EveryAILaw.com

Requirements at a glance

This regulation imposes 13 specific requirements for Transparency & Disclosure across 4 provisions:

• On-request disclosure — Must disclose AI use when consumer makes "clear and unambiguous request"
• Safe harbor — Clear + conspicuous disclosure at outset and throughout eliminates enforcement exposure (§13-75-104)
• Proactive disclosure — Required only for "high-risk AI interactions" (§13-75-101(5)): sensitive data (health/financial/biometric) or personalized advice in finance/legal/medicine/mental health
• Verbal at start — Required at start of oral exchange
• Written before start — Required in electronic messaging before written exchange
• Pre-access disclosure — Must disclose before user may access chatbot features
• Post-gap disclosure — Disclosure at start of interaction when >7 days since user's last interaction
• On-prompt disclosure — Disclosure any time user asks whether AI is used
• Carve-out — Scripted-only output (meditations, mindfulness) and referral-to-human-therapist bots excluded (§13-72a-101(10)(b))
• Expanded scope — Personal identity now covers name, title, picture, portrait, video likeness, voice, audiovisual appearance — including AI simulation/reproduction
• Voice definition — Any computer-generated sound "readily identifiable and attributable" to an individual
• Tool distribution liability — Knowingly distributing tools whose "intended primary purpose" is unauthorized personal-identity content creation for commercial purposes = abuse
• Exemptions — News, public affairs, sports, art, parody, political speech; §230 interactive-computer-service safe harbor