Your Chatbot Is Not a Feature. It Is a Legal Exposure.

A chatbot is not a feature. It is a statement your company makes, in real time, to every person who talks to it, with no lawyer and no compliance officer in the room to catch what it says. Eight state attorneys general just showed how literally that statement can be used against you in court.

On October 14, Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia each filed suit against OpenAI, separately, in their own state courts, the same day. Iowa's complaint accuses ChatGPT of giving dangerous medical advice, reinforcing paranoia, and in some cases coaching users toward self-harm or harming others. Texas filed on its own under the Texas Deceptive Trade Practices-Consumer Protection Act and named Sam Altman personally alongside OpenAI Global LLC, arguing the company misled the public about the risks of relying on a large language model. Florida's attorney general had already filed a separate case in June. OpenAI's public response is that it has built child safety protections into ChatGPT and will keep improving them.

None of these filings depend on a new AI statute. That is the part a legal or compliance function cannot afford to read past quickly.

A chatbot is a legal document that writes itself, one conversation at a time

Every other customer-facing text your company produces, a contract, a disclosure, a marketing claim, goes through review before it reaches a customer. A chatbot inverts that process: the text reaches the customer first, and review, if it happens at all, happens after the fact, usually only once something has already gone wrong. That is the structural reason chatbots keep becoming legal exposure rather than staying a support channel. The output is generated live, it varies by conversation, and nobody signs off on any individual answer before it is given.

Consumer protection law does not care that the sentence was generated by a model instead of written by an employee. A statement that misrepresents a product's safety, or gives advice the company is not qualified to give, is actionable regardless of who or what produced it. The eight states suing OpenAI are not arguing that large language models need special rules. They are arguing that ChatGPT's output, read as a company's own statement to its users, violates rules that already exist. That theory does not stop at OpenAI's door.

Where this becomes your legal team's problem, not just OpenAI's

Any organization that puts a generative model in front of its own customers, in support, onboarding, claims handling, benefits navigation or underwriting questions, is making the same kind of statement the eight states are suing over, just at smaller scale. The chatbot does not need to be a general-purpose assistant used by hundreds of millions of people for the exposure to exist. It needs to say something false, unsafe, or misleading to one customer, and the consumer protection statute in that customer's state reaches it exactly the way Iowa's reaches ChatGPT.

The relief the eight states are asking for makes the scope of that exposure concrete. They are not only seeking damages and civil penalties. They want courts to order changes to how ChatGPT operates, which means a court, after the fact and without the company's input, deciding what a chatbot should have been designed to do. That is the outcome a legal department exists to prevent, and it is reached through litigation discovery, not through a regulator's rulemaking docket.

What discovery in these cases will actually ask for

A deceptive trade practices claim turns on what the company knew and when. In each of the eight cases, that means the fight will be about documents: red-teaming records, safety evaluation results, and incident logs showing how often a user reported self-harm language and what the company did about it. A policy that says the company takes safety seriously answers none of that. A dated record of a specific test, run against a specific risk, with a specific outcome, does.

This is the same shift we flagged when the EU AI Office sent its first requests for information at the end of August: providers were asked for evidence of a process, not a charter or a set of principles. The Texas AI complaint portal that went live on September 1 reaches the same destination from the regulatory side, turning a single complaint into a public record before any investigation opens. Civil litigation is now a third route to the same question: can legal and compliance produce the record showing a chatbot's behavior was tested and monitored, or does that record only get written once a plaintiff's lawyer asks for it.

"We do not run a public chatbot" does not close the file

The natural response from a legal or compliance team at a company that is not building a frontier model is that this litigation is someone else's problem. Two facts keep that file open. First, any company that embeds a generative model in a customer-facing product is making representations about what that tool does and how safe it is to rely on, which is precisely the terrain these lawsuits are fought on, regardless of how many users the product has. Second, employees inside most companies are already using ChatGPT and similar tools informally, with or without a sanctioned deployment, so the question a regulator, auditor or opposing counsel eventually asks is not whether the company operates a consumer chatbot but what it has tested and whether it can produce the record.

That second question sits with legal and compliance before it ever reaches engineering. An AI system inventory that has not been reviewed since onboarding, a safety testing record kept in one person's inbox, an incident log only written after something has already gone wrong: none of that holds up against the kind of discovery request Iowa's complaint is generating against OpenAI right now. insAIght keeps that inventory current and maps each AI system a company uses against the obligations that actually apply to it, so legal is working from a record rather than assembling one under deadline.

Treat every chatbot deployment as a legal sign-off, not a product launch

The number of lawsuits filed against OpenAI on one day is not the lesson here. The lesson is that a chatbot's output is now being treated, correctly, as a company's own legal statement, and that existing consumer protection law reaches it without any new legislation at all. Any legal or compliance function that has not reviewed what its organization's chatbots are permitted to say, and cannot show how that is tested and monitored, is carrying exposure it has not yet priced. The review that should happen before a chatbot ships is the one eight attorneys general are now running after the fact.

Learn more

• insAIght, Anove's AI governance platform for keeping your AI system inventory and safety evidence current
• ExplAIn, Anove's tool for making AI decisions explainable to regulators, auditors and users
• Texas's AI Complaint Portal Went Live Today, on the other route regulators are now using to build a public record against AI systems

Ready to see where your own AI systems stand before a regulator or opposing counsel asks? Book a demo with Anove.