AI Frontier Institute

An act relating to the regulation of chatbots

View primary source →

Vermont H.784 has not been enacted. It was introduced and referred to the Committee on Commerce and Economic Development on 2026-01-27, and its outcome is listed as committee. If enacted, it would add 9 V.S.A. chapter 118, Subchapter 1 (Chatbots), to regulate chatbot providers, meaning any person who creates, distributes, or makes available a chatbot. Data privacy and security (§ 4193b): Providers could not process personal data beyond input data to inform outputs unless it is necessary for an express user request and the user gives affirmative consent. They could not use chat logs to target or customize advertisements, and could not sell chat logs. They could not process chat logs or personal data of users they know or should know are under 18 without parent or guardian consent, and could not use such users' data for training. For adults, training would require affirmative consent. Providers could not profile users beyond what an express request requires, retain chat logs more than 10 years unless required, retaliate against users who refuse training consent, or tell users their input or chat logs are confidential. Users could access their chat logs in a downloadable, human- and machine-readable format. Public agencies would need a wiretap warrant under 13 V.S.A. chapter 232 to compel production of input data or chat logs. Providers would have to keep a written, publicly posted data security program. Transparency (§ 4193c): Chatbots could not imply their outputs come from or are endorsed by licensed professionals, including health care, legal, accounting, financial, or other Office of Professional Regulation professionals. Providers would have to give clear notice that the user is talking to a chatbot, not a human, before the first output, hourly after that, and whenever the user asks if it is a real person. Providers would have to assess risks of harm monthly and mitigate them, and publish information about their chatbots monthly. Rulemaking (§ 4193d): The Attorney General would adopt rules on the disclosures, risk metrics, and the information to be published. Liability (§ 4193e): A chatbot would be a product for product liability purposes. Providers would owe a duty to ensure their chatbot does not injure users and would be liable for injuries even if they used all reasonable care or did not distribute the chatbot directly to the user. Enforcement (§ 4193f): The Attorney General or a State's Attorney could sue for injunctions, compliance, damages, penalties, restitution, and fees. Violations of § 4193b or § 4193c(a) or (b) would be an injury in fact. Injured users could sue in Superior Court for liquidated damages of $5,000 per violation of § 4193b (or actual damages if greater), and $5,000 in total for violations of § 4193c(a) or (b) (or actual damages if greater). They could also seek punitive damages for reckless and knowing violations, injunctive and declaratory relief, and fees. Sec. 2 would make the act take effect July 1, 2026.

← Back to the tracker