WestchesterAI

Which AI Laws Apply to a Westchester Small Business?

Most AI headlines are about the companies that build AI. These are the rules that reach the businesses that use it: what's in effect, what only applies in some cases, and what you can stop worrying about.

By Alex Colombo, WestchesterAI. Checked against official sources on October 21, 2026.

This is a plain-English summary, not legal advice. For a specific situation, ask a lawyer.

Why we wrote this.

If you're thinking about using AI in your business, you've probably wondered whether you're allowed to. Most of what's written about AI law is aimed at tech companies or big employers. This guide sticks to the rules that reach a contractor, a realtor, a dental office, a restaurant, or an insurance agency, with a link to the official source for each one.

The short version.

  • Don't use AI to write reviews.

    Fake reviews are banned nationwide, and the FTC says AI-written ones count.

  • Get consent before an AI voice calls customers.

    Written consent for marketing calls, and the call has to say who it is from.

  • Label AI-generated people in your ads.

    New in New York since June 9, 2026.

  • Keep sensitive customer and patient details out of consumer AI apps.

    Use business accounts with data protection terms, and a business associate agreement for anything with patient information.

  • Tell staff if AI records or reads their calls or email.

    New York requires written notice at hiring.

Rules that reach most small businesses.

All six are in effect now. None has a small-business exemption, though the SHIELD Act scales its expectations to your size.

Fake reviews, including AI-written ones

In effect since October 21, 2024

Every business, of any size, nationwide.

The FTC's rule on consumer reviews bans writing, buying, or posting reviews or testimonials from people who don't exist or never used your business. When it issued the rule, the FTC said AI-generated reviews are covered. It also bans paying for reviews that must be positive or negative, hiding negative ones, and buying fake followers or views.

Penalty: Up to $53,088 per violation for knowing violations. The FTC kept that amount for 2026.

What to do: Never post, buy, or have staff write AI-generated reviews. Ask real customers for honest reviews, with no reward tied to a good one.

AI voices that call your customers

In effect since February 2024

Any business that uses an AI or cloned voice to call or leave voicemails for customers.

The FCC ruled that AI-generated voices count as "artificial" voices under the federal robocall law (the TCPA). A call that uses one needs the person's prior consent unless it is an emergency or exempt call, and a marketing call needs prior written consent. The message has to say who is calling at the start. The ruling is about calls you make; it does not address an AI receptionist answering calls that come in.

Penalty: People can sue for $500 per violation, and a court can triple that for willful or knowing violations.

What to do: Before an AI voice calls customers for reminders, follow-ups, or offers, make sure you have their consent (written consent for marketing) and that the call names your business first.

AI-generated people in your ads

In effect since June 9, 2026

Any New York business that makes a visual or video ad. There is no small-business exemption.

New York General Business Law § 396-b requires a conspicuous disclosure when an ad includes a "synthetic performer": an AI-made person who is not a real, identifiable individual, when you actually know it's in the ad. Audio-only ads are exempt, and so is using AI only to translate a real performer. Newspapers, stations, and billboard companies that just run the ad are exempt too. Using an AI likeness of a real person is a different issue that falls under New York's right-of-publicity law instead.

Penalty: $1,000 for a first violation and $5,000 for each one after.

What to do: If a social post, website banner, flyer, or video ad shows an AI-generated person, say so clearly in the ad itself. We haven't found official guidance on the format yet, so make it easy to see.

Customer information you put into AI tools

In effect since March 21, 2020

Any business holding computerized private information about New York residents.

New York's SHIELD Act requires reasonable safeguards for private information such as Social Security numbers, driver's license and account numbers, medical and health insurance information, and logins. The law's list of reasonable safeguards includes choosing service providers that can protect the data and requiring that by contract. A small business (under 50 employees, under $3 million in revenue in each of the last three years, or under $5 million in assets) meets the standard with safeguards that fit its size and its data. The law doesn't mention AI, but we treat an AI tool you paste customer data into as a service provider.

Penalty: Up to $5,000 per violation, enforced by the Attorney General.

What to do: Keep Social Security numbers, account and card numbers, health details, and passwords out of consumer AI chat apps. Use business plans whose terms say your data is protected and not used for training.

Patient information in AI tools (health offices)

In effect (long-standing HIPAA rules)

Medical, dental, therapy, and other offices covered by HIPAA.

HIPAA lets a practice share patient information with a vendor that handles it on the practice's behalf only under a written business associate agreement. We treat an AI scribe, AI phone answering that takes patient details, or an AI chat tool that receives patient information as that kind of vendor. HHS has also proposed rules saying patient data in AI systems is protected; those are not final yet.

What to do: Don't put patient information into any AI tool unless the vendor signs a business associate agreement.

AI that records or reads staff calls and email

In effect since May 7, 2022

Any New York employer, of any size.

New York Civil Rights Law § 52-c requires written notice, at hiring, to every employee whose phone calls, email, or internet use is monitored, plus a posted notice. The law doesn't mention AI, but we treat AI call recording, call transcription, or email review of staff communications as monitoring. Automated filtering that only manages email or traffic volume, or protects the system, and isn't aimed at a person is excluded.

Penalty: Up to $500 for a first violation, $1,000 for a second, and $3,000 for each one after.

What to do: If any tool records or reads staff calls, email, or web use, give each employee the written notice, get it acknowledged, and post it.

Rules that apply only in some cases.

In effect, but they only reach you if you price, hire, brand, or publish in a particular way.

Prices set using a shopper’s personal data

In effect since November 10, 2025 (on appeal)

Businesses whose software sets an individual shopper’s price using their personal data. Insurers and certain financial institutions are exempt.

New York General Business Law § 349-a requires the label "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA" next to the price. Ordinary sales, time-of-day pricing, or inventory-based pricing that doesn't use a specific shopper's data isn't covered. Retailers challenged the law; a federal judge dismissed their challenge, and an appeal was argued in October 2026. We found no appeals ruling as of the date above.

Penalty: Up to $1,000 per violation, after a warning from the Attorney General.

What to do: If a pricing or coupon app personalizes prices per shopper, show the label or turn that feature off.

AI hiring tools for New York City jobs

In effect since July 5, 2023 (enforcement)

Only jobs tied to a New York City office, or hiring through a New York City employment agency. A Westchester job with no NYC office, filled without an NYC agency, is not covered.

New York City's Local Law 144 requires an independent bias audit, a published audit summary, and 10 business days' notice to candidates who live in New York City before using software that substantially assists or replaces hiring decisions, such as tools that score or rank applicants.

Penalty: Between $500 and $1,500 per day, according to the State Comptroller.

What to do: If you hire for an NYC-based role with software that scores or ranks applicants, get the audit and give the notice. Otherwise this does not apply.

Realistic fakes of real people

Westchester County law in effect since February 2025

Everyone in the county. This is a criminal law, not a marketing rule.

Westchester's law on digitally deceptive material makes it a misdemeanor to share realistic AI-made intimate images of an identifiable person to harass them, or to commit criminal impersonation using a deepfake. It doesn't regulate normal marketing. Separately, New York requires consent from heirs or executors to use a deceased performer's likeness or voice commercially, including AI replicas.

What to do: Never use AI to make a realistic fake of a real person, such as a competitor, former employee, or customer.

Headline laws that don't apply to you.

You may have read about these. They regulate AI companies or insurers, not a small business using AI tools.

  • The RAISE Act (opens in a new tab)

    New York's AI safety law starts January 1, 2027, and covers only companies that train the very largest AI models, with the heaviest duties on those with over $500 million in revenue. Using ChatGPT, Claude, or Copilot doesn't make you one.

  • The AI companion law (opens in a new tab)

    New York's rules for AI "companion" apps took effect November 5, 2025, but they exclude systems a business uses only for customer service, for efficiency, or internally. A chatbot used only for customer service on your website isn't covered.

  • The insurance AI circular letter (opens in a new tab)

    The Department of Financial Services' 2024 guidance on AI in underwriting and pricing is addressed to insurers, not to independent agents and brokers. Carriers may pass some requirements to agents by contract.

Not law yet: the watch list.

As of October 21, 2026, these bills had not been signed or sent to the Governor. The Governor usually acts on bills like these by the end of the year, so we'll update this page if any of them become law.

How we set up AI with these rules in mind.

None of this means avoiding AI. It means a few habits from the start.

AI setup and adviceSee our prices

  • Business accounts, in your name.

    With terms that protect your data, instead of personal or free consumer accounts.

  • Sensitive details stay out.

    Customer account numbers, health information, and passwords never go into a chat tool.

  • A person signs off.

    Anything that goes to a customer, including AI-drafted messages and ad images, is reviewed by someone on your team.

  • Consent before AI calls anyone.

    And the call names your business at the start.

  • Staff know what is monitored.

    If a tool records or transcribes calls, the written notice is in place first.

Want AI set up the careful way?

A 15-minute call. Tell us what you want AI to help with, and we'll tell you what's worth doing and what to watch out for.

Book a 15-minute call(914) 361-9414
Next availableWestchester County, NY
  • 15 MINIntro callFree. Pick a time that suits you online.
  • CALLCall or text Alex(914) 361-9414
  • 1 DAYWritten replyWe aim to answer messages within one business day.