Press 0 for a Human: What NYC's Proposed Chatbot Rule Says, and What It Asks of AI Agents in Lending and Collections

Status as of Thursday, Oct 22, 2026, morning CT: Proposed, not final. DCWP published the proposal in the City Record on Oct 20. Comments are due by Nov 19, 2026, the same day as a public hearing at 11:00 a.m. Eastern. The rule page lists its status as "Proposed." We'll update this line when that changes.

The short version. New York City's Department of Consumer and Worker Protection (DCWP) has proposed rules for "automated customer service systems," which its press release says "often appear as AI customer service chatbots but can also include voice response systems on the telephone." As proposed, a merchant using one would have to disclose "at the beginning of a covered interaction" that the consumer is talking to an automated system. Using automation without offering a way to reach a human would create "a rebuttable presumption" of "a deceptive and unconscionable trade practice." Merchants would keep three years of records, including a log of every automated interaction. A separate new section says it is "not a defense" that a person "used or relied on a technology" that committed or assisted a violation.

Who this is for

Owners and operators at lenders (including banks and credit unions), servicers, third-party agencies and debt buyers, and in-house collections teams at tech companies that use chatbots, AI voice agents, or phone menus to talk with New York City consumers. It matters most to teams where the same automated system answers billing questions, takes payments, and handles disputes.

On scope, the sources speak for themselves:

• DCWP is proposing the rules under the city's Consumer Protection Law. Its core section says: "No person shall engage in any deceptive or unconscionable trade practice in the sale, lease, rental or loan or in the offering for sale, lease, rental, or loan of any consumer goods or services, or in the collection of consumer debts." (NYC Admin. Code 20-700)

• The same law defines "merchant" as "A seller, lessor, or creditor or any other person who makes available either directly or indirectly, goods, services or credit, to consumers," and consumer goods, services, credit, and debts as those "primarily for personal, household or family purposes." (20-701(c) and (e))

• The proposal defines "customer service" as "assistance by a merchant to a consumer, in response to an inquiry from such consumer, regarding a product, service, account, refund, billing matter, complaint, cancellation request, fraud claim, or dispute in relation to the sale or purchase of a good or service." (proposed 6 RCNY 5-310)

How those definitions map to a given lending, servicing, or collection program is the kind of question teams often review with their compliance team or counsel.

Everyone who has said "representative" into a phone four times in a row already has an opinion about this rule. Most of the comments on the city's rules site so far are some version of that.

For operators, the more interesting parts are quieter. The definition of customer service names "account," "billing matter," "fraud claim," and "dispute," which is a pretty good description of what a servicing or collections inbox handles all day. The recordkeeping section asks for numbers most shops have never pulled, like how many automated conversations involved someone who had already been in one in the past 72 hours. And the technology section is four lines long and says "directly or indirectly."

What happened

On Oct 1, 2026, DCWP, the NYC Commission on Human Rights, and the Taxi and Limousine Commission issued a joint enforcement policy statement on AI. It says: "An entity cannot avoid responsibility for violations of law because of reliance on an algorithm, AI, or other technology." It also says the Consumer Protection Law "applies to claims about the capabilities, performance, accuracy, outcomes, or uses of AI systems; representations made by chatbots and other agentic systems; and the design, marketing, sale, or deployment of AI-enabled products and services." (DCWP release, Oct 1)

On Oct 20, DCWP published the proposed automated customer service rules in the City Record. Its release is titled "Mamdani Administration Proposes Ban on AI Customer Service Doom Loops." It says that, upon adoption, "New York would become the first municipality in the nation with the ability to enforce this type of consumer protection." (DCWP release, Oct 20)

The release quotes Mayor Zohran Mamdani: "Whether you're trying to resolve a problem with your bank, get a refund or return a package, you deserve access to real help." Commissioner Samuel A.A. Levine said bad customer service can be "all the difference between refilling a critical prescription, rehabilitating a student loan, or recovering a large refund," and added: "We are not waiting for Washington to come to the rescue of working people."

The notice says the rule "was not included in the Department of Consumer and Worker Protection's regulatory agenda for this Fiscal Year because it was not contemplated when the Department published the agenda." It also includes the Mayor's Office of Operations certification that the proposal "does not provide a cure period because a cure period is not practicable under the circumstances."

What the proposal says, in its own words

All quotes in this section are from DCWP's Notice of Public Hearing and Opportunity to Comment. Section numbers are the proposed sections of Title 6 of the Rules of the City of New York. The notice says "'Shall' and 'must' denote mandatory requirements."

Why DCWP says it's proposing this (Statement of Basis and Purpose)

DCWP writes that "automated customer service systems have a high propensity to fail to address the consumer's issue, inquiry, or desired outcome," so the rules "establish a rebuttable presumption that the use of such automated technology alone in providing customer service is a deceptive and unconscionable trade practice," and "this presumption would apply unless the merchant offers consumers an option to interact with a human representative." In DCWP's words, the presumption "would protect consumers while still allowing the use of new technologies."

The notice cites outside research, including a 2023 Gartner survey it describes this way: "chatbots' ability to resolve customer service issues range from a low of 17% regarding billing disputes to a high of 58% for returns or cancellations." It also cites the CFPB's 2023 report "Chatbots in consumer finance."

On disclosure, DCWP says "Similar measures have been adopted in California, Maine, New Jersey, and Utah," citing Cal. Bus. and Prof. Code 17941, Me. Rev. Stat. tit. 10, 1500-DD, N.J. Stat. 56:18-2, and Utah Code 13-77-103.

Technology is not a defense (Section 5-02)

"It is not a defense for any violation of the requirements of this Title of the Rules of the City of New York and of any local law or statute within the jurisdiction of the department that a person directly or indirectly used or relied on a technology that: (1) Made claims, representations, or offers; (2) Omitted statements or information; (3) Undertook the violative act; or (4) Assisted in the furtherance of the violation."

A footnote adds: "Using a specific technology has never provided a safe harbor under the Consumer Protection Law or any other law within the jurisdiction of the Department. This proposed rule makes this principle explicit."

This section sits in Chapter 5 generally, not only in the new customer service subchapter.

Definitions (Section 5-310)

• "Automated customer service system" means "any technology used to provide consumers with customer service where all or substantially all the communication to the consumer is made by such technology rather than by a natural person."

• "Covered interaction" means "any interaction between a consumer and an automated customer service system."

• "Single-step transfer mechanism" means "a clearly identified, accessible option consisting of a single step - including but not limited to a button, voice command, or menu selection - that, when activated by the consumer at any point during a covered interaction: (1) Initiates transfer to, or queuing for, a human representative; and (2) Does not require the consumer to complete additional automated steps, answer additional questions, provide justification for the transfer request, or navigate additional menus or processes prior to transfer, unless such menu or process serves solely to route consumers to the appropriate human representative." (The original uses dashes around "including but not limited to"; we've rendered them as hyphens.)

Saying customer service is available (Section 5-311)

"It is a deceptive trade practice for a merchant to represent that customer service is available through a communication channel, such as via telephone or email, if the merchant does not provide customer service via that communication channel." Listing contact information alone isn't a representation, the section says, "unless it is accompanied by language indicating that customer service as defined in 6 RCNY 5-310 is available," such as "customer service," "contact us," or similar language.

Disclosure, doom loops, and the human option (Section 5-312)

• Disclosure, 5-312(a). "It is a deceptive trade practice for a merchant to use an automated customer service system to engage in a covered interaction unless such merchant clearly and conspicuously discloses that the consumer is interacting with an automated customer service system and not a human representative. Such disclosure must be made at the beginning of a covered interaction and in the language being used for the interaction."

• Failed promise of customer service, 5-312(b). A merchant fails to provide customer service "in a reasonable and timely manner" if, during a covered interaction, it "repeatedly and unreasonably: (1) Directs a consumer to menus that fail to adequately address such consumer's inquiries; or (2) Responds to consumer inquiries with unresponsive, irrelevant, or erroneous information."

• Access to a human, 5-312(c). The rebuttable presumption applies if a merchant uses an automated system and "fails to provide a consumer engaged in such covered interaction with the option to interact with a human representative" in one of two ways. The first is a single-step transfer, "specifying the particular single-step transfer mechanism necessary to complete such transfer (e.g., 'Say or type 'agent'' or 'Press 0'), and the estimated wait time if the consumer is placed in a queue." The second applies "If a human representative is not available at the time of the covered interaction, or if the queue for such human representative is unreasonably long." Then the merchant provides instructions for an alternative, and the section lists seven: the hours a human is available through the transfer mechanism; a phone number with hours; live chat with hours; a message through the system requesting an email, text, or callback "and the timeframe within which the merchant will respond"; a contact form with a response timeframe; a text number with a response timeframe; or an email address with a response timeframe.

Records (Section 5-313)

Merchants using an automated system "must create and retain records demonstrating compliance with the requirements of this subchapter for a period of at least three years." The list "include[s] but [is] not limited to":

• Documents about the system, "including those that detail the specific models of automated customer service systems," such as agreements, contracts, or licenses, development and installation documents, and "the time period during which each model of customer service system was utilized."

• "Logs of all covered interactions" showing each interaction's total duration, whether a single-step transfer was offered, whether the consumer activated it, and whether the consumer "was transferred to a human representative, placed in a queue, or provided with an alternative means."

• Annual aggregate data on total covered interactions, those resolved without the transfer mechanism, "the number of covered interactions involving a consumer who had engaged in previous covered interactions in the preceding 72 hours," transfers activated, interactions "resolved without any consumer-initiated transfers," and average duration.

• "Records of all disclosures provided to consumers at the outset of covered interactions, including the specific language and format used," and records of alternative means offered.

Records "must be maintained in a machine-readable format and produced upon request by the department."

Penalties (Section 6-91)

The proposed schedule lists $525 for a first violation, $1,050 for a second, and $3,500 for a third and subsequent violation of 5-311(a), 5-312(a), 5-312(b), and 5-313. It notes that under Admin. Code 20-703(d), a knowing violation "is subject to a penalty of $3,500," and that "Each subdivision, paragraph, subparagraph, clause, item, or other provision charged in the Notice of Violation shall constitute a separate violation." DCWP's release adds that "Violators would be liable for restitution to harmed consumers and civil penalties."

The proposal at a glance

A one-screen summary for your team. Every cell is the proposal's own language or a close paraphrase. None of it says how the rule applies to you.

How it sits next to other rules and reports

These are other sources on nearby topics, quoted for context. We're not saying how they interact.

DCWP's own SHIELD Rule

The same agency's amended debt collection rules take effect Jan 1, 2027 (DCWP New Laws and Rules). DCWP's SHIELD Rule FAQ (dated Aug 4, 2026) says the rule "limits communications with NYC consumers to three communications per distinct consumer account within a seven-day period across all media - excluding mailed letters - with some exceptions," and lists "responses to consumer inquiries or outreach from the consumer to the debt collector" among the exclusions. The FAQ also says: "These rules do not apply to day-to-day business transactions, billing, or customer service on accounts that are not subject to debt collection procedures." So one agency now has, or has proposed, a rule about outbound collection contact and a rule about inbound customer service. Where a single conversation falls under each is a question for compliance.

The CFPB's 2023 chatbot report

DCWP cites it. "Chatbots in consumer finance" (June 6, 2023), still posted on the CFPB's site when we checked Oct 22, describes "doom loops" as "continuous loops of repetitive, unhelpful jargon or legalese without an offramp to a human customer service representative." One complaint it quotes is about a debt collection notice: "I could not get a human on the phone. There are endless telephone prompts asking me for personal information, account information. I don't have an account, so nothing will populate on their end." The report's footnote says it "is not intended to impose any obligations or define any rights and is not intended as a CFPB interpretation of any regulation or statute." (CFPB)

California AB 1609

Gov. Gavin Newsom signed AB 1609 (Zbur), "Customer service chatbots," on Sept 28, 2026. His office describes it as "requiring large businesses to make a good-faith effort to connect a customer to a human within 15 minutes after a request for human customer service is made, or schedule an appointment," and requiring large companies "to disclose when connecting with customer service if the representative is a chatbot and not a human." (Governor's release) Fox Rothschild's Odia Kagan writes that the California law "applies only to private businesses with more than $500 million in annual gross revenue." The NYC proposal, as published, lists no size threshold.

The UK FCA, for contrast

On Oct 19 the FCA published "AI in financial services: good practice and areas for improvement." It's UK guidance for FCA-regulated firms and says the examples "do not create new requirements." Among the problems it says it saw: "Creating inflexible automated journeys. Some automated interfaces made it harder for consumers to get support. Problems included unclear responses, not addressing the consumer's issue and not allowing them to move to another channel." (FCA)

What others have said

These are their readings, attributed and linked. We're reporting them, not adopting them.

ACA International, the ARM trade association, wrote on Oct 21: "While aimed at broad commercial practices, receivables management companies that use automated assistants for account inquiries, fraud alerts, and basic navigation should pay close attention to the DCWP proposal." (ACA International)

Odia Kagan of Fox Rothschild, writing Oct 21, called the disclosure piece "similar to bot-disclosure requirements adopted in California, Maine, New Jersey and Utah," then added: "But the NYC proposal goes further." (Fox Rothschild)

AccountsRecovery.net reported Oct 21 that, in an op-ed, Levine wrote he hopes the rule "will offer a template for other municipalities and for states to follow." (AccountsRecovery.net)

DCWP's release also quotes two outside voices. Stephanie T. Nguyen, a former FTC Chief Technologist now at Columbia Law School's Center for Law and the Economy, said the rules "make corporations liable for AI when it breaks the law." Adam Teitelbaum of Protect Borrowers, formerly of the D.C. Attorney General's office, said: "Bad customer service can violate consumer protection law, no matter the technology used to deliver it."

The public comments on the rules site were mostly supportive as of the morning of Oct 22, with one notable dissent. That commenter wrote that an AI bot at AppleCare "provided better and faster service than I have received from many customer service calls," and opposed the rule. None of the posted comments came from a trade group or a company as of that morning.

Questions for your team

None of these need a lawyer to ask. Some end up with one. Teams often start with the ops lead and bring the answers to compliance or counsel.

Which of our systems would count as "automated" under the proposed definition?

The phone menu that takes payments. The chat widget on the servicing portal. The AI voice agent that handles inbound callbacks. The text bot that answers "what's my balance." Who keeps that list, and does it include vendor-run channels?

Which conversations start as an "inquiry from such consumer"?

The definition of customer service is written around a consumer's inquiry. What about an outbound collection call where the borrower asks a billing question halfway through? How does compliance want those conversations classified?

What does our first sentence say today?

For each automated channel and each language it runs in, what exactly does the consumer hear or read at the start, and is that text stored somewhere we can pull?

How many steps does it take to reach a person right now?

Counted honestly, from a cold start, in every channel. And what happens after hours?

What does the estimated wait time come from?

If the system announces one, where does the number come from, and how close is it to reality at 5:45 p.m. on the first of the month?

Can we produce the logs the proposal lists?

Duration, whether a transfer was offered, whether it was used, and what happened next, per interaction. Plus the annual counts, including repeat contacts within 72 hours. Which of those fields exist in our systems or our vendor's today, and who owns them?

What do our vendor contracts say about records?

Section 5-313 lists agreements and "documents related to the development of and/or installation of" the system, and the time period each model was used. Who holds those documents, and for how long?

Who's tracking the comment period?

The notice says comments are accepted through Nov 19 through the city's rules site or by email to Rulecomments@dcwp.nyc.gov, and hearing speakers get up to three minutes. Some teams and trade groups comment on proposals like this one; others wait for the final text. Who on the team decides which?

Questions for AI agents and automation

This part is about systems, not law. These are design questions we think about as operators, and they come up whether or not a rule ever requires them.

Is the disclosure a setting or a script?

If the opening line lives inside every prompt or flow, changing it means editing every flow. If it's one configured message per channel and language, it's one change. Which is it, and is the version that played logged with the interaction?

What does "Press 0" connect to?

A transfer is only as good as the queue on the other end. Does the AI agent's handoff land in the same queue the human team works, with the conversation history attached, or does the borrower start over? And when a borrower says "agent" in the middle of a payment flow, does the system finish the payment first, or stop?

What happens when there's nobody there?

At 11 p.m. on a Sunday, which of the seven listed alternatives does the system offer, and does it state the hours or the response timeframe the proposal mentions? Is the callback request a real ticket with an owner?

How does the system know it's looping?

Repeated intents, the same answer twice, rising frustration. Does anything detect it and offer the human option again, or does that depend on the consumer finding it?

Who checks the answers?

Section 5-312(b) mentions "erroneous information." Which answers come from approved source material, and which are generated? When the agent gives a payoff figure or a due date, where does the number come from, and is the source logged? (See our Human-in-the-Loop entry for how human review is usually set up.)

Can the logs answer the 72-hour question?

Counting repeat covered interactions within 72 hours means tying conversations to a consumer across channels and sessions. That's an identity and data-model question before it's a reporting one.

Which model was running when?

Section 5-313 asks for "the time period during which each model of customer service system was utilized." Does the platform version-stamp the model and prompt set on every interaction, so that question has an answer later?

Tuesday's Pennsylvania post made a similar point from another angle: the rule lives wherever the config lives, and that's often inside a vendor. See No Sundays, Nothing After 7.