Operations / AI Business Legal Stack

AI Business Legal Launch Checklist

Verify your AI product is legally launch-ready before acquiring your first customer. Audit quarterly as regulations evolve.

Section 1: Core Document Stack

Terms of Service

ToS published at a public URL (e.g., /terms)

ToS linked in website footer

ToS linked at sign-up (clickwrap or checkbox)

AI output disclaimer included (outputs may be inaccurate; user responsible for review)

Acceptable use restrictions included

Training data clause included (whether user inputs used for model improvement + opt-out)

Automated decision-making disclosure (if AI influences decisions about users)

Limitation of liability clause

Governing law and dispute resolution

Privacy Policy

Linked in footer and at every data-collection point

Covers: what data collected, why, how long retained

Identifies all third-party data processors

User rights: access, deletion, portability, correction

Cookie and tracking disclosure

AI inference section (how inputs interact with model processing)

CCPA rights addressed if any California users expected

Acceptable Use Policy

AUP published (standalone or section of ToS)

Prohibited uses explicitly listed

Consequences for violations stated

Right to terminate reserved

Data Processing Addendum

DPA template customized (Bonterms is free and widely accepted)

Sub-processor list completed

Data retention and deletion timelines specified

Breach notification timeline specified (GDPR: 72 hours)

DPA available on request or published at /dpa

Section 2: AI Disclosure Requirements

Universal Disclosure

Every AI voice interaction begins with AI disclosure

Every AI chat widget displays AI disclosure at first message

Disclosure framed around capability, not just existence

EU AI Act Article 50 (effective August 2, 2026)

Product audited: is it accessible from EU countries?

If yes: AI disclosure added to ALL interactions

Disclosure triggers at start of interaction, not mid-conversation

State-Specific Disclosure

Texas SB 140: AI disclosure within 30 seconds of call start for Texas numbers

CA, NJ bot disclosure laws: compliance confirmed for chatbot features

Colorado (June 30, 2026): high-risk AI decisions reviewed if applicable

Section 3: SMS / Telephony Compliance

TCPA Consent

Explicit written consent collected before any automated SMS

Consent checkbox present at sign-up where phone number collected

Consent record stored with timestamp and IP

Opt-out mechanism (reply STOP) functional and tested

Consent language is specific (includes "automated text messages" and "msg & data rates")

10DLC Registration

Business 10DLC brand registration submitted

Campaign registered (transactional vs. marketing)

Registration confirmed and approved

Fallback plan if registration pending

Recording Consent

Two-party consent disclosure for recorded calls (CA, CT, DE, FL, IL, MD, MA, MT, NV, NH, PA, WA)

One-party consent states: disclosure still recommended

Section 4: Voice AI Specific

Does your product process voice data that creates a voiceprint?

If yes + Illinois users: written consent collected before voice processing (BIPA)

Biometric data retention/destruction policy published (max 3 years)

FCC: AI voice disclosure present on outbound AI-initiated calls

Section 5: Quarterly Review Trigger

Run this checklist again when any of these occur:

New state AI law takes effect

You add a new data processor or AI model provider

You add a new channel (SMS, voice, WhatsApp, email)

You enter the EU market or receive first EU user

You receive a legal inquiry, complaint, or security incident

90+ days since last review