The Talking-Founder Kiosk, the Seasonal-Hiring Screener and August 2: A US Museum's Real AI Act Exposure

"We are a 34-person county history museum in Ohio with a $2.8 million budget. Europe's AI rules are not our problem."

That is the reaction, and for most of what the museum does it is correct. But run the inventory and two of the four places AI already touches that museum sit inside obligations carrying an August 2, 2026 date, and a third sits inside a state law effective January 1. None of it is fatal. All of it is paperwork you either have or do not have when somebody asks.

"This can't apply to us" — the two things that make it apply

The EU AI Act's high-risk and transparency obligations carry a compliance date of August 2, 2026, and the Act reaches outside Europe: it applies to systems whose output affects people in the EU, not only to companies established there. Two doors are open.

The first is your website. You sell timed tickets to tourists, and a real share of summer visitors book from Germany, France and the Netherlands before boarding a plane. If a chat assistant answers them, its output affects people in the EU. The second is hiring: you recruit seasonal gallery attendants, camp instructors and admissions cashiers every spring, and at a destination museum that pool includes international students and working-holiday applicants. If a screening tool ranks or filters those applications, you are in the part of the rules taken most seriously.

Worth stating cleanly: the compliance question is never "do we use AI" — it is "which specific system, doing which specific job, and does that job appear on somebody's high-risk list." Most of what a museum does is not on any list. Two things usually are.

Inventory first: the four places this already lives in your building

Before anyone reads a statute, the executive director should ask the four people who would know. The list is short and consistent.

• The website chat and phone assistant. Answers hours, parking, ticket availability and accessibility questions, and books visits. Owned by marketing or visitor experience.
• The seasonal hiring screener. Whatever sits inside your applicant tracking system, plus whatever the HR manager uses to summarize resumes. This is the one people forget to declare, because it feels like a convenience rather than a system.
• Anything generative in the galleries. The synthesized voice of a historical figure in the immersive room, the reconstructed portrait, the "ask the founder a question" kiosk your interpretive planner was so proud of.
• Anything that looks at faces. Camera analytics that flag loitering near a case, headcount cameras at the gallery entrance, and any evaluation tool claiming to read engagement or emotion from expressions.

flowchart TD
  A["List every AI system touching a visitor, applicant or staff member"] --> B{"Does it screen or rank job applicants?"}
  B -->|Yes| C["High-risk: keep records, notify applicants, human reviews every decision"]
  B -->|No| D{"Does it talk to visitors or generate exhibit content?"}
  D -->|Yes| E["Disclose it is AI; label synthesized voices, images and reconstructions"]
  D -->|No| F{"Does it identify faces or infer emotion?"}
  F -->|Yes| G["Stop. Call counsel before it runs another day"]
  F -->|No| H["Record it in the register; light obligations, annual review"]

What August 2 actually asks of each one

The hiring screener is the heavy one. Employment screening sits in the high-risk category. For a museum with one HR manager that means: record which tool you use and what it does, tell applicants an automated tool is part of the process, keep its logs, make sure a named person reviews every rejection instead of rubber-stamping a ranked list, and produce that paperwork on request. Hiring 60 seasonal staff, it is about a day of setup and an hour a month.

The gallery kiosk is the interesting one. Transparency rules require that people be told when they are interacting with an AI system and that synthetic content be labeled; a kiosk answering in a synthesized founder's voice is both at once. That is not a burden. A panel reading "This voice was generated by a computer from the founder's written letters; he never said these words aloud" is better interpretation than hiding it. Let the curator write it, not the lawyer.

The website assistant needs one sentence. Tell visitors in the widget itself that they are talking to an automated assistant. Most vendors ship this; check yours is switched on and says so on screen, not in a linked privacy policy nobody opens.

The face-reading systems are the ones to stop on. Emotion detection and biometric identification carry the harshest treatment, and a museum running school programs has an extra problem, because reading emotion in an education setting is treated far more severely than a retailer counting shoppers. If a vendor pitched you a product that reads facial expressions in the galleries, have that conversation with counsel before the next school group.

The state laws that already took effect on January 1

Federal preemption of state rules is unsettled as of this July, so state law binds you now. Texas TRAIGA took effect January 1, 2026, with a wrinkle museums should notice: it reaches government agencies directly, and a great many US museums are city departments, county departments or units of a state university. If your museum is legally part of the city, you are a government body under that statute, not a private nonprofit, and the biometric provisions bind you more tightly than the art museum down the street with its own 501(c)(3).

Illinois has an older law on AI in video interviews plus employment provisions from the start of 2026 — relevant if you record seasonal-hire interviews. New York City requires an annual bias audit and applicant notice for automated employment tools used for jobs in the city. Colorado's AI Act arrived this summer; Utah requires disclosure of AI in consumer interactions; Nevada and Maine have their own. One site means one state's rules plus the city's; historic properties across a state line mean two.

What is genuinely out of scope, so you can stop worrying about it

California SB 53 took effect January 1, 2026 and does not apply to you. It governs developers of frontier models at a scale no museum approaches. If a consultant says you need an SB 53 compliance program, that is a sales pitch.

Nothing here obligates you to catalog differently, disclose that a grant application was drafted with help, or label a text panel a curator wrote with an assistant and then approved. Labeling attaches to synthetic audio, video and images presented as depictions — the reconstructed voice, the generated photograph — not to a curator who used a writing tool.

Membership renewal scoring, the donor propensity model in Raiser's Edge NXT, store recommendations and gallery captioning are not high-risk. One adjacent deadline is real, though: the Justice Department's web accessibility rule for state and local government entities, first compliance date April 2026. If your museum is a city or county department, your website and online collection are covered. That one is not AI, it is WCAG, and it needs its own budget line.

The file the board will ask for, and what it costs to build

All of this produces one deliverable: a register, one page per system. Name, what it does, who owns it, the vendor, whether a person reviews its output, what visitors or applicants are told, date last reviewed. Seven fields; a shared document is fine.

What you are insuring against is not primarily a fine. It is pulling a $180,000 immersive gallery offline six weeks into a sixteen-week run because nobody wrote a label, and explaining that to the funder whose name is on the wall.

Where counsel has to be in the room

Do not self-assess the face-reading question. Whether a headcount camera counts as biometric identification turns on details of the vendor's product you cannot judge from a brochure, and getting it wrong falls in the most serious category. Lawyer conversation, vendor questionnaire — not a staff call.

Do not assume vendor compliance covers you. Ticketing platforms and applicant tracking systems will say they are compliant; that is about their product. How you use it, what you tell people and who reviews the output stay yours. And if your museum is a municipal or university unit, bring in the city or university attorney early — their answer may differ from the nonprofit across town, and you do not get to pick the more convenient one.

Start Monday with four emails — marketing, HR, the interpretive planner, whoever manages the cameras — asking one question: what tool are you using that makes a decision or writes something for us. Fifteen minutes of reading, and that is the register's whole foundation.

Frequently asked questions

We are a private nonprofit with no European visitors we know of. Are we really in scope?

Check the data first: pull last summer's ticket sales by billing country. A handful of orders means small exposure — disclose on the chat widget and move on. Hundreds means take it seriously. Either way, the hiring and state-law questions apply whether or not a single European visits.

Does an audio guide that answers visitor questions need a disclosure?

If it responds conversationally, yes — say so at the start. If it plays fixed tracks recorded by your interpretive team, no. The line is whether a visitor could think a person is answering.

Who should own this at a museum with 34 staff?

The deputy director or director of operations — not IT, not the curator. It is a governance file touching HR, marketing and exhibitions, and it needs someone who can demand answers from all three. Report it to the board's governance committee once a year, alongside the insurance review.

A practical note on where most museums first meet these obligations. The chat assistant on your website and the automated attendant on your main line are usually the earliest AI systems a museum has, and the easiest to bring into line: disclose clearly, answer only from your own approved information, log what was said. CallSphere builds AI voice and chat agents for exactly that surface — answering the phone and website chat around the clock, booking visits and capturing inquiries — with the disclosure and transcript record the register asks you to keep.