The bill H.784 establishes comprehensive regulations for chatbot providers in Vermont, focusing on user privacy, data security, and transparency. It introduces a new chapter in the Vermont Statutes Annotated (9 V.S.A. chapter 118) dedicated to artificial intelligence, specifically addressing chatbots. Key provisions require chatbot providers to obtain affirmative consent from users before processing personal data, disclose that users are interacting with a chatbot, and provide access to chat logs. The bill prohibits the sale of these logs and mandates their retention for no longer than ten years unless legally required. Additionally, it defines terms such as "affirmative consent," "chat log," and "dark pattern" to ensure clarity in the regulations.

The legislation also emphasizes the importance of a robust data security program, requiring chatbot providers to conduct monthly risk assessments to identify potential harms to users. It clarifies the liability of chatbot providers for any injuries caused by their chatbots, regardless of care exercised in their design. The Attorney General is empowered to adopt rules for required disclosures and can take civil action against non-compliant providers. Users who suffer injuries due to violations can pursue legal action with specified damages and relief options. The act is set to take effect on July 1, 2026.