Since
the
public
release
of
ChatGPT
in
November
2022,
solo
and
small
law
firms
have
been
inundated
with
ethics
opinions
by
the ABA and 20
different
states regarding
artificial
intelligence
use
and
client
disclosure
obligations.
While
these
ethics
considerations
are
important,
the
real
disclosure
requirements
that
firms
need
to
worry
about
are
emerging
state
laws
that
mandate
specific
AI
disclosures
and
that
carry
concrete
penalties
for
noncompliance.
State
AI
Disclosure
Laws
Currently,
three
states—Utah,
New
Jersey,
and
Maine—have
enacted
legislation
requiring
disclosure
when
businesses,
including
law
firms,
use
AI
to
interact
with
consumers.
What
makes
these
laws
particularly
significant
for
solo
and
small
firms
is
their
potential
extraterritorial
reach
and
the
specific
penalties
attached
to
violations.
Utah’s Artificial
Intelligence
Policy
Act
(AIPA) was initially
passed
as
SB149
in
2024.
The 2025
amendments
through
SB226 modified
the
mandatory
disclosures
to
apply
only
to
“high-risk
artificial
intelligence
interactions”
which
include
“financial,
legal,
medical,
or
mental
health
advice
or
services.”
This
means
that
if
a
solo
practitioner
uses
an
AI
chatbot
or
phone
receptionist
to
handle
initial
client
inquiries,
schedule
consultations,
or
provide
preliminary
legal
information,
they
must
clearly
disclose
the
AI’s
involvement.
New
Jersey bot
law makes
it
unlawful
to
use
an
online
bot
to
communicate
with
another
person
in
the
state
“with
the
intent
to
mislead
the
other
person
about
the
bot’s
artificial
identity”
to
incentivize
commercial
transactions
which
would
encompass
an
engagement
with
an
attorney.
The
penalties
for
violations
are
substantial:
$2,500
for
a
first
offense,
$5,000
for
a
second
offense,
and
$10,000
for
each
subsequent
violation. Similarly,
Maine’s AI
law prohibits
use
of
an
AI
bot
to
incentivize
a
transaction
unless
users
are
notified
that
they
are
not
interacting
with
a
human.
Civil
penalties
of
up
to
$1000
apply
for
each
violation.
The
Extraterritorial
Challenge
Many
solo
and
small
firms
may
assume
these
laws
don’t
apply
to
them
if
they’re
not
physically
located
in
Utah,
New
Jersey,
or
Maine.
This
assumption
could
prove
costly.
Modern
digital
marketing
and
client
acquisition
mean
that
law
firms
routinely
interact
with
potential
clients
across
state
lines.
A
firm’s
website,
online
advertising,
or
AI-powered
intake
systems
can
reach
residents
of
any
state,
potentially
triggering
that
state’s
disclosure
requirements.
Consider
this
practical
scenario:
A
small
immigration
law
firm
in
Texas
uses
an
AI-powered
chat
system
on
its
website
to
answer
common
questions
about
visa
applications.
If
a
potential
client
from
Salt
Lake
City
visits
the
website
and
interacts
with
the
chatbot,
the
firm
must
comply
with
Utah’s
disclosure
requirements—even
though
the
firm
itself
is
based
in
Texas.
The
connection
to
Utah
through
the
client’s
location
could
trigger
the
law’s
application.
The
reality
is
that
if
a
firm’s
AI
tool
interacts
with
someone
in
a
regulated
state,
the
firm
could
face
penalties
regardless
of
its
own
location.
This
is
particularly
challenging
for
small
firms
that
may
use
third-party
AI
services
for
client
intake,
document
review,
or
legal
research
without
fully
understanding
where
their
potential
clients
are
located
when
initial
contact
occurs.
Practical
Compliance
Steps
To
navigate
this
regulatory
landscape,
solo
and
small
firms
should
implement
several
protective
measures.
First,
incorporate
clear
AI
disclosure
language
at
the
beginning
of
any
automated
interaction,
whether
through
chatbots,
email
automation,
or
phone
systems.
Second,
don’t
rely
on
vendor
assurances
for
compliance;
fact-check
disclosures
yourself.
Third,
maintain
documentation
(or
insist
that
your
vendor
does)
showing
when
and
how
AI
disclosures
were
provided
to
protect
against
potential
enforcement
actions.
Looking
Forward
The
focus
on
ethics
rules,
while
important,
has
overshadowed
the
more
immediate
legal
requirements
imposed
by
state
legislation.
These
laws
don’t
merely
suggest
best
practices—they
mandate
specific
disclosures
with
real
penalties
for
noncompliance.
As
more
states
consider
similar
legislation,
the
patchwork
of
requirements
will
only
become
more
complex.
Solo
and
small
firms
must
recognize
that
AI
regulation
extends
far
beyond
bar
association
guidance.
State
consumer
protection
laws,
disclosure
requirements,
and
emerging
AI-specific
legislation
create
a
multi-layered
compliance
obligation
that
requires
immediate
attention.
The
firms
that
thrive
in
this
new
environment
will
be
those
that
proactively
address
both
the
ethical
and
legal
dimensions
of
AI
use,
ensuring
they
meet
not
just
professional
standards
but
also
the
growing
body
of
state
regulatory
requirements.
Carolyn
Elefant
is
one
of
the
country’s
most
recognized
advocates
for
solo
and
small
firm
lawyers.
She
founded
MyShingle.com
in
2002,
the
longest-running
blog
for
solo
practitioners,
where
she
has
published
thousands
of
articles,
resources,
and
guides
on
starting,
running,
and
growing
independent
law
practices.
She
is
the
author
of
Solo
by
Choice,
widely
regarded
as
the
definitive
handbook
for
launching
and
sustaining
a
law
practice,
and
has
spoken
at
countless
bar
events
and
legal
conferences
on
technology,
innovation,
and
regulatory
reform
that
impacts
solos
and
smalls.
Elefant
also
develops
practical
tools
like
the AI
Teach-In to
help
small
firms
adopt
AI
and
she
consistently
champions
reforms
to
level
the
playing
field
for
independent
lawyers.
Alongside
this
work,
she
runs
the
Law
Offices
of
Carolyn
Elefant,
a
national
energy
and
regulatory
practice
that
handles
selective
complex,
high-stakes
matters.