AI Disclosure | Transparency Requirements | User Notification | Automated Decision Rights | Accountability
This AI Disclosure & Transparency Policy for [Company / Service] effective [Date] establishes requirements for disclosing AI use to end users. Legal Framework: EU AI Act 2023/1230 Art. 52 (Transparency), GDPR Art. 22 (Automated Decision-Making), US FTC AI Transparency Guidelines, FTC Act §5 (Deceptive Practices).
1.1 When Disclosure REQUIRED: Per EU AI Act Art. 52, disclose AI when:
☑ Chatbot/virtual assistant providing customer service
☑ AI-generated content: Text, images, audio, video (not created by human)
☑ Automated decision-making: Loan approval, hiring, content recommendation
☑ Biometric identification: Facial recognition, emotion detection
☑ Risk assessment: Credit scoring, fraud detection (per Art. 52(2))
1.2 Explicit Notification (MANDATORY): Clear disclosure that AI involved per FTC Act §5 (Clear & Conspicuous):
• Format: "This is powered by AI" OR "AI-Generated" badge/notification
• Timing: Disclosed BEFORE user engages with AI system
• Prominence: Easily visible (not buried in small print per GDPR Art. 22(3))
• Language: Clear, non-technical (user-friendly per FTC Guidance)
1.3 Disclosure Content: Must include per AI Act Art. 52(1):
☑ Fact that AI system is operating (not human)
☑ Capability/purpose: What the AI can and cannot do
☑ Limitations: Accuracy rate, error rate (if material)
☑ Human fallback: "Request human review" option available
2.1 Required Chatbot Notice (AT START): Per AI Act Art. 52:
EXAMPLE (MANDATORY LANGUAGE):
"You are chatting with an AI assistant. This is not a human. I can answer questions about [X], but cannot [Y]. You can request a human agent anytime." | Button: "Talk to Human"
• Placement: Message 1 (before bot responds) per FTC Guidelines
• Persistent: Visible throughout conversation
• Switchable: One-click human transfer available (opt-out right per GDPR Art. 21)
2.2 Capability Disclosure: What chatbot CAN do per AI Act Art. 52(3):
☑ "Can help with [X] topics"
☑ "Cannot provide legal/medical advice"
☑ "Responses are AI-generated (not guaranteed accurate)"
2.3 Interaction Logging: Users informed that per GDPR Art. 13(1):
• Conversations logged (for improvement/debugging)
• Data retention: [X days/months]
• Privacy policy link: Available in chat footer
3.1 Text Content: If generated by AI per AI Act Art. 52(1):
• Label: "[AI-Generated]" OR "[Generated with AI assistance]"
• Placement: At beginning of content (or near title)
• Example: "[AI-Generated Article] This content was created using AI technology and reviewed by an editor."
3.2 Image/Video Content: AI-generated visuals per FTC Guidance:
• Watermark: "AI Generated" OR visual badge (unavoidable)
• Metadata: EXIF data includes "AI-Generated" tag
• Platform: Social media caption states "AI-Generated Image"
3.3 Synthetic Media (Deepfake): If AI-manipulated per AI Act Art. 52(2):
• PROMINENT WARNING: "[AI-Synthesized/Manipulated Media]"
• Location: Video overlay + caption + description
• Example: "[SYNTHETIC] This video contains AI-generated or manipulated content depicting real people."
4.1 Decision Disclosure (GDPR MANDATORY): When AI makes decision per GDPR Art. 22(3) & Art. 13(2)(f):
REQUIRED LANGUAGE:
"This decision was made automatically by AI. You have the right to:
• Request human review
• Know the reasoning behind the decision
• Challenge the decision
Contact: [email/phone] to exercise these rights."
4.2 User Rights (NON-WAIVABLE per Art. 22):
☑ Right to human review: Decision made by human (on request)
☑ Right to explanation: Why AI rejected/approved (reasoning disclosure per Art. 15)
☑ Right to object: Contest decision + request reconsideration
☑ Right to data access: See data used for decision (per Art. 15)
☑ Response time: Reply within [30 days] (per GDPR Art. 12(3))
4.3 High-Risk Automated Decisions: Additional disclosure per AI Act Art. 6 (High-Risk):
• Credit/loan decisions: Disclose AI involvement + appeal process
• Employment/hiring: Disclose AI screening + human review availability
• Criminal justice: Disclose AI use in risk assessment + review right
5.1 Accuracy Metrics (IF MATERIAL): Disclose performance data per FTC Act §5 (Substantiation):
• If claiming high accuracy: "[AI System X is 95% accurate]" - must be substantiated
• Error rate: "[System has 5% error rate]" - disclose if material
• Limitations: "[Not suitable for life-critical decisions]"
5.2 Bias & Fairness Disclosure: If AI system may exhibit bias per AI Act Art. 6(1) (High-Risk):
• Known limitations: "[System may perform differently across demographics]"
• Testing results: Documented fairness testing (if conducted)
• Recourse: Human review available for disputed decisions
5.3 Hallucination Warning (For LLMs): If Large Language Model used per AI Act Art. 52(4):
• Warning: "[AI may generate false/misleading information]"
• Recommendation: "[Do not rely on responses without verification]"
• Placement: Visible in UI + help section
6.1 Documentation (REQUIRED): Maintain per AI Act Art. 22 (Record-Keeping):
☑ AI system description (what it does, training data)
☑ Disclosure texts (proof of disclosure to users)
☑ Performance metrics (accuracy, error rates, tested)
☑ Complaints log (user complaints + resolutions)
☑ Impact assessment: DPIA if GDPR-relevant (Art. 35)
6.2 Audit Trail: Log all AI decisions per GDPR Art. 5(2):
• Decision logged with: timestamp, inputs, reasoning, outcome
• Retention: [X years] (per regulatory requirements)
• Access: User can request logs (transparency per Art. 15)
6.3 Complaint Handling: Process per AI Act Art. 20 (Right to Appeal):
• Complaint channel: Email/form available
• Response time: Within [30 days] (per GDPR standard)
• Resolution: Explain decision, offer alternatives (escalation to human if needed)
Law: ☐ EU AI Act + GDPR (if EU user) ☐ [US (FTC Act §5)] | Enforcement: Regulatory fines (GDPR: up to EUR 20M / 4% revenue; AI Act: EUR 30M / 6% revenue per Art. 71) + private claims (class actions possible for misleading AI)