Using ChatGPT at Work? Here's What You Need to Disclose in 2026

The New Reality of AI in Business

In 2024, AI tools were a competitive advantage. In 2026, they are table stakes. Over 75% of small businesses now use at least one AI-powered tool in their daily operations. ChatGPT, GitHub Copilot, Midjourney, Jasper, Grammarly, and dozens of other tools have become as routine as email.

But while adoption has exploded, most businesses have not caught up on the compliance side. New state laws in Colorado, California, Illinois, Texas, and other states now require businesses to disclose their use of AI tools in specific ways. The requirements vary by state, by industry, and by how you use the tools.

This article walks through the most commonly used AI tools and explains what disclosure requirements apply to each.

Which AI Tools Trigger Disclosure Requirements?

Not every AI tool triggers the same level of compliance obligation. The key factor is not which tool you use, but how you use it and who is affected.

Tier 1: Direct Consumer or Employee Impact

These uses create the strongest disclosure obligations:

• AI-powered hiring tools (screening resumes, scoring candidates, analyzing video interviews)
• AI-driven customer decisions (loan approvals, insurance pricing, tenant screening)
• Chatbots and virtual assistants that interact directly with customers
• AI-generated content presented to customers as human-created work
• Automated performance evaluation tools for employees

If you use AI in any of these ways, you need to disclose it in most states with AI legislation. Period.

Tier 2: Client-Facing Professional Services

These uses create moderate disclosure obligations:

• Using ChatGPT or similar tools to draft client deliverables (reports, analysis, content)
• Using AI to analyze client data or generate insights
• Using AI-powered project management or scheduling tools that affect client work
• Using AI for quality assurance or review of client-facing work

For these uses, client disclosure is increasingly expected and in some states required. Even where it is not legally mandated, many clients contractually require it.

Tier 3: Internal Operations

These uses create lighter but still relevant obligations:

• Using AI for internal research and knowledge management
• Using Copilot or similar tools for software development
• Using AI for internal communications drafting
• Using AI-powered analytics on internal business data

Internal uses generally have fewer disclosure requirements aimed at consumers, but you should still document them in your internal AI use policy. Some states require employee notification even for internal AI uses, especially if those uses affect employment decisions.

Tool-by-Tool Breakdown

ChatGPT and Large Language Models

ChatGPT (and similar tools like Claude, Gemini, and Llama-based models) is the most widely used AI tool in business. Its disclosure requirements depend entirely on context:

If you use ChatGPT to generate customer-facing content — such as marketing copy, blog posts, product descriptions, or email campaigns — several states require disclosure that the content was AI-generated or AI-assisted. California's SB-942 is particularly focused on this area.

If you use ChatGPT to draft client deliverables — such as reports, proposals, or analysis — you should disclose this to clients. Our client AI disclosure letter guide provides templates for different industries. Even in states without explicit requirements, professional ethics standards in many industries (legal, accounting, consulting) increasingly require transparency about AI assistance.

If you use ChatGPT to respond to customer inquiries — such as drafting email responses or powering a chatbot — most state AI laws require you to disclose that AI is involved in the interaction. Consumers have a right to know they are not communicating with a human.

If you use ChatGPT for internal purposes only — such as brainstorming, drafting internal memos, or research — the disclosure requirements are minimal, but you should have an internal policy governing acceptable use.

Midjourney and AI Image Generation

AI image generators like Midjourney, DALL-E, and Stable Diffusion raise specific disclosure concerns (see our detailed guide on AI-generated images disclosure):

Marketing and advertising — If you use AI-generated images in your marketing materials, some states require disclosure. Even where not legally required, industry standards increasingly call for transparency. The FTC has also signaled concern about AI-generated content in advertising.

Client work — If you are a design firm, marketing agency, or similar business using AI image generation in client deliverables, you should disclose this to clients. Some clients explicitly prohibit AI-generated imagery in their contracts.

Product images — Using AI to generate or enhance product photos without disclosure could run afoul of consumer protection laws if the images create misleading impressions.

GitHub Copilot and AI Coding Tools

AI coding assistants like GitHub Copilot, Cursor, and Amazon CodeWhisperer are widely used by development teams. The disclosure requirements are relatively light:

Client software development — If you build software for clients, many enterprise contracts now include clauses about AI tool usage. You should be prepared to disclose which AI tools are used in development and how they are supervised.

Internal development — For internal tools, the disclosure requirements are minimal, but your internal AI policy should address acceptable use, code review practices, and intellectual property considerations.

CRM and Marketing Automation AI

Tools like Salesforce Einstein, HubSpot AI, and Marketo's AI features often operate behind the scenes. These tools can trigger disclosure requirements even though you did not explicitly choose to use AI:

Lead scoring and segmentation — If AI determines which customers receive which marketing messages, some states consider this automated profiling, which may trigger disclosure and opt-out requirements under consumer privacy laws.

Predictive analytics — AI-powered predictions about customer behavior, churn risk, or lifetime value are generally internal analyses with lighter disclosure requirements. But if those predictions directly affect pricing, offers, or service levels, disclosure may be required.

Automated email and messaging — If AI determines the timing, content, or targeting of customer communications, disclosure is increasingly expected.

AI-Powered HR Tools

HR technology is one of the most heavily regulated areas for AI:

Resume screening — Tools that use AI to screen, rank, or filter job applicants trigger disclosure requirements in New York City, Illinois, Maryland, and Colorado. You must notify applicants before AI is used in the hiring process.

Video interview analysis — Illinois specifically requires consent before using AI to analyze video interviews. The consent must be specific to the AI analysis, not buried in general terms and conditions.

Performance monitoring — AI-powered employee monitoring and performance evaluation tools require disclosure to employees in multiple jurisdictions. This includes tools that track productivity, analyze communication patterns, or score employee performance.

Scheduling and workforce management — AI-optimized scheduling systems that affect employee work hours should be disclosed, especially in states with predictive scheduling laws.

What Your Disclosure Documents Should Look Like

Different audiences require different types of disclosure:

For Customers: AI Disclosure Policy

Your public AI disclosure policy should be posted on your website and should cover:

• Which AI tools and systems your business uses
• How those tools affect customer interactions and decisions
• What data is processed by AI systems
• How customers can ask questions or request human review
• How to contact your business about AI-related concerns

This document should be written in plain English, not legal jargon. The goal is genuine transparency, not compliance theater.

For Clients: Client AI Notice

If you provide professional services, your client AI notice should:

• Identify which AI tools are used in delivering client work
• Explain how AI-assisted work is reviewed by humans before delivery
• Address data handling and confidentiality
• Acknowledge the client's right to request non-AI alternatives where feasible

For Employees: Internal AI Use Policy

Your internal policy should cover:

• Which AI tools are approved for use
• Which categories of work can and cannot involve AI
• Data handling requirements (what information can be entered into AI tools)
• Quality assurance and review requirements for AI-assisted output
• Reporting obligations when AI produces unexpected or concerning results

For Job Candidates: Employee AI Notification

If you use AI in hiring, you need a specific notification that:

• Informs candidates before AI is used in the process
• Describes what the AI evaluates and how
• Explains how candidates can request human review
• Provides contact information for questions

The Compliance Gap

Most businesses are in one of two positions right now:

Position 1: You use AI tools but have no formal disclosure documents. This is the most common situation, and it is a compliance risk that grows every month as more states pass AI legislation.

Position 2: You have generic or outdated templates that do not reflect your actual AI usage, your industry, or the specific laws of the states where your customers are located.

Both positions leave your business exposed. The fix is not complicated, but it does require creating documents that are specific to your situation.

Getting Compliant Without Spending Thousands

Hiring a compliance attorney to create custom AI disclosure documents typically costs between $1,000 and $5,000. For a large enterprise, that is routine. For a small business, it is a significant expense that often gets deferred.

Attestly exists to close this gap. Our questionnaire asks six questions about your business — your industry, your size, the states where you operate, the AI tools you use, and how you use them. Based on your answers, we generate five customized compliance documents that address the specific requirements of your states and your industry.

The AI Disclosure Policy and Client AI Notice are free. The full set of five documents, including the Internal AI Use Policy, Employee AI Notification, and Data Processing Addendum, is available with Attestly Pro.

Every document is generated with state-specific compliance language, proper legal formatting, and references to the actual laws that apply to your situation. You can download them immediately and start using them the same day.

Frequently Asked Questions