Stage 7: AI features

The short answer

If a person talks to your AI feature, tell them it is an AI, at the start, in plain words. If your app sends user data to an outside AI company, say so and ask first. Make no claim about your AI that you cannot prove with a test you kept. Then check whether your feature is a companion chatbot, a content generator or a decision tool, because each of those triggers extra rules.

Why this matters

These rules are not future plans. Most of them apply today.

• The EU AI Act transparency rules apply now. The EU AI Act is the European Union's law on artificial intelligence. Its Article 50, the transparency article, applies from 2026-08-02. In 2026 the EU passed a change package called the Digital Omnibus on AI. It moved the dates for high-risk systems, but it did not move Article 50. Its only change there is a short grace period for one duty, the machine-readable marking of AI output, and only for systems already on the market (Cuatrecasas, Hunton).
• The EU fines are large. A breach of the Article 50 duties can bring a fine of up to EUR 15,000,000 or 3% of total worldwide yearly turnover, whichever is higher. For small and medium companies and start-ups, the lower of the two applies (Article 99, unofficial mirror).
• California lets people sue companion chatbot operators. California's SB 243 took effect on 2026-01-01. A person injured by a breach can sue for actual damages or $1,000 per violation, whichever is greater, plus lawyer fees (SB 243 chaptered text, Cooley on the date).
• The FTC acts against false AI claims. The FTC is the US Federal Trade Commission, the agency that polices unfair and deceptive business practices. In September 2024 it announced Operation AI Comply, five cases against deceptive AI claims. One was DoNotPay, which sold a "robot lawyer" and agreed to a proposed $193,000 settlement. Another was Rytr, an AI tool that the FTC said could generate fake reviews. The FTC chair at the time said: "there is no AI exemption from the laws on the books" (FTC press release).
• Apple checks data you send to AI companies. Apple's App Review Guideline 5.1.2(i) says you must clearly disclose where personal data is shared with third parties, "including with third-party AI", and get explicit permission first (Apple App Review Guidelines). This applies to apps on the App Store: if yours sends user text to an AI model you do not run, this is you.
• Utah fines per violation. Utah's AI disclosure law allows fines of up to $2,500 per violation, and it is not a defense that the AI said it, not you (Utah SB 226, enrolled text).

Core concepts

Classify your AI feature first

Different laws attach to different kinds of AI feature. Before you read any rule, write down which kind you have. Most apps have one or two of these:

Every AI feature also falls under the FTC rule on claims: what you say about it must be true.

Worked example. Your app is a recipe planner. It has a chat that answers cooking questions and it sends the user's pantry list to an outside model. That is a bot that talks to people, and a tool that sends user data to an AI company. It is not a companion chatbot, because it is a productivity tool and does not try to build a relationship. It is not a decision tool. So you need an AI notice in the chat, a disclosure and consent for the data flow, and honest marketing. Write that classification down. If someone asks later, you can show why SB 243 does not apply.

Tell people they are talking to an AI

The most common rule is also the simplest: a person must not think they are talking to a human when they are not.

• EU, Article 50(1). If you provide an AI system meant to talk directly with people, you must design it so people are told they are talking to an AI. The exception is when that is obvious to a reasonably well-informed person (Article 50, unofficial mirror). I read the text on an unofficial mirror site, because the official EU site did not load for my research.
• Utah, SB 226. A business that uses generative AI to talk with a person in a consumer transaction must say it is AI and not human, if the person clearly asks. People in regulated jobs, such as licensed health or finance work, must disclose AI up front in "high-risk" chats, for example ones that collect health or financial data or give advice people may rely on. There is a safe harbor, which is a rule that protects you from enforcement if you meet it: no action is taken if the AI clearly says, at the start and throughout the chat, that it is generative AI and not a human (Utah SB 226). This text took effect on 2025-05-07. I did not check for changes made in the 2026 session.
• California BOT Act. An older California law from 2019 makes it unlawful to use a bot that hides that it is a bot, in order to push a sale or sway a vote. Clear disclosure is the defense. I could not open the statute text, so this rests on a law-firm summary (Davis Wright Tremaine).
• Your model provider. Anthropic's Usage Policy says consumer chatbots that talk to outside users must disclose that they are AI, at least at the start of each session or in the interface (Anthropic Usage Policy). The version I read says it is effective on 2026-11-12, which is after the date I checked it, so I could not confirm which version is live today. Read the page on the day you launch.

One notice meets the spirit of all four. Worked example. Put this line in the chat, above the first message, every session:

You are chatting with an AI assistant, not a person. It can make mistakes.

Do not hide it in a tooltip or the terms. Do not give the bot a human name and photo with no label. If your bot hands off to a human, say so when that happens.

Here is a fact from my own app. When I checked Ducktate, each AI cleanup provider in the app names where text goes. But the "Ask your notes" chat does not say in its first message that an AI writes the answer. That gap is small, and it is still open as of 2026-10-09. It shows how easy this is to miss on a feature you think of as search, not chat.

Mark and label what your AI makes

Article 50 has two more duties for content.

Marking (Article 50(2)). If you provide a system that generates synthetic audio, images, video or text, its output must be marked in a machine-readable way, which means a mark that software can detect, such as metadata or a watermark. Light editing help that does not change the input much is excepted (Article 50, unofficial mirror).

Labels (Article 50(4)). If you use AI to make a deepfake, which is content that would falsely look real, you must disclose it. If you publish AI-written text to inform the public on matters of public interest, you must disclose that too, unless a human reviewed it and a person holds editorial responsibility. Article 50(3) adds a duty to inform people exposed to emotion recognition or biometric categorization systems.

The dates, as reported by law firms (I could not open the official text of the Omnibus):

Sources: Cuatrecasas, Hunton, Lewis Silkin.

Worked example. You launch an app in October 2026 that makes product photos with an image model from a vendor. Your app is new, so there is no grace period. Ask the vendor in writing how its outputs are marked, and keep the answer. If you strip image metadata during upload or resize, you may strip the mark too. Test one output before launch.

Companion chatbots in California

California's SB 243 covers a companion chatbot: an AI system with a natural-language interface that gives adaptive, human-like replies, can meet a user's social needs, and can keep a relationship going across many chats. It does not cover bots used only for customer service, business operations, productivity, internal research or technical help, some video-game bots, or simple voice assistants. An operator is anyone who makes a companion chatbot platform available to a user in California (SB 243 chaptered text). I read a copy of the chaptered bill hosted by a law firm, because the official California site refused my request.

If your bot is a companion chatbot and you have users in California, SB 243 requires:

1. A clear notice that the bot is AI and not human, if a reasonable person could be misled.
2. A protocol to prevent suicide and self-harm content, including a referral to a crisis line, with details published on your website.
3. For users you know are minors: say it is AI, show a reminder at least every three hours to take a break and that the bot is not human, and take reasonable steps to stop sexual content.
4. A notice to all users that companion chatbots may not be suitable for some minors.
5. From 2027-07-01, a yearly report to California's Office of Suicide Prevention, with counts and no user identifiers.

Worked example. A "study buddy" bot that remembers each student, asks how they feel, and chats every evening can meet the definition, even if you call it a productivity tool. A bot that only answers questions about your invoices does not. If you are near the line, write down why, and plan as if it applies.

Asking before you send data to an AI company

When your app sends a user's text, voice or photos to a model you do not run, that company receives personal data. Apple's guideline 5.1.2(i) asks for two things: clear disclosure of where the data goes, "including with third-party AI", and explicit permission before you send it (Apple App Review Guidelines). I read explicit permission as an action the user takes, such as tapping a button that says what will happen. A line in your privacy policy alone does not look like that.

Worked example. A journaling app adds "Summarize my week". Before the first summary, show a screen: "To write your summary, we send this week's entries to OpenAI. OpenAI processes them under its terms. Continue?" with "Send and summarize" and "Not now". Then name the provider in your privacy policy too (Stage 3 covers the policy).

Claims, provider rules and big decisions

Claims. The FTC cases above share one pattern: the company said its AI could do something it could not prove. DoNotPay called its product a "robot lawyer". Rytr was charged over an AI tool that generated fake reviews. The other three cases were Ascend Ecom, Ecommerce Empire Builders and FBA Machine; the FTC reports consumer losses of at least $25 million for Ascend Ecom and more than $15.9 million for FBA Machine (FTC press release). Before you write "accurate", "replaces a lawyer" or "99%" on your site, keep the test that proves it.

Provider rules. Your model provider's usage policy is a contract you accepted. Anthropic's policy lists high-risk uses, such as legal, medical, financial, insurance, housing, employment and education advice, and asks for a qualified human in the loop plus disclosure (Anthropic Usage Policy). OpenAI publishes its own usage policies. Its page refused my request, so I could not confirm its current wording. Read the policy of each provider you use.

Big decisions. Colorado passed SB 26-189 in 2026. It repealed and replaced the earlier Colorado AI Act. The Governor signed it on 2026-05-14. It covers automated decision-making technology that materially influences "consequential decisions": education, employment, housing, lending, insurance, health care and essential government services. It gives users notice at the point of interaction, a plain explanation within 30 days of an adverse decision, and rights to correct data and ask for human review. The bill page lists start dates for the duties, with developer documentation from 2027-01-01 (Colorado SB 26-189). I did not read the full statute text, so check each duty's date before you rely on it. If your app does not help make one of those decisions, write that down and move on.

Key terms

The checklist

• Write down which kinds of AI feature your app has: chat, companion, generator, decision tool, or data sent to an AI company.Must doSource: EU AI Act Article 50 (mirror), California SB 243 text, Colorado SB 26-189
• Show a plain "you are chatting with an AI, not a person" notice at the start of every chat session.Must doSource: EU AI Act Article 50 (mirror), Utah SB 226, Anthropic Usage Policy
• Never give a bot a human name or photo without an AI label, and never let it deny being an AI when asked.Must doSource: Utah SB 226, BOT Act summary
• If your app is on the App Store, name the outside AI company and get explicit permission with a clear button before you send it user data.If it appliesSource: Apple App Review Guidelines 5.1.2(i)
• If your app generates images, audio, video or text, ask your model vendor in writing how outputs are marked, and check your app does not strip the mark.If it appliesSource: Cuatrecasas on the Omnibus dates, EU AI Act Article 50 (mirror)
• If you publish deepfakes or AI-written public-interest text, label them as AI-made.If it appliesSource: EU AI Act Article 50 (mirror)
• If your bot is a companion chatbot with California users, add the AI notice, a published self-harm protocol with a crisis-line referral, the minors notice, and three-hour break reminders for known minors.If it appliesSource: California SB 243 text
• If your bot is support or productivity only, write one paragraph on why it is not a companion chatbot and keep it with your launch notes.Should doSource: California SB 243 text
• Remove any AI claim from your site and app store page that you cannot prove with a test you kept.Must doSource: FTC Operation AI Comply
• Read the usage policy of every AI model provider you use on launch day, and note its rules on advice, high-risk uses and minors.Must doSource: Anthropic Usage Policy, OpenAI usage policies
• If your AI helps decide hiring, lending, housing, insurance, health care, education or benefits, plan Colorado notices and documentation for 2027.If it appliesSource: Colorado SB 26-189
• If you work in a licensed field in Utah and your AI collects health, financial or biometric data or gives advice, disclose the AI before the chat starts.If it appliesSource: Utah SB 226

The prompt for your agent

Copy this into Claude Code, Codex or Cursor from the root of your project. It finds every place your app talks to an AI model, then checks each one.

Audit this project for Stage 7 of a launch checklist: AI features.
Do not change any code, copy, config, or prompt until I approve a plan.

First, list every place the app calls an AI model or AI API (OpenAI, Anthropic,
Google, OpenRouter, a local model, or any other). For each, say what user data is
sent and which feature uses it.

Then, for each item below, report PASS, FAIL, or UNKNOWN, with the file and line
that proves it. If you cannot prove an item from the code, report UNKNOWN.
Never report PASS without evidence.

1. Classify each AI feature: chat with people, companion-style bot (remembers the
   user, human-like, social), content generator, decision tool (hiring, lending,
   housing, insurance, health, education, benefits), or data sent to an AI company.
2. Does every chat or assistant UI show a notice that the user is talking to an
   AI, visible at the start of each session (not only in a tooltip or the terms)?
3. Does any bot have a human name or avatar without an AI label? Does any system
   prompt tell the model to claim it is human or to deny being an AI?
4. Before user data is first sent to an outside AI provider, does the app name the
   provider and ask for explicit permission with a button or toggle? Where is that
   choice stored, and is it checked before every call?
5. Does the privacy policy in the repo name each AI provider that receives data?
6. If the app generates images, audio, or video: does any upload, resize, or
   export step strip metadata that could carry an AI mark?
7. If any feature is companion-style: is there a self-harm protocol with a
   crisis-line referral, a minors notice, and a break reminder for known minors?
8. List every claim about AI in the marketing site, app store text, and in-app
   copy (accuracy, "replaces", percentages). Is there a test or eval in the repo
   that supports each one?
9. Does any AI feature give legal, medical, or financial advice without a human
   review step?

End with a table: item, status, evidence (file and line), and the smallest fix you
suggest. Then stop and wait for my approval.

When the report comes back, open two of the cited files yourself. Look at the chat screen in the running app too. A notice that exists in code but never shows on screen is a FAIL.

Common mistakes

• Believing the EU "delayed the AI Act", so Article 50 can wait. The Omnibus moved the high-risk dates. Article 50 applies from 2026-08-02.
• Putting the AI notice in the terms of service only. People must see it where they chat.
• Calling a relationship-style bot a "productivity tool" to avoid SB 243, while it remembers the user and asks how they feel.
• Sending user notes or photos to an AI API with no permission step, because "it is in the privacy policy".
• Writing "99% accurate" or "replaces your lawyer" on the landing page with no test behind it.
• Reading the model provider's policy once, at sign-up, and never again.
• Treating every AI feature the same. A support bot, a companion and a decision tool fall under different rules.

Check yourself

Resources

• EU AI Act Article 50 (unofficial mirror)LawFree

  The transparency duties, in readable form, with links to the rest of the Act.

• Cuatrecasas: the Digital Omnibus on AI is publishedArticleFree

  What the 2026 change package moved, and the Article 50 marking grace period.

• Hunton: Digital Omnibus on AI enters into forceArticleFree

  A second law-firm reading of the same dates.

• California SB 243, chaptered text (law-firm copy)LawFree

  The full companion chatbot law, short enough to read in one sitting.

• Utah SB 226, enrolled textLawFree

  Utah's AI disclosure rules and the safe harbor.

• Colorado SB 26-189LawFree

  The bill page for Colorado's automated decision-making law.

• Apple App Review GuidelinesGuidanceFree

  Guideline 5.1.2(i) on sharing data with third-party AI.

• FTC: Operation AI ComplyGuidanceFree

  Five cases that show which AI claims the FTC treats as deceptive.

• Anthropic Usage PolicyDocsFree

  AI disclosure and high-risk use rules for apps built on Claude.

• OpenAI usage policiesDocsFree

  The equivalent rules for apps built on OpenAI models.

Next stage

Your AI features now say what they are. Stage 8 is for apps where users post, upload or share content: who is liable for what they put there, and the takedown processes the law expects you to run.