Cleo AI paid $17 million to settle allegations it *deceived millions* of customers

What Cleo is accused of

Cleo AI is a personal finance app with an AI chatbot. The US Consumer Financial Protection Bureau alleges that Cleo falsely told customers it would help them improve their credit scores, when it did not report payment information to credit bureaus and had no way of doing so ^[1]. The CFPB also says Cleo sent illegal debt collection messages, including threats to take money from customers' bank accounts without proper legal authority ^[1].

The company has agreed to pay $17 million and will be subject to compliance obligations for ten years, including regular reporting to the Bureau ^[1]. Cleo neither admitted nor denied the findings.

The evidence question

When a customer disputes what a chatbot said, the customer's screenshot is often the only record. It's like a receipt from a shop: the customer keeps it, and if they later claim the shop promised something it didn't, the shop has to show what was actually on the till slip. If the shop has no record, the receipt wins.

In this case, millions of customers interacted with Cleo's chatbot. Some of them kept screenshots. Those screenshots became evidence of what the chatbot promised. The company appears to have had no independent, unchangeable record of the same conversations to put alongside them.

That imbalance matters, because it leaves one side holding the only proof of what was said.

What Article 50 requires

Since 2 August 2026, people in the EU must as a rule be told when they are interacting with an AI system, unless it is obvious from the context ^[2]. The notice must be clear, distinguishable and timely.

The rule applies to anyone who puts an AI system on the market or into service in the EU. It does not require a particular form of notice, and it says nothing about keeping a record of what the AI said. That is a separate question, and one worth answering early.

What this means for you

If you run a chatbot that talks to customers, ask yourself:

• Do we tell people they are talking to an AI, in a way that meets Article 50?
• Could we show what our chatbot said on a given day, if a customer turned up with a screenshot?
• Who keeps the record: us, the customer or nobody?
• If a regulator asked to see the conversation logs from six months ago, could we prove they have not been edited since?

The answers matter, because the side without its own unchanged record starts on the back foot when something is questioned.

How a witness would work here

Here, the thing to seal is each answer the chatbot sends, or each conversation when it closes. The record includes the customer's question, the chatbot's answer, the time it was sent and the notice that the customer was talking to an AI.

Sealing takes a fingerprint of the record, not the record itself, so the conversation never leaves your systems. The fingerprint is sent to WitniumChain, which returns a witness ID. If the conversation is questioned later, you share the record and the witness ID with whoever needs to see it: your compliance team, the customer or a regulator. They calculate the fingerprint again and check it against the sealed one. If it matches, the record has not changed since it was sealed. Change a single character and it will not match.

Anyone you share the record with can check it, without having to trust you. That is what makes it evidence rather than just a log.

What it does not do: it does not show that the answer was correct, fair or legally binding. It only shows that this is what the chatbot said at that time, unchanged.

How it would work

1. Customer asks a question; chatbot sends an answer.
2. Your system seals a fingerprint of the exchange (question, answer, time, AI notice) through the REST API, SDK or MCP server.
3. If questioned, you share the record and the witness ID. Anyone can check that it has not changed.

You can start with the REST API, the SDK or the MCP server. The content stays with you. The first 2,000 witnesses a month are free.

What to watch

Article 50 of the AI Act has applied since 2 August 2026 ^[2]. If your chatbot operates in the EU and it is not obvious from the context that people are talking to an AI, you must tell them.

The CFPB's allegations against Cleo relate to US consumer finance law, not the AI Act, but the evidence question is the same: when a customer says the chatbot promised something, who has the unchanged record of what it actually said?

Sources

1. "Cleo AI paid $17M to settle allegations it deceived customers", Compliance Week, 8 January 2025, https://www.complianceweek.com/regulatory-enforcement/cleo-ai-paid-17m-to-settle-allegations-it-deceived-customers/
2. Article 50 of Regulation (EU) 2024/1689 (AI Act), European Commission AI Act Service Desk, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50