Since the debut of ChatGPT in November 2022, solo and small law firms have faced a deluge of ethics opinions from the ABA and 20 different states concerning the use of artificial intelligence and the requisite disclosures to clients. Yet, it's the emerging state laws that solo and small firms should be particularly vigilant about, as these laws not only require specific AI disclosures but also impose heavy penalties for non-compliance.

Currently, three states—Utah, New Jersey, and Maine—have passed legislation mandating that businesses, including law firms, disclose when they use AI to interact with consumers. The significance of these laws for solo and small law firms lies in their potential extraterritorial effect and the specific penalties for infringements.

Utah’s Artificial Intelligence Policy Act (AIPA), which evolved through amendments in 2025, now necessitates disclosures only for "high-risk artificial intelligence interactions" such as financial, legal, medical, or mental health advice. This means a solo practitioner employing an AI chatbot for initial client interactions must disclose the AI’s involvement explicitly.

In New Jersey, the use of online bots to communicate for commercial transactions under a guise is illegal, carrying fines of up to $10,000 for repeat offenses. Similarly, Maine's AI law prohibits using an AI bot to facilitate a transaction unless users are explicitly informed they are not interacting with a human, with penalties up to $1000 per violation.

Many solo and small firms might think these laws do not apply if they are not based in these states. However, this assumption could be financially damaging. Digital marketing and online client engagement mean that firms often interact with potential clients across state lines. For instance, a Texas-based immigration law firm using an AI chat system might need to comply with Utah’s laws if the system interacts with a potential client from Utah.

The reality is stark: if a firm’s AI tool engages with someone in a regulated state, the firm could face penalties irrespective of its physical location. This is especially challenging for small firms that may utilize third-party AI services for client intake or legal research without fully understanding the implications of where their clients are located during these interactions.

To navigate this complex regulatory landscape, firms should take proactive steps. These include implementing clear AI disclosure language at the onset of any automated interaction, verifying compliance measures themselves rather than relying on vendor promises, and maintaining thorough documentation of when and how AI disclosures are made.

Looking ahead, the focus on ethics rules, while critical, might distract from the immediate legal requirements enforced by state legislation. These laws don't just recommend best practices; they enforce disclosures with significant penalties for non-compliance. As more states contemplate similar legislation, the patchwork of requirements will only grow more complex, necessitating vigilant attention and proactive compliance from law firms. Solo and small practices must recognize that AI regulation extends well beyond bar association guidelines to include a broader scope of state consumer protection laws and AI-specific legislation, creating a layered obligation that demands immediate attention.

The firms that anticipate and adapt to both the ethical and legal dimensions of AI use will be the ones that not only survive but thrive in this evolving legal landscape.