AI Disclosure for Hotel Guests: The Rules and What Works

Yes, tell them. In the European Union it becomes a legal requirement for AI systems that interact with people from 2 August 2026, unless it is obvious. In California it is the safe harbor against a bot-deception claim. In Utah you must answer honestly when asked and may disclose up front for protection. And the consumer evidence says disclosure plus a clear way to reach a person makes guests more willing to use AI, not less. Any platform worth its place in our guide to the best hotel AI concierge platforms should make up-front disclosure the default; the rest of this post is about why, where and in what words.

One line before the law: this is general information, not legal advice. Rules change, several of these laws have changed in the last year, and you should confirm with counsel for the jurisdictions where your guests are. What follows is the plain summary I wanted and could not find when I started reading these statutes, with the text quoted from the official source wherever I could.

Do hotels have to tell guests they are talking to AI?

It depends on where the guest is and what the chat does, but the simple policy, always disclose, satisfies every rule I found. The honest reason to adopt it is not that every jurisdiction requires it. It is that tracking which guest is covered by which law, on a chat that serves travelers from forty countries, is a job nobody at a resort wants.

AI disclosure rules relevant to guest-facing hotel chat, as of early 2026. General information, not legal advice; confirm current text with counsel.

What does the EU AI Act require for chatbots?

Article 50(1) of Regulation (EU) 2024/1689 requires providers to ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use ^[1]. Article 50(5) requires that the information be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure ^[1]. The transparency obligations apply from 2 August 2026 ^[1].

Two things a hotel should take from the text. First, the exception is narrow and uncomfortable to rely on. "Obvious to a reasonably observant person" is exactly the kind of judgment a regulator and a guest might make differently, and a well-written AI concierge is designed not to be obvious. Second, the timing standard is the first interaction, which rules out disclosure buried in a terms page or a footer. The first message is the place.

Guidance is still arriving. The Future of Life Institute's 2026 explainer notes that the Commission published draft guidelines on Article 50 for consultation with a final version expected before August 2026, alongside a Code of Practice on marking and labelling with a final version expected by June 2026 ^[2]. If your property or your guests are in the EU, someone should read those when they land.

What does California's bot disclosure law cover?

California's rule is narrower than the EU's and older. Business and Professions Code section 17941, enacted as SB 1001 in 2018 and effective July 1, 2019, makes it unlawful for any person to use a bot to communicate or interact with another person in California online with the intent to mislead the other person about its artificial identity for the purpose of knowingly deceiving them in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election [3] ^[4].

Read the scope carefully. The law targets intent to mislead for commercial gain. A hotel does not intend to mislead anyone. But a guest concierge that offers room upgrades, late checkout and spa bookings is plainly incentivizing purchases, so it sits inside the commercial half of the statute. If a guest later argued they were misled into a purchase by what they believed was a person, the hotel's defense is the law's own safe harbor: a person using a bot is not liable if they disclose that it is a bot, with a disclosure that is clear, conspicuous and reasonably designed to inform the person they are communicating with a bot ^[3].

That standard, clear and conspicuous and reasonably designed, is a useful test for your own wording. A grey one-line footer is not it. A first message that says what the assistant is, in the language the guest is reading, is.

Which other US states have AI disclosure rules?

Utah and Colorado, with more on the way, which is why a jurisdiction register belongs in your governance file. Utah's Artificial Intelligence Policy Act (SB 149) took effect May 1, 2024 and required disclosure when a consumer asked. Amendments in SB 226 and SB 332, effective May 7, 2025, narrowed the trigger to a clear and unambiguous request, limited proactive disclosure to high-risk interactions involving sensitive personal information and personalized advice on major decisions, added a safe harbor for disclosing at the start and throughout the interaction, set fines of USD 2,500 per violation, and extended the law's repeal date to July 2027 ^[5]. In plain terms: answer honestly when asked, and disclose up front if you want the protection.

Colorado's Artificial Intelligence Act (SB 24-205) was delayed by SB 25B-004, signed August 28, 2025, which moved its effective date from February 1, 2026 to June 30, 2026, with further changes anticipated ^[6]. I am not going to tell you what its consumer disclosure provision requires of a hotel chat, because the alert I relied on does not cover that provision and the statute text should be read directly. Put Colorado on the register with the June date and have counsel confirm.

Other states are drafting. The practical response is not to track them one by one. It is to adopt the policy that would satisfy the strictest of them, up-front disclosure at first interaction with a persistent label, and to review the register twice a year.

Does disclosure also cover automated decisions?

No, that is a separate question, and the two get confused. Telling a guest they are talking to AI is about the conversation. GDPR Articles 13 and 22 are about decisions. Article 13(2)(f) requires informing the data subject of the existence of automated decision-making, including profiling, and meaningful information about the logic involved, and Article 22 gives a person the right not to be subject to a decision based solely on automated processing which produces legal effects concerning them or similarly significantly affects them ^[7].

A concierge answering "what time is breakfast" is not making a legally significant decision. A concierge that decides which guests are eligible for an upgrade offer, or declines a request based on a profile, is closer to the line than most operators realize. The safe practice is to keep a person on any decision with consequences for the guest (eligibility, pricing exceptions, refusals, billing disputes) and to describe the automated parts honestly in your privacy notice. How that gets written down, section by section, is the subject of a plain English guest data and AI policy template, which I would read alongside this post.

Do guests mind talking to AI if they are told?

They mind not being told, and they mind having no way to reach a person. Those are the two findings every survey I have seen agrees on, and both are vendor surveys from general customer service rather than hotels, so weigh them as such.

In Talkdesk's 2025 research among 1,000 US consumers and 300 retailers, 84% of consumers wanted to know when they were interacting with AI during the customer journey ^[8]. In Five9's June 2026 study of 3,000 consumers, 80% said they would use AI customer service when a path to a live representative was available; 55% trusted AI when a clear human option existed against about 25% without one; and 41% said they were less likely to use a company that uses AI for service, rising to 53% when there was no human option ^[9]. The wider backdrop from Pew Research Center's 2023 survey of 5,101 US adults: among people who had heard of AI, 70% had little or no trust in companies to use it responsibly ^[10].

Read those together and the operational conclusion is not subtle. Disclosure is not the risk. Disclosure without a visible human path is. A guest who is told "this is an AI assistant, and a person is one tap away" has been given both the honesty and the exit, and the second half is what moves trust from a quarter to half.

How should a hotel word the disclosure?

Plainly, three times, in three patterns: a first-message line, a persistent label, and an honest answer whenever a guest asks. Say the human path in the same breath each time. The property approves the words; what follows are starting points.

Disclosure patterns for hotel guest chat with sample wording. Practice table, 2026; the property approves the final words and counsel confirms they meet local rules.

Two drafting notes. Avoid cute names that hide what the thing is; a label a guest cannot decode is not a disclosure. And write the on-request answer so the AI never hedges: a guest who asks "is this a real person" and gets "I am here to help!" has been dodged, and will remember it.

When must a person take over?

On request, on negative sentiment, and on any topic the property lists in advance: safety, medical, billing disputes, complaints, anything involving a child's welfare, anything that sounds like a legal threat. The handoff should say, in the chat, that a named person is now reading. Silence after an escalation is worse than no escalation, because the guest does not know whether anyone heard.

The list of topics is a governance decision made before launch, not a judgment the AI improvises. What an AI concierge should refuse, and why guests thank you for the refusals, is covered in what an AI concierge should refuse to answer, and I would set the handoff triggers and the refusal list in the same meeting.

Some properties want to go further at the start and have a person review every AI reply before it sends. That is a sensible way to build confidence in week one. On the ResortConcierge AI platform a supervised mode of that kind is planned, not shipped, and starting with a human watching every reply explains how to run that period with the escalation tools that exist today.

Where ResortConcierge helps

The general practice is disclosure at first interaction, a label on every reply, and a handoff that names a person. ResortConcierge carries a property-set disclosure line in the first message of web chat opened by QR or stay link, with a persistent assistant label, so the first-interaction standard is met by default and the wording is the property's to approve; how ResortConcierge handles disclosure and guest trust is published for anyone who wants the detail.

The human path is handing the conversation to a named person when a guest asks for one or when sentiment or topic rules fire, with the handoff announced in the chat.

The on-request answer comes from the knowledge base, where the property writes its own "am I talking to a person?" entry so the concierge answers that question the same way every time, in all 11 languages. One honest limit: none of this makes a property compliant on its own. The defaults are designed to meet the first-interaction standard; the wording, the jurisdiction register and the legal review are the property's.

Write the first-message line this week and read it aloud to someone at the desk. If it sounds like something a person would say to a guest, and it names the way to reach a human, you are most of the way there. Then hand the jurisdiction table to counsel and ask them to confirm it for the places your guests come from.