AI Disclosure Requirements: Before, After, or Never

A woman in Texas is owed a sentence by the day her treatment starts. A woman in Colorado will be owed a paragraph thirty days after it has decided against her. A woman in most other states is owed nothing at all.

Same technology. Same decision. Three different answers, and the thing that picks between them is an address.

Artificial Intelligence (AI) disclosure sounds like one subject. It is at least two, and they protect different people at different moments.

Does anyone have to tell you AI was involved in your care?#

In some places, yes. In most, no.

There is no general federal rule requiring it. The duties that exist were written by state legislatures, recently, and each one drew its own line about who must speak and when.

That patchwork produces a strange result for an older reader. The same insurer, running the same software, may owe an explanation in one state and nothing in the state next door. Nothing on the letter or the screen marks which.

So the first question is not whether a machine was involved. It is which state’s rule reaches the person who used it.

Which rights exist at all, and which have actually started, is the frame this page sits inside.

Two states are worth knowing in detail. One duty is live today. One begins next year and is already being described as though it were live.

What does the Texas healthcare AI law require?#

Notice, before or at the moment of the interaction.

The Texas governance act took effect on 1 January 2026. Its general disclosure provision, the one requiring that a consumer be told before or at the time of interaction, is written for a governmental agency. Read that limit before you rely on the rest.

For health care the act names a different party. Where a machine is used in relation to a health care service or treatment, the provider must give that disclosure no later than the date the service is first provided. It goes to the person receiving the care, or to that person’s representative. Emergencies do not remove the duty. They move it to as soon as reasonably possible.

Then comes the clause that does the real work. The disclosure is required regardless of whether it would be obvious to a reasonable consumer that they are dealing with a machine.

Read that twice. Somebody anticipated the defence that an obvious robot needs no introduction, and shut it before it could be argued.

That choice matters more as the technology improves. An obviousness exception would have quietly shrunk every year, as systems became more recognisable and providers grew more confident that people could tell. A bright line does not shrink.

So in Texas the duty is simple to state and easy to check. Were you told, and were you told in time.

Which states passed chatbot disclosure laws in 2026?#

More than a handful, and I can only vouch for the two I opened.

That limit is worth stating plainly rather than hiding, because this article is about disclosure and it should practise what it asks of others. California enacted a measure whose official title is health care professions, deceptive terms or letters, artificial intelligence. I could confirm the title at the state legislature and I could not open the operative text from here.

So I am not going to tell you what California requires. A law firm summary would have let me write a confident paragraph. It would also have meant reporting a rule I had never read, in an article arguing that you should never accept that.

What the title alone does show is a different frame. California approached the problem as deception rather than as disclosure. That is a real distinction.

A deception rule asks whether you were misled. A disclosure rule asks whether you were told. A provider can satisfy one and fail the other.

Think of it like a shop with an unmarked door. A deception rule punishes the sign that points the wrong way. A disclosure rule requires a sign at all. The shop with no sign breaks the second and not the first.

Now look at who writes about this. Open the first page of results and you find law firm alerts, compliance vendors and a trade association. Every one of them is written for the provider who must comply.

Almost none is written for the person on the receiving end. That is why the timing question at the heart of this subject rarely came up in what I read. A provider wants to know what to publish. A patient wants to know when they will hear.

Those are different questions, and only one of them has a whole industry answering it.

Reading around a gap like that is a skill of its own. It is the same one that finds the sentence an announcement omits.

How is disclosure in a coverage decision different from clinical care?#

One arrives before anything happens. The other arrives after something already has.

The Texas duty sits with care. You are told by the day the treatment starts, which is early enough to act on it. You can ask for a person. You can phrase a question differently. You can decline.

Colorado’s coming duty sits with decisions about money and eligibility, and it fires later. Its 2026 act requires a deployer to give a plain language description of the system’s role within thirty days after it makes a consequential decision resulting in an adverse outcome. That duty starts on 1 January 2027 and binds nobody before then.

Thirty days after. Not before, and not at the time.

That sounds like a weaker right and it is a different one rather than simply a lesser one. A disclosure before the interaction protects your choices. A disclosure after an adverse decision protects your appeal.

Colorado pairs its later disclosure with something that gives it teeth. The act grants a right to request meaningful human review and reconsideration after such a decision. Without that, an after-the-fact explanation would be a courtesy. With it, the explanation is the thing you build an appeal on.

Both duties are worth having. Neither substitutes for the other, and a reader who has only one should know which one they have.

Like a smoke alarm and a fire report, one wakes you while the room can still be saved. The other tells you afterwards what burned. A house wants both, and nobody would accept the second in place of the first.

That is the shape of the gap for an older reader in particular. A person managing a chronic condition meets the clinical moment at a desk or on a phone, and meets the coverage decision in a letter. So the two duties land in very different parts of a life.

The clinical disclosure is small and constant. The coverage disclosure is rare and heavy. The ordinary week goes untouched.

What would a disclosure have to say to actually be useful?#

Four things.

• That a machine was involved.
• What part it decided.
• What it worked from.
• What you can do next.

Nothing I have checked supplies all four.

The first is the one every disclosure rule reaches. It is also the least useful alone. Knowing a machine was involved somewhere tells you almost nothing about your position. It is a fact without a handle.

The second is where most notices go vague. A practice uses technology to support care is not a statement about your decision. What made the call is a different question from what tools sit in the building. Watch for that swap. It is the commonest one.

The third is the one nobody thinks to ask for. It is often the one that matters. A system fed the wrong record produces a confident wrong answer. The answer looks identical to a right one. Nothing on the page marks it.

So ask what it read. Not how it works.

The fourth is the difference between information and a route. A notice naming the person who will look again beats three paragraphs explaining a model. One gives you a door. The other gives you a lecture.

Read any notice you receive against those four. Most will supply one. A good one supplies three. Nothing I have checked supplies all four reliably, and knowing that keeps you from mistaking a compliant notice for a helpful one.

Colorado’s coming rules reach further into the third and fourth than anything in force does today. That is worth knowing, and it is worth remembering that reaching further next year is not the same as protecting anyone now.

Where are the gaps that no state has closed?#

Three, and they are the same three everywhere.

The first is the obvious one. Beyond the two states here, I cannot vouch for any rule, and the map I can see has more holes than rules in it.

The second is subtler and it survives even a good rule. Texas asks for plain language, and that is a rule about how a notice is written, not about whether anyone understood it. A notice can satisfy a statute and still be written to end a conversation rather than to open one.

Words are cheap and a cost is not. That is why the honest test of any of this is what somebody actually gave up.

The third is the one that will matter most as these systems spread. Nothing in force reliably reaches the software your insurer’s contractor licensed from somebody else. Duties tend to bind a developer or a deployer, and the person in front of you may be neither.

None of that makes the existing rules worthless. A live duty you can point to beats a proposal, every time, and Texas gives a reader something concrete to ask for today.

It does mean the honest posture is narrower than the coverage suggests. Ask what your state requires. Ask when. Then ask who it binds, because a right that binds a company you have never heard of is exercised very differently from one that binds the clinic.

Write the three answers down. Which state. When. Who it binds.

Three lines on a page. That is the whole exercise. It takes an evening and it survives a change of staff, which is more than memory does.

Then keep the letter. Keep the date it arrived. A disclosure you were given late is only provable if you can show when it came.

Anyone in the household can do all three in an evening, with the letter in front of them. That is a smaller ambition than knowing your rights. It is also the version that survives contact with a real letter.