Does an AI Receptionist Have to Tell Callers It Is Not Human? (2026 Law)
AI receptionist disclosure laws in 2026: does an AI voice agent have to tell patients it is not human? What California, Utah, and healthcare rules mean for your practice front desk.
Ed
Security & Compliance, AI disclosure and consent
General information for practice owners, not medical, legal or tax advice.
A prospective patient calls your practice at 8:40 in the evening. A warm, competent voice answers, confirms the treatment they asked about, and offers two consult times. The caller books. Here is the question a growing number of practice owners now have to answer before that call ever happens: at what point in that conversation does the voice have to say it is not a person?
For most of the last three years the honest answer was "nowhere in particular." That is changing. In 2026 a series of state laws began requiring operators of automated voice and messaging systems to disclose, clearly, that the party on the line is not human. The instinct among owners is to treat that as a liability, a moment that breaks the spell and sends the caller elsewhere. The evidence points the other way. Disclosure, done well, is a trust event, not a leak. But it has to be built into the system, not bolted on after a complaint.
What the law actually requires now
The regulatory picture is no longer hypothetical, and it is not one federal rule. It is a patchwork of state statutes that a nationwide practice has to read together.
California. AB 3030, effective January 1, 2025, requires health care providers that use generative AI to write patient communications about clinical information to include a disclaimer that the message was AI-generated, plus clear instructions for reaching a human, unless a licensed provider reviews the message first. Separately, SB 243, effective January 1, 2026, regulates "companion chatbots": it requires disclosure that the user is not talking to a person where a reasonable user could be misled, expressly excludes customer-service bots, adds crisis-protocol reporting duties from July 1, 2027, and carries a private right of action of at least $1,000 per violation.
Utah. Anyone using generative AI in a high-risk consumer interaction, a category that expressly names healthcare, must disclose that fact at the start of the conversation, and mental-health-adjacent systems carry heavier disclosure and governance duties.
Colorado. C.R.S. § 6-1-1708 (as enacted by HB 26-1263), with duties effective January 1, 2027, requires an operator to disclose that a user is interacting with AI at the first interaction each day and whenever asked, to refer self-harm indicators to the 988 crisis line, and bars any suggestion that the system is a licensed health or mental-health professional. Both the vendor and the practice can be operators. To the extent the law applies, TTR maintains these safeguards as a baseline regardless.
The trend line. Firms tracking this space (DLA Piper, Baker McKenzie) describe AI-disclosure requirements on commercial interactions as rising quarter over quarter, with more states drafting. A practice that serves patients across state lines inherits the strictest rule its callers touch.
The specifics will keep moving. The durable takeaway does not: the direction of the law is toward plain identification on automated calls, and in healthcare that duty arrives sooner and harder than in most industries. TTR's standard is simpler than any single statute: every call and every text thread opens with a plain AI disclosure and a recording notice, in every state. This is the same posture we describe in a policy says PHI should not leak, an architecture makes it unable to: compliance you can prove beats compliance you assert.
Why disclosure is an asset, not a broken spell
The fear is that the moment the caller learns they are speaking with an automated assistant, they hang up. In practice, the opposite failure is more common and more expensive: a caller who suspects something is off, is never told, and later feels handled. That caller does not just leave. In a premium vertical, that caller tells other people.
The Thinking Robot builds Revenue Recovery Infrastructure as Lifelike Automations for exactly this reason. The thesis is cold math, warm front desk, and the warmth depends on honesty. Our master intake agent, Rosey, opens every call by stating plainly that she is an AI assistant, for example: "Hi, this is Rosey, [Practice]'s AI assistant. This call is recorded. I can get you booked, or get you a person right now." She repeats that she is AI whenever asked, and hands off to a human the instant the conversation needs one. That disclosure is not a weakness in the script. It is the amplification thesis stated out loud: the automation exists to free your coordinators for the work only they can do, not to impersonate them. You can hear how that sounds in the top questions prospective patients ask Rosey.
What a compliant intake disclosure sounds like
Disclosure is a design choice, and the good versions share four traits. Each is worth verifying before any vendor's system answers your line.
Early and plain. The identification happens near the top of the call, in ordinary language, not buried in a rushed legal footer. Utah's rule is explicit that high-risk healthcare interactions disclose "at the start."
A named human off-ramp. The caller can reach a person on request, and the system says so without being asked twice. California's healthcare disclaimer rule requires exactly this instruction to reach a human.
Logged. The disclosure, and the caller's path afterward, is recorded so you can prove what was said. This is the same accountability spine we cover in the ten-question vendor security questionnaire.
Built for HIPAA compliance underneath. Identity disclosure and PHI handling are separate obligations that have to hold at the same time. A system that discloses honestly but mishandles patient data has solved one problem and kept the worse one. The medical director's verification checklist walks through both.
Ask any prospective vendor to show you all four in a live call, not a slide. If they cannot, you are the one exposed, because the disclosure duty and the statutory penalty can attach to the practice and to the vendor; contract for who does what, but assume both are on the hook.
The math most owners have not run
Consider the exposure at the low end. Where a disclosure statute carries a private right of action, as California's companion-chatbot law (SB 243) does at a minimum of $1,000 per violation, a caller can sue directly. SB 243 is aimed at companion chatbots rather than customer-service lines, but read "per violation" as "per call" under any statute of that shape and the arithmetic gets uncomfortable fast for a practice running an undisclosed automated line at volume. Against that, the cost of building disclosure in from day one is close to zero, because it is a script decision and a logging decision, not a new system.
Illustrative model - not a client result or guarantee. The point is directional, not a prediction for your practice: the downside of getting disclosure wrong is open-ended and legal, and the cost of getting it right is a design choice you make once. That asymmetry is the whole argument. A practice that treats honest identification as part of the intake, the way it treats data handling built for HIPAA compliance under a signed BAA, or the HIPAA safeguards underneath it, is not choosing between compliance and conversion. It is buying both.
References
Future of Privacy Forum and National Law Review, on California SB 243 (effective Jan 1, 2026): disclosure of non-human status and private right of action at $1,000 minimum per violation.
Baker McKenzie analysis of U.S. laws governing AI assistants (Feb 2026), and DLA Piper, "AI disclosure laws on commercial interactions are on the rise" (Jan 2026): California healthcare AI-communication disclaimer requirement (AB 3030, effective January 1, 2025) and Utah high-risk-interaction disclosure at the start. Colorado: C.R.S. § 6-1-1708 (as enacted by HB 26-1263).
Next Step
If your premium practice runs more than 100 inbound consult inquiries a month and has no structured measurement of how many never reach a scheduled consultation, your pipeline may be leaking revenue you cannot see. The Line Audit shows you what actually happens: we call your line at the hours you're least likely to answer and send you the recordings with a written breakdown.
Audit Real-Time Conversational Velocity: Talk to Rosey, our AI receptionist, at +1 (720) 776-1664 (an AI demo line; calls are recorded).
