What must Pennsylvania callers change now?
Recheck the dialling calendar and the scope of registration before the next campaign. Act 47, enacted on 20 July 2026, changes the Telemarketer Registration Act, broadens relevant definitions and addresses calls and messages involving residential, wireless and business subscribers. Its operative text prohibits covered solicitations on Sundays and outside 9am–7pm; it also addresses misleading caller identification and attempts to bypass screening. (legis.state.pa.us)
An official 19 October 2026 announcement confirms that the new protections have taken effect. This is a present control issue, not a 2027 planning item. (pasenategop.com)
Recommended actions:
- Configure jurisdiction-specific scheduling rather than changing the global setting for every customer.
- Include callbacks and retries in the scheduling test.
- Have counsel review statutory definitions and exemptions before classifying a workflow as out of scope.
- Obtain written confirmation of which party handles registration and caller-ID configuration.
Does Texas require every private AI receptionist to announce itself?
TRAIGA’s cited disclosure provisions are more specific than that. Effective 1 January 2026, the law requires disclosure for relevant governmental AI interactions and for AI used in relation to healthcare services or treatment. The healthcare provider must make the specified disclosure by the first provision of the service or treatment, with an emergency exception. (texasattorneygeneral.gov)
For a Texas dental scheduling project, our recommendation is to include a clear AI introduction and ask counsel to approve how it satisfies the applicable healthcare provision. Do not leave disclosure entirely to an unscripted answer if the patient happens to ask.
What does Utah require?
Utah’s current code requires a supplier using generative AI in a consumer transaction to disclose that fact when the individual clearly asks whether the interaction is with AI or a human. For regulated occupations, high-risk AI interactions trigger prominent disclosure; verbal interactions require the disclosure at the start. The code also rejects AI use as a defence to specified consumer-protection violations. (le.utah.gov)
Recommended tests: ask “Are you a person?”, “Is this automated?” and “Are you a licensed professional?” The agent should identify its role accurately, follow the approved disclosure policy and avoid presenting itself as the professional whose work it supports.
What replaced Colorado’s original AI Act?
SB26-189 replaced the earlier framework with requirements focused on automated decision-making technology that materially influences consequential decisions. Covered subject areas include access to or eligibility for healthcare, insurance, financial services, housing, education and employment. The enacted summary describes developer documentation, consumer notices, adverse-outcome explanations, meaningful human review and at least three years of compliance records. (leg.colorado.gov)
The Attorney General identifies 1 January 2027 as the implementation date. Its rulemaking page also records an October 2026 interim draft, so buyers should not freeze their legal requirements around an earlier proposal. (coag.gov)
Desk interpretation: a voice interface is not automatically a consequential-decision system. The important question is whether the workflow merely executes a customer’s request or materially influences access, eligibility or another covered outcome. That distinction follows from the enacted scope, but the conclusion for a specific deployment requires legal review. (leg.colorado.gov)
For example, our recommended review should distinguish:
- Offering an available appointment under approved scheduling rules.
- Ranking patients for scarce access using inferred urgency or other personal data.
- Collecting insurance information.
- Deciding that a person is ineligible for a service or financial product.
Do not allow a supplier to expand from the first type of task into the latter types without a new approval.
Does Colorado’s chatbot law capture ordinary customer service?
Not necessarily: the enacted definition contains substantial exclusions. The separate conversational-AI law, approved on 29 May 2026, excludes specified commerce and transactional assistance, including customer support, and includes exclusions relevant to business operations and HIPAA-covered contexts. These exclusions are visible in the signed act—not merely in commentary. (leg.colorado.gov)
Our recommendation is a short applicability memorandum that records the product’s actual purpose, audience and functions. An exclusion from this chatbot law should not be represented as an exemption from the separate ADMT, calling, privacy or healthcare assessment.
What should California buyers prepare for by January 2027?
California approved new privacy regulations on 23 September 2025, with an effective date of 1 January 2026. Covered risk-assessment compliance began in 2026; the ADMT requirements have a separate 1 January 2027 compliance date. Initial cybersecurity-audit certifications are phased later, beginning in April 2028 for the highest revenue band. (cppa.ca.gov)
Recommended procurement work:
- Determine whether the buyer is covered by the CCPA and whether the proposed use falls within the relevant ADMT scope.
- Identify whether the agent contributes to a significant decision, rather than assuming all voice automation is equivalent.
- Request enough supplier documentation to support the buyer’s risk assessment and consumer-rights processes.
- Separate ordinary reception from eligibility, pricing, employment or access decisions.
- Avoid treating the later audit-certification dates as permission to postpone every privacy control.
This is not a complete review of California’s calling, recording, biometric or AI-specific statutes. Those require a jurisdiction-specific release check.