AI in customer service: what a chatbot should do, and the disclosure laws in 2026

AI in customer service does one thing very well: answering the questions that come up every day (lead times, shipping, warranties, order tracking) from your own documents, even when your team is busy. Everything else, it should leave to a person: disputes, goodwill gestures, unhappy customers. And the disclosure laws (in several US states, and in the EU since August 2, 2026) come down to one simple requirement: tell customers clearly, from the very start, that they’re talking to an AI.

I build chatbots and assistants plugged into small businesses’ documents and software. Here’s what I put in place, what I refuse to do, and what US state laws and the EU AI Act really require as of October 2026. This article isn’t legal advice: it’s a practitioner’s reading. If your use case is sensitive, have a lawyer review it.

What can AI do in customer service, and what should it leave to a person?

In small business customer service, many requests are alike. They call for an answer that already exists somewhere: in your terms and conditions, your product pages, your ERP, or your delivery tracking tool. That’s where AI saves your team time, and where your customers get an instant answer.

The demo on my site follows the same principle: the tool answers questions about lead times, shipping, and warranties, and hands off to the team whenever it’s unsure. In the demo’s (fictional) example, Alice from customer service picks up the conversation.

There are two possible settings, chosen task by task. Either the assistant drafts the reply and a person approves it before it goes out: that’s the right way to start for emails and form requests. Or, once its replies have proven themselves on a given type of question, it answers on its own, and anything outside the rules goes back to your team. The choice is yours, and you can switch in one click.

What makes a good AI customer service chatbot?

I judge a customer service chatbot on five points. None of them is optional.

1. It answers from your documents. Terms and conditions, product pages, manuals, Q&A pages, ERP data: it doesn’t draw on its general knowledge. That’s the idea behind an AI chatbot for your documents.
2. It cites its source. “According to our delivery terms, section 4…” The customer can check, and so can your team.
3. It hands off. A “Talk to a person” button that’s always visible, and an automatic handoff when it doesn’t know, when the request falls outside its scope, or when the conversation gets heated. The customer doesn’t have to repeat everything: the person gets the history.
4. It keeps a log. Every conversation can be reviewed, along with the source used, to correct an answer, improve the documents, and respond to a customer who challenges an answer.
5. It’s measured. Questions handled on its own, handoffs to a person, corrected answers: without these numbers, there’s no way to tell whether it’s helping customers or annoying them.

The same reasoning applies on the phone: an AI voice agent that picks up when no one’s available follows the same rules, and I break down its costs in the article on AI receptionist cost.

Key point A customer service chatbot that answers everything is a risk. One that answers accurately within a written scope, and hands off everything else, is a tool.

How much does customer service AI cost?

There’s no single price: it all depends on the route you choose. Three cost items always come up.

A public benchmark: Intercom charges $0.99 per “outcome” (a resolved request or a completed action) for its AI agent, Fin, on top of the seats for its platform, at $29 to $132 a month depending on the plan (prices checked October 9, 2026). That model works for modest volumes. At thousands of requests a month, the bill grows with the volume.

Custom-built makes sense when the chatbot needs to read your software (orders, inventory, delivery tracking) or when you want to keep control of your data. Its price depends on the scope: it’s fixed, and put in writing before work starts.

What do AI chatbot disclosure laws require in customer service?

In the US, no federal law specifically requires a chatbot to identify itself as an AI. Several states do, as of October 2026: California since July 1, 2019, for bots that interact online to sell (Business and Professions Code §17941); Utah since 2024, when a customer clearly asks (Utah Code §13-75-103); Maine since September 2025, for any chatbot that could make a consumer think they’re talking to a person (10 M.R.S. §1500-DD). If you serve customers in the EU, the EU AI Act (Regulation (EU) 2024/1689) applies too, and a July 2026 omnibus (Regulation (EU) 2026/1744) changed its timeline. Here’s what it requires of a customer service chatbot.

Chatbot disclosure requirements: saying it’s an AI

In the US, Maine’s law is the broadest of the three: a business may not use a chatbot, by text or by voice, in a way that could lead a reasonable consumer to think they’re talking to a person, unless it says so clearly and conspicuously. California’s law covers bots that interact online to sell, and Utah’s requires an honest answer when a customer clearly asks. In the EU, Article 50 requires the same notice no later than the first interaction, unless it’s “obvious”; the guidelines the European Commission adopted on July 20, 2026, keep that exception for cases where almost no doubt remains, and name helpdesk chatbots among the examples where the obligation applies.

The EU guidelines give useful examples, and they work for the US rules too. A written notice at the top of the conversation, such as “You are interacting with an AI system,” supplemented if needed by a label that stays visible throughout. On the phone, a spoken sentence right at the start. And they consider these insufficient: a notice buried in the terms and conditions, a vague “assistant” with no further detail, a human photo or tone that leaves people guessing. They also require the system to say what it is when asked, and recommend reminders in more sensitive contexts, including complaint handling.

Who carries the obligation?

Under the US state laws, it’s the business that uses the chatbot with its customers: you. Under the EU AI Act, the duty falls on the provider, the party that puts the system into service under its own name: with an off-the-shelf platform, normally the vendor; for a chatbot custom-built in your name, probably you, according to the Commission’s guidelines. Have a lawyer confirm it if the stakes are high. In practice, I add the notice in every case: it’s your website and your customers.

Training your staff: good practice, and an EU rule

The US state laws above don’t require it. In the EU, Article 4 has applied since February 2, 2025, and the omnibus rewrote it: providers and deployers “take measures to promote the development” of their staff’s AI literacy, rather than having to guarantee a given level. Either way, the person who reviews the log and corrects the answers needs to know how the tool works and where it can go wrong.

Human oversight isn’t required for a customer service chatbot

The US disclosure laws don’t require a person behind the chatbot. In the EU, Article 14 requires human oversight only for high-risk systems, uses listed in Annex III: recruitment, access to credit, education, biometrics, access to essential services. Answering questions about delivery times isn’t one of them, and even for high-risk systems, these rules will only apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I). Handing off to a person remains good practice, not a legal obligation.

Penalties and enforcement

In Maine, a violation counts as a violation of the state’s Unfair Trade Practices Act; in Utah, the Division of Consumer Protection can impose fines of up to $2,500 per violation. In the EU, breaching Article 50 can cost up to €15 million or 3% of worldwide annual revenue, and for a small or midsize business, the lower of the two amounts applies (Article 99). The €35 million or 7% figure targets prohibited practices, not a chatbot.

Key point In the US, disclosure is set state by state; in the EU, the omnibus postponed the high-risk rules, not customer disclosure. Either way, the simple rule holds: your chatbot says it’s an AI in its first message.

Who is liable for what the chatbot says?

Your company, as far as your customers are concerned. In February 2024, a British Columbia tribunal found Air Canada liable: its chatbot had described a refund policy that didn’t exist, and the argument that the chatbot was a separate entity, responsible for its own statements, was rejected (decision 2024 BCCRT 149). It’s a Canadian ruling, but the logic holds everywhere: to the customer, the chatbot is you.

Hence two rules I always apply. The chatbot never promises a price, a lead time, or a refund that isn’t in your documents. And whenever it’s unsure, it passes the request on instead of improvising.

Privacy rules come on top of the disclosure rules. As soon as a customer leaves a name, an email address, an order number, or the details of their request, you’re processing personal data: tell them when you collect it, set a retention period for the log, and sign a data processing agreement with every provider that handles this data for you, chatbot vendor and model provider included. For your employees’ use of ChatGPT or Claude, see the article on shadow AI and AI policies.

If the legal side is holding you back, start with the checklist below: it’s short, and it covers what these laws ask of a customer service chatbot.

What should you check before launching a customer service chatbot?

Here’s the checklist I apply to every website chatbot. It isn’t an official standard: it’s my own practice, and it covers the disclosure rules plus the questions that usually follow.

1. The notice in the very first message: “You’re chatting with an AI assistant.” Easy to read, high-contrast, read aloud by screen readers, plus an “AI” label visible throughout the conversation.
2. A name that doesn’t mislead: “Martin Inc. Assistant” rather than a first name and a photo of a person.
3. An honest answer when the customer asks, “Am I talking to a bot?”
4. A written scope: the topics covered, the documents used, the topics always passed to a person.
5. A “Talk to a person” button that’s always visible, and an automatic handoff, with the history.
6. The source cited in every factual answer.
7. The privacy notice at the moment the customer gives their contact details.
8. A log you can review, with a set retention period.
9. A one-page memo: the use case, who does what (vendor, your company), the disclosure rules that apply where your customers are, the notices in place.
10. A named person who reviews the log every week and updates the documents.

For an online store, I add a review of the answers on returns and refunds before every sales season: that’s when questions surge. See also the e-commerce page.

What I don’t recommend

• A chatbot that answers everything. The broader the scope, the more it improvises. I’d rather have ten topics handled well than a hundred handled roughly.
• A chatbot sold as “certified compliant.” No such legal certification exists for a customer service chatbot, in the US or under the EU AI Act. A serious provider walks you through the measures in place. They don’t sell you a stamp.
• Believing the rules are still to come. Maine’s and Utah’s rules are already in force, and in the EU, the omnibus postponed the high-risk rules, not customer disclosure, which has applied since August 2, 2026.
• Believing the law requires a person behind every answer. Not true for a customer service chatbot, in the US or the EU. The level of review is your call, question by question.
• Hiding that it’s an AI to seem more human. It goes against the law in several states and in the EU, and it’s the surest way to lose a customer’s trust the day they find out.
• Letting it talk money. Discounts, refunds, penalties: a person should decide.

Torn between a chatbot, an AI agent, or a simple automation for your customer service? I compare all three in AI agent vs chatbot vs automation: which one to choose.