On 20 October 2026, New York City proposed a rule that treats bot-only customer service as presumptively deceptive. You’d have to say up front that it’s a bot, offer a one-step route to a person, and log every bot conversation for three years. For anyone running live support software, the logging is the part to plan for now.
What the city proposed
The Department of Consumer and Worker Protection (DCWP) published the proposal under its Consumer Protection Law powers. It adds a new section 5-02 and a new Subchapter U to Chapter 5 of Title 6 of the Rules of the City of New York. We read the rule text itself, not the press coverage. It’s short, and it’s more specific than most headlines suggest.
Its definition of an automated customer service system is broad. It covers any technology where “all or substantially all” of the communication comes from the technology rather than a person. That takes in an LLM chat agent, a rules-based chatbot and a phone IVR alike. Customer service is defined just as widely: help with a product, account, refund, bill, complaint, cancellation, fraud claim or dispute.
The four obligations
Don’t promise a channel you don’t staff (5-311)
If you label an email address, phone number or chat as “customer service” or “contact us”, real customer service has to happen there. A bare address with no such label isn’t treated as a promise. Audit your footer and contact page with that in mind.
Say it’s a bot, at the start (5-312(a))
The disclosure must be clear and conspicuous, made at the beginning of the conversation, and in the language the conversation is happening in. A Spanish-language chat that opens with an English disclaimer wouldn’t meet it. If you already handle the EU AI Act’s disclosure duty, you’re most of the way there, but check the language point.
Give people a way to a human (5-312(b) and (c))
This is the heart of it. It’s a deceptive and unconscionable practice to promise customer service and then repeatedly and unreasonably send people to menus that don’t address their question, or answer with “unresponsive, irrelevant, or erroneous information”. That’s the doom loop, written into a rule.
Then comes the presumption. If you run a bot and don’t offer a human option, you’re presumed to be breaking that rule. You can rebut the presumption, but you start out losing. There are two ways to stay clear of it:
- A single-step transfer. One clearly named action at any point, such as “Say or type agent” or “Press 0”, that starts a transfer to or queues for a person. No extra questions, no reason demanded, no further menus, except a menu that only routes the customer to the right team. If there’s a queue, tell them the estimated wait.
- An alternative, when nobody’s free or the queue is unreasonably long. The rule lists seven options, and you need at least one: the hours when live transfer works, a phone number with hours, live chat with hours, a message with a promised reply timeframe, a contact form with a timeframe, a text number with a timeframe, or an email address with a timeframe.
Notice that every alternative comes with either hours or a timeframe. “Leave a message and we’ll get back to you” doesn’t qualify. “We’ll reply within one business day” does.
Keep the records (5-313)
Most teams will spend their real effort here. For at least three years, in a machine-readable format, you’d keep:
- the agreements, licences and setup documents for the bot, plus the dates each model was in use;
- a log of every bot conversation showing its duration, whether a one-step transfer was offered, whether the customer used it, and whether they were transferred, queued or given an alternative;
- yearly totals, covered below;
- the exact wording and format of the disclosure you showed;
- a record of the alternative routes to a person you offered.
The number that will sting
The yearly totals include total bot conversations, how many were resolved without a transfer, how many customers asked for a transfer, and the average length. One more item says a lot about what the city expects to find: how many bot conversations came from someone who’d already talked to the bot in the previous 72 hours.
That’s the doom loop, counted. A bot can report a high resolution rate because people give up and close the window. Then they come back the next day with the same problem. The 72-hour repeat count catches exactly that. It’s the same gap we wrote about in deflection versus resolution, and this would make it a figure you hand to a regulator.
“The AI did it” is no defense
The new section 5-02 applies across DCWP’s whole jurisdiction, not just chatbots. It isn’t a defense that you “directly or indirectly used or relied on a technology” that made the claim, left out the information, did the violating act or helped with it. It’s the same principle a German court applied this year when it held a clinic liable for what its website chatbot invented, which we covered in a German court says your support bot speaks for you.
Penalties and dates
The proposed schedule is $525 for a first violation, $1,050 for a second and $3,500 for a third or later, for each of the four rules. Each subdivision charged counts as a separate violation. The certification from the Mayor’s Office of Operations says there’s no cure period.
The public hearing is at 11:00 a.m. on 19 November 2026, by phone and video. There’s a discrepancy on comments. The printed notice says comments must arrive on or before 19 November, while the city’s rules portal lists 18 December. If you plan to comment, aim for the earlier date.
It’s a proposal, not law. Wording can change after comments, and nothing applies until DCWP adopts a final rule. It also covers merchants dealing with New York City consumers, not everyone, everywhere. But California’s AB 1609, signed on 28 September 2026, already bars larger businesses from passing a chatbot off as a human. Rules like this tend to travel.
What to check in your own setup
In ICTDesk, a visitor who types “talk to a human”, or reaches a point where the AI’s confidence is low, is transferred to the next available live agent. The agent sees the full conversation history, so the visitor doesn’t repeat themselves, and the full transcript is saved. When your team is offline, the AI keeps answering routine questions, and anything it can’t handle lands in your inbox for an agent to pick up later. Chat Reports split AI and agent performance. Our support center covers the setup.
Measured against the proposal, the gaps to close are mostly wording and records, not technology:
- Make the greeting say plainly that it’s an AI assistant, in each language you serve.
- Name the transfer phrase in the greeting itself, not only when the bot gets stuck. The rule wants it offered as a clear, named option.
- When nobody’s online, state a reply timeframe in the offline message and your live hours.
- Decide where the four per-conversation fields will come from, and export transcripts on a schedule that gives you three years of history.
- Start counting 72-hour repeat contacts now, so you see your own number before anyone else asks for it.
FAQ
Is the NYC chatbot rule in force?
No. DCWP proposed it on 20 October 2026. It holds a public hearing on 19 November, takes comments, and only then can adopt a final version, which may differ from the draft.
Does it apply to businesses outside New York City?
It applies to merchants under DCWP’s Consumer Protection Law jurisdiction, which turns on dealings with New York City consumers. If you sell to people in the city, assume it reaches you, and check with counsel for your situation.
Does a phone IVR count, or only chatbots?
Both. The definition covers any technology that handles all or substantially all of the communication, and the rule’s own examples of a single-step transfer include “Press 0”.
We only offer chat during business hours. Is that allowed?
Yes, if the bot tells people the hours when a person is available, or gives another route with a stated timeframe, such as a contact form with a promised reply time. A bot with no human option at any hour is what triggers the presumption.
Can the bot ask a question before transferring?
Only to route the customer to the right team. The definition of a single-step transfer bars extra automated steps, extra questions or asking the customer to justify the request, except for a menu that “serves solely to route” them.
What happens if we can’t produce the logs?
Failing to keep or produce the required records is a violation in its own right, on the same $525, $1,050 and $3,500 schedule as the other three rules.
Source: NYC Department of Consumer and Worker Protection, Notice of Public Hearing and Opportunity to Comment on Proposed Rules Regarding Automated Customer Service Systems, published 20 October 2026, and the NYC Rules portal listing for the same proposal.