AI Disclosure Requirements: Complete SMB Guide

The three laws at a glance

• Colorado SB 24-205 — broadest. Effective June 30, 2026. $20K/violation. Applies to any consumer-facing AI.
• Illinois HB 3773 — narrowest. Effective Jan 1, 2026. $10K/violation. Employment AI only.
• California CPPA ADMT rules — most detailed. Effective Oct 1, 2025. $7.5K/violation. Significant decisions about consumers.

What ALL three require

• A clear notice before AI processes consumer data
• Plain-English description of what the AI does
• An opt-out or human-review path
• Documentation you can produce on request

Universal disclosure template

If you write one disclosure that satisfies all three laws, here's a starting point:

Where to put the disclosure

• Above the fold on any page where AI processes data (chat widgets, hiring forms, pricing pages)
• In your privacy policy with a dedicated AI section
• Inside the AI tool itself — chat widgets should have an in-widget disclosure
• In job applications if you use AI screening

What you DON'T need to do

• You don't need to expose your proprietary algorithms
• You don't need to stop using AI
• You don't need a fancy AI ethics board (unless you're enterprise-sized)
• You don't need to translate to 12 languages — English is fine for most SMBs

Penalty exposure summary

Per affected consumer per violation:

• Colorado: up to $20,000
• Illinois: up to $10,000
• California: up to $7,500

For a small site with 100 affected consumers, total exposure could reach $3.75M. Most enforcement, though, will start with cease-and-desist letters and modest fines for clear non-compliance.