ISSUE 011
The State AI Patchwork
I started this one expecting to write about Missouri's AI rules. Missouri does not have general ones yet. What I found instead is that the laws most likely to touch a business here were written in other states, and the clearest of them comes from Maine. I am not a lawyer and none of this is legal advice. It is a map of where to look.
An idea worth thinking about
What is actually moving in Jefferson City is about impersonation, not about how you use a chatbot
The Missouri Independent, a nonprofit newsroom covering state government, reported in February 2026 on the AI bills in front of the legislature. Seven House Republicans presented deepfake bills to the Emerging Issues Committee on the same day and said they intended to combine them. The bills create civil remedies and criminal penalties for AI-generated sexual images made without written consent, add AI-generated content to the state's definition of child pornography, and in the broadest version make distributing any non-consensual deepfake a crime.
One bill in the set is different, and it is the one a business should notice. Representatives Scott Miller and Phil Amato proposed shielding companies from criminal liability if they follow a voluntary federal guideline, the NIST AI Risk Management Framework. The same bill also states that AI is non-sentient so liability traces back to a human, and bars AI from owning property or being treated as a spouse.
Nothing in that list governs whether you disclose a chatbot, screen resumes with software, or let a model draft a quote. Two Democratic members objected that considering this many bills at once limits useful questions, and one proposed an expiry date so lawmakers could revisit. I would read the whole set as a legislature finding its footing rather than as a compliance obligation arriving at your door.
A tool I disappeared into
A running count of every AI bill in every state, kept by a firm that sells the complexity
MultiState is a commercial legislative-tracking company, and its public AI legislation page carries the clearest running count I have found. Fewer than 200 AI-related bills introduced in 2023. In 2024, 635 bills across 45 states with 99 enacted. In 2025, 1,208 bills across all 50 states — the first year every state introduced at least one — with 145 enacted. By March of 2026, 1,561 introduced, already past the whole of 2024, with sessions still running.
Say the conflict out loud. MultiState sells bill-tracking subscriptions, compliance guides and lobbying services. A fast-growing, confusing patchwork is its product category. The counts also rest on its own definition of AI-related, which that page does not publish, and a bill count is not a measure of how much law binds anyone, because most introduced bills die in committee.
Used carefully it is still the right first stop, because the direction and the order of magnitude are not in dispute and no public body publishes an equivalent tally this promptly. Treat the numbers as an index of legislative attention rather than of legal exposure, and go read the statute text for any state you actually sell into.
Learn something
The voluntary framework that state bills keep naming as a defence
NIST released the AI Risk Management Framework 1.0 on 26 January 2023. It is voluntary, free, and organised around four functions: Govern, Map, Measure, Manage. It was written for any organisation that builds or uses AI rather than only for large ones, and it is deliberately not a checklist. It is a structured way of asking what could go wrong, who would be harmed, how you would notice, and what you would do about it.
It matters here because legislatures keep pointing at it. The Missouri liability bill described above would make following it a shield from criminal liability. Colorado's 2024 AI act offered an affirmative defence to developers and deployers who follow a recognised AI risk management framework. If you want one document to read before any rules arrive, this is the one the drafters keep citing by name.
The companion material is free as well: the AI RMF Playbook, a Roadmap, a Crosswalk to other standards, and the Generative AI Profile, NIST AI 600-1, released 26 July 2024, which covers risks specific to generative systems. One vintage warning worth carrying: NIST says the framework is being revised as part of the White House AI Action Plan, so expect the 2023 text to change under you.
What we’re seeing
Maine requires any business whose chatbot could be mistaken for a person to say otherwise, and nothing about that rule stops at the Maine state line
The most useful survey I found of state chatbot-disclosure rules is a client alert from Cooley, a law firm, published 21 October 2025. Flag the conflict first: firms publish these to sell compliance work, and a year is a long time in this field. I went looking for a neutral count and did not find one. Searching this exact question returns page after page of near-identical marketing content with contradictory state lists, which is itself the best argument for reading statutes instead of summaries.
What the alert sets out, with the laws named. Maine's Chatbot Disclosure Act, enacted June 2025 and effective 24 September 2025, requires a business using an AI chatbot to communicate with consumers to tell them they are not talking to a live person, in circumstances where a reasonable consumer could not otherwise tell. It is enforced under Maine's Unfair Trade Practices Act. Cooley reports no business-size threshold.
The others are narrower than the headlines suggest. New York's AI companion law, effective 5 November 2025, applies to AI companion providers. Utah HB 452, effective 7 May 2025, applies to mental health chatbots and includes a safe harbour for suppliers running a specified internal compliance programme. California's SB 243, effective 1 January 2026, covers companion chatbots and explicitly excludes chatbots used only for customer service. Utah's AI Policy Act as amended requires a chatbot to say it is AI when a consumer asks directly, and in high-risk interactions. Cooley counts at least six states enacting new AI chatbot laws in 2025.
Maine is the one that reaches an ordinary business, and consumer-protection statutes generally follow the consumer. If a Cape Girardeau shop sells to someone in Portland through a website chat window, that is the kind of rule that can apply. I want to be careful here: the sentence before last is general legal logic, not a holding about this act applied to a Missouri seller, and whether it reaches you depends on facts I do not have. It is a reason to spend an hour with a lawyer, not a conclusion you can act on from a newsletter.
I will also name what is wrong with my own source, because it tells you something. The Cooley alert's heading says Colorado's law was delayed six months while its text says five, and the dates it gives fit neither. It misspells the Illinois act in one place. These are small errors in a careful piece by expert lawyers, and they are a fair measure of how difficult this subject currently is to state accurately.
The practical version, for a business with one location and customers in several states: disclosure rules are cheap to satisfy and expensive to argue about. A line reading you are chatting with an automated assistant costs nothing and closes the question. Most of the rest of the patchwork — high-risk decision systems, developer duties, frontier-model transparency — is aimed at organisations considerably larger than yours.
One question
Does your website chat say it is automated?
If it does not, I would like to know what is stopping you: a vendor setting you cannot find, a worry about conversion, or simply that it is nobody's job. Reply and tell me which.
More in this pillar as it's written.
— Shana
Sources link to the original publisher, never to a summary.