While Europe enforces one AI rulebook, the United States is producing its own characteristic alternative: dozens of them. With comprehensive federal AI legislation stalled, state legislatures have moved into the gap, and the chatbot has become their favourite subject - on the order of a hundred chatbot-specific bills have been introduced across most of the states in recent sessions. The themes rhyme without matching: requirements that bots disclose they are not human, special protections where minors interact with conversational AI, restrictions on bots that simulate therapists or offer mental-health support, rules against AI impersonation of real people, and duties around what a companion chatbot may encourage. Any single bill is a reasonable response to a real incident. The aggregate is something else: a compliance patchwork in which the same product faces different obligations at every state line it crosses.
This is not a new American story - privacy, data-breach notification and consumer protection all went through the same sequence of federal vacuum, state experimentation and eventual painful reconciliation - but chatbots make an unusually awkward subject for it. A chatbot does not ship to a state; it converses with whoever arrives, and the user's location is often unknown at exactly the moment obligations attach. The strictest-state problem follows immediately: a business that cannot geo-differentiate its bot's behaviour ends up complying everywhere with the most demanding rule anywhere, which quietly converts one legislature's judgment into national policy without anyone voting for that. And because many bills target categories with soft edges - what exactly makes a bot a companion, when does helpful conversation become mental-health support - the practical burden lands less on the bad actors the bills imagine than on ordinary deployers trying to classify themselves honestly.
The substantive concerns underneath the wave deserve respect even from those exasperated by its form. The incidents motivating legislators are real: people forming dependencies on companion bots, minors in long unsupervised conversations with systems optimised for engagement, chatbots drifting into quasi-therapeutic territory with none of the duties a human counsellor carries, and synthetic personas passing as real people. Disclosure - the one requirement appearing in nearly every bill - is the floor, and businesses already covered here on the voluntary case for telling customers they are talking to AI will recognise the argument; the state wave converts that hygiene into law with penalties attached. What the patchwork adds beyond the floor is variance: the same duty of care implemented five different ways, with five definitions and five enforcement postures.
For a business running or planning a chatbot in the American market, three moves are worth making now, before the map hardens. First, adopt the emerging common denominator voluntarily and uniformly: clear AI disclosure at the start of every conversation, honest limits on what the bot claims competence in, and hard refusals plus human referral wherever conversations approach health, crisis or legal territory - this is both defensible design and the likely centre of gravity of eventual harmonisation. Second, know your bot's exposure: whether minors can realistically use it, whether anything in its persona invites emotional reliance, whether its subject matter brushes regulated ground - these are the classification questions the statutes turn on, and answering them deliberately beats discovering them in a demand letter. Third, build the operational capacity to vary behaviour by jurisdiction, because whatever reconciliation eventually comes, the interim belongs to the patchwork. American federalism is running its standard experiment on a new subject. The businesses that fare well under it are always the ones that treated the strictest plausible rule as the design target rather than the worst case.