Episode 6 · 2026-08-07
AI Regulations and the Chatbot Laws Already in Force
Chatbot obligations already took effect across nine states, the EU, and California, with real Monday-morning consequences for operators.
Guest Michael Simon, a practising lawyer, on the chatbot obligations already in force across US states, the EU and California, and what an operator does about them on Monday.
Host Sam Rogers · guest Michael Simon, the AI lawyer · 32 min
A choice this episode can help with
Who owns the risk when a vendor's AI speaks to your customers?
Run it on your own work: The External Speech Map, one page, any model.
Watch it below, or read the conversation.
Listen
Or follow the show on Apple Podcasts, Spotify, or in any podcast app.
The signals
- Mike: privacy law was a patchwork; AI law is a minefield without a map. The state privacy build-out produced roughly two dozen general privacy laws that rhyme: about 85% is the same template, so a company complies with the common core and handles California and the outliers. The AI laws arriving now share no template, have no commonalities, and some contradict each other outright. The exposure at the top of a US operator's risk ranking is domestic, state by state, and already in force.
- Sam: 63 legal instruments that were never made to work together. Building the legal graph under EveryAILaw means splitting provisions mechanically, and the week the show aired that meant separating the Article 50 transparency obligation from the Article 13 one, two duties aimed at different people that travel under one word. The instruments are inconsistent in a way that makes the inconsistency your problem: nobody upstream is going to clean it up. Mike's on-air reaction: the best argument for why you need lawyers he has heard in a while.
The subtractions
- Mike: have AI write a lot less. A Claude user since it was just Claude, and he still uses it when he is stuck, for outlines, for something to throw ideas at. What he subtracted is the drafting. The tell is all over LinkedIn, and it is not the em dashes: it is prose written the way Captain Kirk talked, everything a short dramatic sentence. One or two of those work in a brief. An entire article of them does not, and he was publishing them.
- Sam: sensitive material never goes to a cloud model, and there is now an easy alternative. Legal material shared before the episode looked sensitive, so it never touched a cloud service. A local model running offline on the laptop stripped anything identifying and boiled eight pages down to about two, Sam read the output against the original, and only that redacted version went to Claude for episode prep. Mike's counterpoint from the leak history: assume anything typed into a consumer chatbot can surface.
About this episode
The center of the episode is the rundown: the chatbot obligations already in force, state by state, stacked in one pass so the cumulative weight is visible. New York, reasonable measures against content promoting self-harm, up to $15,000 per incident from the Attorney General. California, the same plus preventing sexually explicit material reaching minors, an annual disclosure to a suicide-prevention agency, and a private right of action. Washington, no simulating distress, no dark-pattern pleas to stay or pay, no "don't tell your parents," private right of action. Oregon, the self-harm measures published openly plus a mandatory interrupt-and-refer when a user shows signs of suicidal ideation, private right of action again. Connecticut, no implying the bot is a mental health professional. Iowa, four duties: prevent creation of sexually explicit material, never claim to be human, do not create dependency on the chatbot, and provide privacy tools for minors and parents. Then healthcare on top: Illinois, Texas, Nevada, and claims-substantiation rules in California, Tennessee, and Colorado.
The jurisdictional hook is the part operators most often get wrong: if you have a website offering products or services to anyone in the US, these laws reach you. Most of the AI statutes skip the revenue thresholds privacy law uses; impacting consumers in the state is enough, and the internet goes everywhere.
The liability point lands through a hobby Mike picked up from a security-minded CEO: open any customer-help chatbot and treat it like ChatGPT. More often than not it behaves like a free frontier-model instance, set to do anything, like the dealership bot that offered a Chevy Suburban for $20. Contracting with a vendor does not move the liability; the laws put the deploying company on the hook for what the bot does. His standing advice: you do not want to be a test case, because the companies in those cases spend millions just to get back to where they were.
Mike is a lawyer, not your lawyer: nothing in the episode is legal advice. He practices at Law+Data and is part-time chief strategy officer at Bells Up AI.
This week's links:
- EveryAILaw: Sam's free index of AI regulations, referenced throughout
- Law+Data: Michael Simon's firm
- Bells Up AI: AI for law firms, where Mike is part-time CSO
- Michael Simon on LinkedIn: mention the show in the invite
Mentioned on air, unpaid: EveryAILaw, the free index of AI regulations cited on air as the episode's source. No money changed hands. Disclosure: EveryAILaw is built by Sam, the show's host, and owned by PAICE.work.
Want to bring your own signal and subtraction? Find yours. Mentioned on air, unpaid: EveryAILaw.
Transcript
Read the conversation
Michael Simon: We're really into a minefield here. It's a minefield without a map. one of the things I tell clients constantly is, you do not want to be a test case.
Sam Rogers: Welcome to Signals and Subtractions. I'm your host, Sam Rogers. On Sunday, Article 50 of the EU AI Act went into effect, and with it, California's new AI transparency law. Most of the attention went to these big headlines. But what didn't is probably what matters to you. There are already chatbot laws in force in nine states, and more AI regulations landing with Every legislative session, so the rules are changing all the time. Maine just six days ago. Colorado more happens a week from now. There's been lots of flip-flopping European schedule slippage and suits in many states. So it makes you wish you knew someone with 30 years experience watching organizations And what they do when a rule meets a system that nobody's documented yet. And lucky for us, our guest today is Michael Simon. He practiced as a trial attorney for seven years, I believe it was,
Michael Simon: Almost seven, yes.
Put it to work
Where does AI communicate externally for your organization, and who is accountable for what it does?
The newsletter
Issue 63 · Sunday 9 August 2026 · sent on Substack and LinkedIn.
One signal, one subtraction, one analogy, in five minutes. It draws on this episode but stands on its own. Every issue.
The method from this episode is one page with its copy-paste prompt and schema: The External Speech Map, linked under the decision above. Every takeaway.
Keep the next choice in view
One signal, one subtraction and one analogy every Sunday. Five minutes, no video required.
Optional. Free on Substack, no account needed. Already on LinkedIn? Subscribe there.