When must AI-generated content be disclosed — to customers, regulators, employees? Here's the emerging legal landscape and policy framework.
For most of 2023 and 2024, AI disclosure was treated as a best practice — something you did to build trust. That framing is out of date. The FTC, multiple state legislatures, and industry regulators have moved from encouragement to enforcement. If your company generates marketing copy, customer communications, legal documents, financial advice, or health information using AI tools, you're operating in a regulated space whether your policy reflects that or not.
The rules don't require you to label every spellcheck suggestion as "AI-assisted." What they target is specific: AI-generated personas pretending to be humans, fabricated endorsements, synthetic voices or likenesses, and automated advice passing as professional human judgment. Your policy needs to draw that line clearly for every employee who touches a content workflow.
For background on how shadow AI use — employees using AI tools without formal approval — creates undisclosed content risks, see our overview of what shadow AI is and why it matters for employers.
The FTC's authority over AI-generated marketing flows primarily from Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices. In May 2024, the FTC issued its "Attention FTC Act" policy statement making clear that using AI to generate fake reviews, fabricate endorsements, or create deceptive consumer personas violates Section 5 — no new statute required.
The FTC's August 2024 final rule on fake reviews and testimonials (16 CFR Part 465) went further. It explicitly prohibits businesses from creating, buying, or disseminating consumer reviews generated by AI when those reviews are not from genuine consumers sharing genuine experiences. Violations carry civil penalties of up to $51,744 per violation. If your marketing team is using ChatGPT or similar tools to draft testimonials, case study quotes, or "customer" social posts, that workflow needs to stop — or be explicitly approved with genuine human review and attribution.
The FTC's endorsement guides (16 CFR Part 255), updated in 2023, also require that any material connection between an endorser and a brand be disclosed — and the FTC has confirmed this applies when AI generates content attributed to a named individual. Your policy should require employees to get explicit written approval from any named person before publishing AI-generated content in their voice.
Several states have passed or are advancing laws that impose specific AI disclosure obligations. The one most likely to reach an ordinary employer's marketing team is the synthetic performer rule in advertising, covered in the next section. The rest of this list governs digital replicas of real people, AI providers, and political ads.
The practical implication for your policy: if your company operates in California or produces content involving real people's voices or likenesses, you need an explicit approval workflow before any AI-generated audio, video, or image goes out the door. "We got it from a stock prompt" is not a defense under AB 1836.
A synthetic performer is an AI-generated person who looks or sounds like a human performer but is not recognizable as any real, identifiable person. That is the opposite of a deepfake, so a policy written only about deepfakes misses it. Two states now require advertisers to disclose one, and their rules do not match.
The trap is building one rule for both states. A process that skips disclosure on audio-only ads is correct in New York today and under-complies in California from 2027. Write the stricter rule into your policy: disclose any AI-generated performer or voice in any ad format. Both dates are on our AI regulation compliance deadlines tracker.
General FTC and state rules set a floor. Several industries have layered disclosure requirements on top that are significantly more specific.
HIPAA doesn't directly regulate AI-generated content, but the HIPAA Privacy Rule (45 CFR § 164.502) and Security Rule (45 CFR § 164.312) apply the moment patient data touches an AI tool used to generate communications. Beyond HIPAA, the FDA has issued guidance on AI-generated content in direct-to-consumer drug advertising — if your health organization uses AI to draft promotional materials, those materials remain subject to FDA's prescription drug advertising rules under 21 CFR Part 202. The bottom line: AI doesn't exempt healthcare content from existing accuracy and disclosure obligations; it adds a new vector for violations. See our HIPAA-compliant AI tools comparison for BAA status across the tools your team is likely already using.
FINRA and the SEC both treat AI-generated client communications as subject to existing content standards. FINRA Rule 2210 requires that all communications with the public be fair, balanced, and not misleading — AI authorship doesn't change that obligation. The SEC's Marketing Rule for investment advisers (Rule 206(4)-1 under the Investment Advisers Act) explicitly governs testimonials and endorsements, and the SEC has signaled in examination priorities that AI-generated performance representations are on its radar. If your firm uses AI to draft client-facing commentary, disclosures, or reports, those documents need human review and sign-off before distribution.
Courts are moving faster than legislatures here. Multiple federal courts — including the Southern District of New York and the Northern District of Texas — have issued standing orders requiring attorneys to certify whether AI tools were used to draft filings and whether outputs were verified by a human attorney. Several state bars have issued formal ethics opinions requiring disclosure of AI use in client communications. Check your jurisdiction's bar guidance before assuming silence means permission.
The standard "this content was generated with AI assistance" footer has limited legal value if it doesn't match what regulators actually want disclosed. Here's how to think about customer-facing disclosure by content type:
| Content Type | Disclosure Risk Level | What to Disclose | Applicable Rule |
|---|---|---|---|
| Customer reviews / testimonials | High | AI-generated reviews must not be published; must come from real customers | FTC 16 CFR Part 465 |
| Marketing copy / ad content | Medium | Disclose if a named person's voice/likeness is AI-generated | FTC Act § 5; CA AB 1836 |
| Chatbot / automated customer service | High | Must disclose bot identity if customer asks; some states require proactive disclosure | CA B.O.T. Act (Bus. & Prof. Code § 17940) |
| Blog / editorial content | Low–Medium | Disclose if published under a named human byline who didn't write it | FTC Act § 5 (deceptive attribution) |
| Financial / legal client reports | High | Disclose AI use; require human professional sign-off | FINRA Rule 2210; SEC Rule 206(4)-1; bar ethics rules |
| Political advertising | Very High | Explicit AI-generated content label required in many states | State election laws (vary by state; check yours) |
For chatbots specifically: California's Bolstering Online Transparency (B.O.T.) Act (Business and Professions Code § 17940–17945) prohibits using a bot to communicate with California residents online to influence a sale or vote without disclosing that the communication is automated. If your customer service or sales team uses an AI chat tool, that tool must identify itself as automated when asked — and your policy needs to say that explicitly.
Your policy needs to distinguish between two different disclosure contexts, because they have different audiences, different stakes, and different rules.
External disclosure is about what you tell customers, regulators, courts, and the public. Internal disclosure is about what employees tell managers, HR, and legal before content goes out. Both matter — but conflating them leads to policies that are either too restrictive internally or too permissive externally.
Internal disclosure requirements your policy should include:
External disclosure requirements your policy should lock in:
The disclosure and transparency section of your acceptable use policy is where these requirements live. See the disclosure and transparency section of our AI acceptable use policy template — Section 8 covers EU AI Act Article 50 obligations and US synthetic-performer advertising disclosure language you can adapt directly.
Use this framework as a quick-reference decision tree at the team level. Every content workflow — marketing, customer service, legal, finance — should map to one of these branches. If a workflow consistently hits the "consent required" or "do not publish" branches, that's a signal to restructure the process, not find a workaround. To put this into a formal policy, generate a tailored policy kit that includes industry-specific disclosure clauses and approval workflow language your team can implement without starting from scratch.
About Shadow AI Policy: We build AI acceptable use policy tools for HR and operations teams at 50–500 person companies. We publish guides on shadow AI, acceptable use policies, and AI governance, updated as regulations and AI tools change.
Disclosing AI use means telling someone that an AI tool was involved in a workflow — that's an internal governance practice. Disclosing AI-generated content means telling a customer, regulator, or recipient that a specific output was created by AI, not a human. Regulators care about the second category, not the first. Your policy needs to cover both, but the external disclosure obligation is the one that carries legal risk.
In California, yes — the B.O.T. Act (Business and Professions Code § 17940) prohibits using a bot to communicate with California consumers to influence a commercial transaction without disclosing it's automated. The bot must disclose its automated nature when directly asked, and it cannot deny being a bot. Other states are moving in the same direction. Build proactive disclosure into the chat UI now rather than waiting for your state to pass its own version.
Most current disclosure rules target external content — what you send to customers, courts, regulators, or the public. Internal use of AI (drafting memos, summarizing meetings, generating internal reports) isn't directly regulated in most jurisdictions. That said, if an internal document later becomes discoverable in litigation, or if it contains fabricated information about a real person, the usual defamation and accuracy obligations still apply. Your policy should require human review of AI outputs before any document crosses the internal/external boundary.
Run every content piece through two questions: Is this attributed to a named or identifiable person? And did that real person actually write it or verify it? If the answer to the first is yes and the second is no, you have a deceptive attribution problem under FTC Act Section 5 and potentially the fake reviews rule at 16 CFR Part 465. Pull any testimonial, review, or quote that was AI-drafted and attributed to a specific person — even a composite persona — and replace it with verified human-sourced content before publishing.
Free tool: See the AI regulation deadline tracker → Each compliance date marked as verified, or not, against the enacted text.
Tailored to your industry and the AI tools your team uses. Free preview, then $149/mo to keep it current as the rules and vendor terms change — or $79 for a one-time snapshot.
Generate my policy kit →Writing policies for several clients? MSPs, IT consultancies and fractional CISOs keep a roster of client kits that refresh monthly, under their own branding. See partner plans →