observant and circumspect person. Article 50(5) adds that the notice must be clear and distinguishable, and given at the latest at the first interaction. Both have applied since 2 August 2026.
This is general information, not legal advice.
Three details in the AI Act, Regulation (EU) 2024/1689, decide whether it reaches you.
The Omnibus did not defer it. Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force from 27 July 2026, moved the high-risk deadlines to December 2027 and August 2028 and gave generative systems already on the market until 2 December 2026 for machine-readable marks under Article 50(2). The chatbot duty in 50(1) got no grace period: a bot running on 1 August had to comply on 2 August.
Distance probably does not help. Article 2(1)(c) applies the Act to providers in a third country "where the output produced by the AI system is used in the Union". A Singapore retailer whose website chat answers a shopper in Lyon should treat that conversation as in scope. No court has yet tested a site that never targeted the EU.
The duty sits with the provider. Article 3(3) makes the provider whoever develops a system, or has it developed, and puts it into service under its own name or trademark. The Commission's Article 50 guidelines of 20 July 2026 apply this to a company that builds a chatbot in-house under its own name. Wire a model API into your own sales assistant and the duty is yours. Rent a named SaaS chatbot and the vendor is usually the provider; white-label it under your brand and you may become one. Either way you pick the persona, so put disclosure in the contract and test it.
The escape hatch is narrow. The Commission's Q&A on Article 50 says the "obvious" exception "should be interpreted in a restrictive manner, given that it deprives people of transparency". The guidelines name helpdesk and support chatbots as cases that do not qualify, and treat a human profile picture or a human-sounding voice as making AI less obvious. A sales bot called "Sarah" with a stock photo very likely fails.
Breach can cost up to 15 million euros or 3% of worldwide turnover, whichever is higher (AI Act Article 99(4)); for SMEs, whichever is lower. The rest of the timetable is in our EU AI Act guide for Singapore SMEs.
AI disclosure requirements in the US, Singapore, Malaysia and Australia
Outside the EU, AI disclosure requirements split into a patchwork of US state bot laws and voluntary guidance elsewhere. Utah and Maine have consumer-bot rules that reach a generative sales assistant; California and New Jersey have older "online bot" laws. Singapore's IMDA published voluntary Transparency Guidelines for GenAI chatbots on 20 July 2026.
Here is what each market binds you to, as of 6 August 2026 (general information, not legal advice).
| Market and instrument | Binding? | Duty in short |
|---|---|---|
| EU: AI Act Art. 50 | Law | Tell people by the first interaction, unless obvious |
| Utah: Code 13-77-103 | Law | Disclose when clearly asked; regulated occupations upfront in high-risk chats |
| Maine: 10 MRSA 1500-DD | Law | Clear notice if a bot may pass as human to a reasonable consumer |
| California: BPC 17941 | Law | No online bot misleading about its identity to drive a sale |
| New Jersey: N.J.S.A. 56:18-2 | Law | Online sales bots disclose at the outset |
| Colorado: HB26-1263 | Law from 2027 | AI disclosure, but customer service bots are excluded |
| Singapore: IMDA guidelines | Guidance | Info card and safety statement; CPFTA s4 bars misleading consumers |
| Malaysia: AIGE (MOSTI) | Guidance | Voluntary principles; AI bill in engagement since 10 July 2026 |
| Australia: AI adoption guidance | Guidance | Bot should not pass as a human specialist; ACL s18 bans misleading conduct |
Utah's baseline is a trap. Under Utah Code 13-77, most businesses only have to disclose when a consumer asks, and the question must be "a clear and unambiguous request". Staying quiet until asked is the expensive option: you must detect every phrasing of "am I talking to a real person?" in every language. Section 13-77-104 is cheaper: no enforcement action if the bot discloses at the outset and throughout that it is generative AI, is not human, or is "an artificial intelligence assistant". Fines run up to $2,500 per violation (Utah Code 13-77-105).
California's Business and Professions Code 17941, operative since July 2019, bites only where a bot is used "with the intent to mislead" to drive a sale; disclosure is a defence under that section. New Jersey's law of January 2020 (N.J.S.A. 56:18-2) is stricter: an online bot used to sell merchandise or real estate must disclose "at the outset" that it is a bot. Both define a bot as an account run all or substantially all by automation, so a blended flow with real human review may fall outside them. Maine's 10 MRSA 1500-DD uses a reasonable-consumer test instead.
A correction to much published guidance: Colorado has no general disclosure duty for sales or service bots. Colorado SB 26-189, signed on 14 May 2026, replaced the original AI Act with a notice regime for automated decisions in areas such as credit and jobs, from 1 January 2027. A separate law, HB26-1263, signed on 29 May 2026, makes conversational AI services disclose that they are AI from 1 January 2027. It excludes bots primarily designed for shopping, ordering, customer support or customer service.
That carve-out is the pattern. Companion-chatbot laws, such as California's SB 243 and Washington's HB 2225 (signed 24 March 2026), target bots that sustain a relationship with a user, not sales assistants. The list moves fast: check each state you sell into.
Compare
EU and US-state chatbot rules, side by side
Hide the markets you do not sell into, filter by topic, or show only the rows where the rules differ.
| Rule | EU | Utah | Maine | California | New Jersey | Colorado |
|---|---|---|---|---|---|---|
| Binding status | Law, since 2 Aug 2026 | Law | Law | Law, since July 2019 | Law, since Jan 2020 | Law from 2027 |
| When to disclose | By the first turn | When clearly asked | If bot may pass as human | If meant to mislead | At the outset | Not for service bots |
| Upfront disclosure rewarded | Required | Safe harbor | Not stated here | A defence | Required | Not stated here |
| Covers a sales or service bot | Yes, helpdesks too | Yes | Yes | If misleading to sell | Online sales bots | Excluded |
| Penalty named in this post | Up to EUR 15m or 3% | $2,500 per violation | Not stated here | Not stated here | Not stated here | Not stated here |
Key: binding duty or clear answer · conditional or partial · not covered · not stated in this post
As of 6 August 2026. General information, not legal advice. Check each state you sell into; the list moves fast.
Singapore asks a different question. The EU wants the bot to say what it is. IMDA's Transparency Guidelines for GenAI Chatbots want it to say what it can do. The centrepiece is a chatbot info card answering four user questions, from what the bot cannot do to how to report a problem, linked from a first-use safety statement that IMDA wants "substantive rather than generic". The guidelines "are voluntary and do not impose obligations", though DBS and OCBC are among the organisations that said the guidelines will provide "a point of reference" over the next 12 months.
EU: what to build
A first-turn line that names the bot as AI, in the user's language, before it asks for anything (Article 50(5)). A visible AI label in the chat header. A rule that the bot always answers truthfully when asked what it is. Spoken disclosure at the start of every voice session. Keep a record of when each disclosure fired, so you can show the design works.
United States: what to build
Disclose at the outset and keep a persistent label. That earns Utah's 13-77-104 safe harbor, meets New Jersey's outset rule for online sales bots, and answers California's intent test and Maine's reasonable-consumer test. In Utah, people in regulated occupations must disclose upfront in high-risk interactions, such as those involving health or financial data or advice. For outbound AI voice calls, the FCC (February 2024) treats AI voices as artificial voices, so you need the called person's prior express consent, written for telemarketing, unless an exemption applies.
Singapore: what to build
Nothing here is mandatory for a chatbot. The IMDA guidelines of 20 July 2026 are the point of reference that DBS, OCBC and Singapore Airlines indicated they will use over the next 12 months. Publish a chatbot info card covering capabilities and limits, reliability, data handling and complaints. Show a short, specific safety statement with a link to the card at first use. Never let the bot imply it is a person: CPFTA section 4 treats conduct that might reasonably mislead a consumer as an unfair practice.
Malaysia: what to build
The national AIGE principles, launched by MOSTI in September 2024, are voluntary. The Ministry of Digital opened engagement on an AI Governance Bill on 10 July 2026 and has said the bill will not directly regulate AI output. Apply the EU-standard disclosure now so that a future rule changes your paperwork, not your product.
Australia: what to build
The government's Guidance for AI adoption says a customer receiving guidance from a chatbot should know it is not a human specialist. It is voluntary. Section 18 of the Australian Consumer Law is not: it bans conduct in trade that is misleading or likely to mislead. In our view a bot with a human name and no disclosure is an easy section 18 case.
What counts as a valid AI disclosure?
A valid AI disclosure tells a person, at the moment a conversation starts and in the channel they are using, that the counterpart is an AI system. The European Commission's Article 50 guidelines of 20 July 2026 list what fails when used alone: a line buried in terms and conditions, a generic "assistant" label, a site-wide "we use AI" notice, a statement that the system "uses LLMs", or a human-looking persona.
Utah's safe harbor sharpens the rule. The Commission treats "assistant" alone as ambiguous; Utah's safe harbor accepts "an artificial intelligence assistant". "AI assistant" is our shorthand that tracks both. It is not a statutory phrase. A first name on its own fails both tests.
Wording that works (illustrative, not legal text):
- Chat opens: "Hi, I'm Kai, [Brand]'s AI assistant. I can check stock and delivery dates. A person from our team can take over any time."
- Asked "are you real?": "No, I'm an AI assistant. Want me to bring in someone from the team?"
- Human takes over: "You're now chatting with Priya from our sales team."
- Voice, first sentence: "This is [Brand]'s AI assistant calling about your quote. You can ask for a person at any point."
The opening line also says what the bot can do and how to reach a human: IMDA's info-card logic in one sentence, read as service rather than warning. One notice per session usually suffices; the Commission flags financial advice, insurance and complaints handling as settings needing periodic reminders.
Illustrative example: a Singapore furniture retailer runs an AI sales assistant called "Mia", with a stock photo of a woman, on web chat and WhatsApp. It handles about 5,000 conversations a month, roughly 500 of them from EU visitors. The name and photo push it away from "obvious", so from 2 August those 500 conversations are at risk. The fix is small: an AI icon for the photo, the name "Mia, AI assistant", the opening line and announced handovers. Geo-fencing the line to EU visitors saves nothing and breaks on VPNs.
Does an AI-drafted reply sent by a human need a label?
An AI-drafted reply that a human agent properly reviews and sends does not trigger EU AI Act Article 50(1), because the AI is not interacting directly with the customer. The Commission's guidelines of 20 July 2026 set a limit: "the mere possibility for humans to intervene or review the AI system's outputs" does not exempt a bot, and blended conversations need disclosure on the AI-generated parts.
For a sales team this is a choice about modes, not wording. In agent-assist mode the AI drafts and a person edits before sending; Article 50(1) does not bite. In autopilot the AI replies alone and full disclosure applies. In blended mode the bot handles routine questions while a person steps in for pricing or objections, so each AI reply must be identifiable as AI.
Which replies need an AI label depends on the mode
Message pattern per mode, per the Commission’s Article 50 guidelines of 20 July 2026. Schematic, not data.
The word that matters is "properly". A rep who clicks send on 200 drafts an hour unread is a log entry, not a reviewer, and we would not rely on that. How to make approval real is in designing the confirm step.
What it means by role:
- CTO or technical lead: a disclosure that lives only in the system prompt can be jailbroken or lost in a model swap. Tag every outbound message by who actually sent it.
- Owner or managing director: one honest sentence costs little next to a regulator asking why a bot pretended to be "Sarah". Set the persona policy once, at the top.
- Compliance: map provider and deployer roles per channel and per vendor.
- Sales operators: handovers are where disclosure breaks. Announce yourself when you take over.
Voice agents and WhatsApp: where disclosure gets harder
Voice agents and WhatsApp bots break the web-chat pattern because there is no persistent badge on screen. The Commission's guidelines of 20 July 2026 ask voice systems for a spoken statement at the beginning, such as "This is an AI-powered assistant", with reminders after interruptions or a change of role. A WhatsApp thread has no header to hold a label.
Voice. The FCC's declaratory ruling FCC 24-17 (8 February 2024) confirms that telephone consumer law's restrictions on an "artificial or prerecorded voice" cover "current AI technologies that generate human voices". Outbound AI calls therefore need the called person's prior express consent (written consent for telemarketing) unless an exemption applies. On inbound calls, say it in the first sentence, before the caller shares anything.
WhatsApp. With no header badge, the first message of each conversation carries the disclosure. WhatsApp's Business Messaging Policy allows automation inside the 24-hour customer service window but says you "must also have available prompt, clear, and direct escalation paths", such as in-chat transfer to a human. The policy does not require a bot to identify itself; the EU and US rules above do. So the opening line should name the bot as AI and say how to reach a person. A customer returning days later starts a new session, so repeat the line.
Email from an agent. The Commission's own example is an AI label at the top of an email an AI agent sends. If your SDR agent emails prospects without a human reviewing each message, label it.
Our sales automation work treats these channels as one system, because the disclosure has to survive the move between them.
Where Origin Pi stands
Disclosure is cheap. The risk sits in ambiguity: a human name, a stock photo, a handover nobody announces.
We design disclosure into the agent-ready layer, not a prompt. The identity statement and the AI label are emitted by the messaging layer, so a model change or a clever user cannot talk the bot out of them. The persona is a locked setting with bounded permissions, and an output check blocks any reply claiming to be human. Every outbound message is tagged in the audit trail as AI-sent, human-sent or AI-drafted and human-reviewed. That trail is good engineering, not an Article 50 element. Where a person takes over, the handover runs through a confirm step that announces them.
Built once to the EU standard, the same layer is designed to support Utah's safe harbor and to carry IMDA's info card link.
Your first action: this week, ask your own bot "am I talking to a real person?" in an incognito browser, then on WhatsApp, then by calling your sales line. Any channel that hesitates is your first ticket.
