Since the public release of ChatGPT in November 2022, solo and small law firms have been inundated with ethics opinions by the ABA and 20 different states regarding artificial intelligence use and client disclosure obligations. While these ethics considerations are important, the real disclosure requirements that firms need to worry about are emerging state laws that mandate specific AI disclosures and that carry concrete penalties for noncompliance.
State AI Disclosure Laws
Currently, three states—Utah, New Jersey, and Maine—have enacted legislation requiring disclosure when businesses, including law firms, use AI to interact with consumers. What makes these laws particularly significant for solo and small firms is their potential extraterritorial reach and the specific penalties attached to violations.
Utah’s Artificial Intelligence Policy Act (AIPA) was initially passed as SB149 in 2024. The 2025 amendments through SB226 modified the mandatory disclosures to apply only to “high-risk artificial intelligence interactions” which include “financial, legal, medical, or mental health advice or services.” This means that if a solo practitioner uses an AI chatbot or phone receptionist to handle initial client inquiries, schedule consultations, or provide preliminary legal information, they must clearly disclose the AI’s involvement.
New Jersey bot law makes it unlawful to use an online bot to communicate with another person in the state “with the intent to mislead the other person about the bot’s artificial identity” to incentivize commercial transactions which would encompass an engagement with an attorney. The penalties for violations are substantial: $2,500 for a first offense, $5,000 for a second offense, and $10,000 for each subsequent violation. Similarly, Maine’s AI law prohibits use of an AI bot to incentivize a transaction unless users are notified that they are not interacting with a human. Civil penalties of up to $1000 apply for each violation.
The Extraterritorial Challenge
Many solo and small firms may assume these laws don’t apply to them if they’re not physically located in Utah, New Jersey, or Maine. This assumption could prove costly. Modern digital marketing and client acquisition mean that law firms routinely interact with potential clients across state lines. A firm’s website, online advertising, or AI-powered intake systems can reach residents of any state, potentially triggering that state’s disclosure requirements.
Consider this practical scenario: A small immigration law firm in Texas uses an AI-powered chat system on its website to answer common questions about visa applications. If a potential client from Salt Lake City visits the website and interacts with the chatbot, the firm must comply with Utah’s disclosure requirements—even though the firm itself is based in Texas. The connection to Utah through the client’s location could trigger the law’s application.
The reality is that if a firm’s AI tool interacts with someone in a regulated state, the firm could face penalties regardless of its own location. This is particularly challenging for small firms that may use third-party AI services for client intake, document review, or legal research without fully understanding where their potential clients are located when initial contact occurs.
To navigate this regulatory landscape, solo and small firms should implement several protective measures. First, incorporate clear AI disclosure language at the beginning of any automated interaction, whether through chatbots, email automation, or phone systems. Second, don’t rely on vendor assurances for compliance; fact-check disclosures yourself. Third, maintain documentation (or insist that your vendor does) showing when and how AI disclosures were provided to protect against potential enforcement actions.
The focus on ethics rules, while important, has overshadowed the more immediate legal requirements imposed by state legislation. These laws don’t merely suggest best practices—they mandate specific disclosures with real penalties for noncompliance. As more states consider similar legislation, the patchwork of requirements will only become more complex.
Solo and small firms must recognize that AI regulation extends far beyond bar association guidance. State consumer protection laws, disclosure requirements, and emerging AI-specific legislation create a multi-layered compliance obligation that requires immediate attention. The firms that thrive in this new environment will be those that proactively address both the ethical and legal dimensions of AI use, ensuring they meet not just professional standards but also the growing body of state regulatory requirements.
Carolyn Elefant is one of the country’s most recognized advocates for solo and small firm lawyers. She founded MyShingle.com in 2002, the longest-running blog for solo practitioners, where she has published thousands of articles, resources, and guides on starting, running, and growing independent law practices. She is the author of Solo by Choice, widely regarded as the definitive handbook for launching and sustaining a law practice, and has spoken at countless bar events and legal conferences on technology, innovation, and regulatory reform that impacts solos and smalls. Elefant also develops practical tools like the AI Teach-In to help small firms adopt AI and she consistently champions reforms to level the playing field for independent lawyers. Alongside this work, she runs the Law Offices of Carolyn Elefant, a national energy and regulatory practice that handles selective complex, high-stakes matters.