AI transparency obligations are legal duties that require organizations to disclose when people interact with an AI system, to label AI-generated or manipulated content, and to give users and regulators enough information to understand how a system should be used. In AI regulation, the best-known set is Article 50 of the EU AI Act, which applies to chatbots, generative AI, emotion recognition and deepfakes regardless of whether the system is otherwise classed as high-risk.
Transparency duties sit alongside, not instead of, the risk-based rules. A system can be minimal risk and still require disclosure, while a high-risk system carries additional documentation and instruction duties toward its deployers. The obligations fall on different actors, mainly the AI provider that develops the system and the AI deployer that uses it.
The core transparency duties under the EU AI Act
Article 50 sets out four main situations in which people must be informed. Each one targets a specific risk of deception: believing a machine is a human, mistaking synthetic media for authentic recordings, or being analyzed without knowing it.
| Situation | Responsible actor | Required measure |
|---|---|---|
| AI interacting with people | Provider | Inform users they are dealing with AI, unless obvious |
| Synthetic audio, image, video or text | Provider | Mark outputs in a machine-readable, detectable way |
| Emotion recognition or biometric categorization | Deployer | Inform exposed persons about the operation |
| Deepfakes | Deployer | Disclose that content was generated or manipulated |
| AI text on matters of public interest | Deployer | Disclose, unless under human editorial responsibility |
Information must be given clearly and at the latest at the first interaction or exposure, and it must meet accessibility requirements. Narrow exceptions exist for law enforcement uses authorized by law, and for evidently artistic, satirical or fictional works, where disclosure may be limited so it does not hamper the enjoyment of the work.
The disclosure test is whether a reasonably well-informed person would already understand that the system is AI. A voice assistant on a smart speaker may be obvious, while a customer service agent with a human name and a natural writing style is not. When in doubt, organizations generally disclose, because the cost of a short notice is far lower than the cost of an enforcement action or a loss of customer trust.
Marking and detecting AI-generated content
The duty to mark synthetic content requires technical solutions that are effective, interoperable, robust and reliable as far as technically feasible. No single technique meets all of these goals, so providers usually combine several methods.
| Technique | How it works | Main weakness |
|---|---|---|
| Metadata and content credentials | Signed provenance data attached to the file | Easily stripped by screenshots or re-encoding |
| Invisible watermarks | Signal embedded in pixels, audio or tokens | Can degrade under heavy editing |
| Fingerprinting | Hash of output stored for later lookup | Requires a database and exact matches |
| Visible labels | On-screen notice or caption | Removable, but clearest for people |
Watermarking text is especially difficult, because paraphrasing or translation can remove statistical signals. A code of practice on marking and labeling supports implementation, and conformance with such a code or with standards is expected to become the practical benchmark for compliance.
Transparency for high-risk systems and GPAI models
Beyond Article 50, the AI Act contains other transparency layers aimed at professional users and authorities rather than at the general public.
| Layer | Audience | Content |
|---|---|---|
| Article 50 duties | Individuals and the public | Disclosure and labeling |
| High-risk instructions for use | Deployers | Capabilities, limits, accuracy, oversight needs |
| GPAI documentation | Downstream providers and AI Office | Model documentation, training content summary |
| EU database registration | Public and authorities | Key data on high-risk systems |
| Explanation of decisions | Affected persons | Role of AI in decisions about them |
Providers of general-purpose AI models must publish a sufficiently detailed summary of training content and keep technical documentation available. The GPAI Code of Practice offers a template for meeting these duties, which apply independently of how downstream products disclose AI use to end users.
Comparison with other transparency regimes
Transparency rules for AI also appear outside the AI Act, and an organization often has to satisfy several regimes at once.
- The GDPR requires meaningful information about the logic of automated decisions with legal or similarly significant effects.
- The Digital Services Act requires platforms to explain recommender system parameters and label advertising.
- The Colorado AI Act requires deployers of high-risk AI to notify consumers of consequential decisions made with AI.
- Voluntary frameworks such as the NIST AI RMF and ISO/IEC 42001 treat transparency as a governance practice rather than a legal duty.
Timeline, enforcement and common mistakes
Under the AI Act’s original timetable, the Article 50 duties apply from 2 August 2026, while GPAI duties applied from August 2025. Infringements of transparency obligations can lead to fines of up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher, with lower caps for smaller companies. Legislative adjustments to parts of the timeline have been discussed, so organizations should track the current legal text.
- Assuming disclosure is unnecessary because the system is not high-risk.
- Relying only on metadata that disappears when content is shared or compressed.
- Placing the AI notice in terms of service rather than at the point of interaction.
- Confusing provider and deployer duties when a company both builds and uses a system.
Enforcement rests with national market surveillance authorities, while the EU AI Office supervises GPAI model providers directly.
Stripped to the essentials
AI transparency obligations mean that people should not be fooled by AI. If you chat with a bot, you should be told it is a bot. If a picture, voice or video was made or changed by AI in a realistic way, that should be labeled.
The companies that build AI tools must make their output recognizable as machine-made, and the businesses that use those tools must tell people when they are being shown or analyzed by them.
Where it is applied
An online electronics retailer in the European Union deploys a customer service chatbot built on a third-party model and uses an image generator for product lifestyle photos. Its compliance team maps each use to the AI Act and finds two deployer-side tasks and one dependency on the provider.
The chat window now opens with the line “You are chatting with an automated assistant” and offers a button to reach a human. Generated images keep the provider’s embedded content credentials and watermark, and realistic scenes showing people carry a small visible label. The team also adds a check to its publishing workflow so that images are not re-exported in a way that strips the provenance data.