EU AI Act Transparency Obligations: What You Must Disclose

The EU AI Act (Regulation 2024/1689) introduces the most comprehensive transparency framework for artificial intelligence ever enacted. Unlike previous regulations that focused primarily on data protection, the AI Act establishes clear rules about what must be disclosed when AI systems interact with people, generate content, or make decisions that affect them.

Transparency is not limited to high-risk AI systems. Even AI systems classified as limited risk — including chatbots, deepfake generators, and emotion recognition tools — carry specific disclosure obligations. Failing to meet these requirements can result in fines of up to 15 million EUR or 3% of global annual turnover.

This guide breaks down the transparency obligations under Articles 50 through 52 of the EU AI Act, explains who must comply, and outlines practical steps for implementation.

Why Transparency Matters Under the EU AI Act

The EU AI Act is built on the principle that people have a right to know when they are interacting with AI. This is not just a philosophical stance — it is a legally enforceable requirement. The regulation recognizes that without transparency, individuals cannot exercise informed consent, contest automated decisions, or understand the basis for outcomes that affect them.

Transparency obligations apply across the entire risk pyramid. While high-risk systems face the most demanding requirements (including technical documentation, conformity assessments, and CE marking), even systems classified as limited risk must meet specific disclosure rules.

Limited Risk

Most transparency obligations fall under the limited risk category. This means they apply broadly to a wide range of AI systems that many organizations already deploy, including customer service chatbots, content generation tools, and AI-assisted communication platforms.

Article 50: Core Transparency Requirements

Article 50 is the central provision governing transparency for AI systems that interact directly with natural persons. It establishes four main categories of disclosure obligations.

1. AI System Interaction Disclosure

When an AI system is designed to interact directly with natural persons, the provider must ensure that the system is designed and developed in such a way that the natural person is informed they are interacting with an AI system. This obligation applies unless the AI nature of the system is obvious from the circumstances and context of use.

In practice, this means:

• Chatbots must clearly identify themselves as AI-powered before or at the beginning of any conversation
• Virtual assistants that handle customer inquiries must disclose their non-human nature
• AI-driven phone systems (including voice clones) must inform callers that they are speaking with an AI

2. Emotion Recognition and Biometric Categorization

Deployers of emotion recognition systems or biometric categorization systems must inform natural persons exposed to such systems about the operation of the system. This includes informing them about the categories of personal data being processed and, where applicable, the purpose of the processing.

Key requirements include:

• Informing individuals before the system processes their data
• Explaining what categories of data are collected (facial expressions, voice patterns, physiological signals)
• Stating the purpose of the categorization or recognition
• Providing this information in a clear, distinguishable manner

3. AI-Generated Content Labeling

Providers of AI systems that generate synthetic audio, image, video, or text content must ensure that the outputs are marked in a machine-readable format and are detectable as artificially generated or manipulated. This is one of the most technically demanding transparency obligations.

The requirement has two components:

• Machine-readable marking: Outputs must contain metadata or watermarks that allow automated detection of their AI-generated nature
• Human-facing disclosure: When AI-generated content is published, deployers must disclose that the content was generated or manipulated by AI

4. Deepfake Disclosure

The regulation pays special attention to deepfakes. Any person who deploys an AI system that generates or manipulates image, audio, or video content that constitutes a deepfake must disclose that the content has been artificially generated or manipulated. This disclosure must be made in a clear and distinguishable manner at the latest when the content is first published.

There are limited exceptions for:

• Content used for legitimate artistic, satirical, or fictional purposes, provided there are safeguards for third-party rights
• Law enforcement activities where disclosure would compromise public safety

Article 50 in Practice: Who Must Do What

Understanding transparency obligations requires distinguishing between providers and deployers:

Role	Obligation	Example
Provider	Design systems to enable transparency	Build disclosure mechanisms into the chatbot interface
Provider	Implement machine-readable content marking	Add C2PA metadata or watermarks to generated images
Deployer	Inform users about AI interaction	Display "You are chatting with an AI assistant"
Deployer	Disclose AI-generated content	Label AI-written articles or images as AI-generated
Deployer	Notify subjects of emotion recognition	Post signage about facial analysis in retail spaces

Article 52: Transparency for High-Risk AI Systems

High-risk AI systems face additional transparency requirements beyond those in Article 50. These are detailed primarily in Articles 13 and 14, but Article 52 extends transparency obligations to specific high-risk use cases.

Instructions for Use

Providers of high-risk AI systems must supply deployers with clear, comprehensive instructions for use. These must include:

• The identity and contact details of the provider
• The characteristics, capabilities, and limitations of the AI system
• The level of accuracy, robustness, and cybersecurity performance
• Any known or foreseeable circumstances that may lead to risks to health, safety, or fundamental rights
• Human oversight measures and how to implement them
• The expected lifetime of the system and maintenance requirements

Logging and Traceability

High-risk AI systems must automatically generate logs. These logs must be detailed enough to enable monitoring of the system's operation and to facilitate post-market surveillance. Deployers must retain these logs for a period appropriate to the intended purpose of the high-risk AI system, and for at least six months unless otherwise provided by applicable law.

Practical Steps to Achieve Transparency Compliance

Step 1: Inventory Your AI Systems

Before you can meet transparency obligations, you need to know what AI systems your organization uses. Conduct a thorough audit covering:

• Customer-facing chatbots and virtual assistants
• Content generation tools (text, image, video, audio)
• Emotion recognition or biometric categorization systems
• Any AI system that interacts directly with natural persons

Step 2: Classify Disclosure Requirements

For each system identified, determine which transparency obligations apply. Map each system to the relevant provisions of Article 50 and, where applicable, Article 52.

Step 3: Implement Technical Measures

For AI-generated content, implement machine-readable marking. The C2PA (Coalition for Content Provenance and Authenticity) standard is emerging as a leading approach. For chatbots and interactive systems, build disclosure mechanisms directly into the user interface.

Step 4: Draft User-Facing Disclosures

Create clear, plain-language notices for each transparency obligation. Avoid burying disclosures in lengthy terms of service. The regulation requires disclosures to be "clear and distinguishable" — meaning they must be prominent and easy to understand.

Step 5: Document Everything

Maintain records of your transparency measures. This documentation will be essential if regulators ask you to demonstrate compliance. Keep records of:

• What disclosures are made, where, and when
• How machine-readable marking is implemented
• Training materials for staff on transparency obligations
• Any decisions not to disclose (with justification under an exemption)

Timeline for Transparency Compliance

Common Mistakes to Avoid

Assuming chatbot transparency is optional. If your system interacts with people and the AI nature is not obvious, you must disclose. The bar for "obvious" is high.

Ignoring the machine-readable requirement. Simply adding a text label to AI-generated content is not enough. Providers must implement technical marking that enables automated detection.

Conflating GDPR transparency with AI Act transparency. While both regulations require transparency, the AI Act's requirements are distinct. GDPR transparency focuses on data processing; AI Act transparency focuses on the AI nature of the system and its outputs. You need to comply with both.

Treating transparency as a one-time task. Transparency obligations are ongoing. As AI systems are updated, disclosures must be reviewed and revised to remain accurate.

Penalties for Non-Compliance

Failure to meet transparency obligations can result in administrative fines of up to 15 million EUR or 3% of total worldwide annual turnover of the preceding financial year, whichever is higher. For particularly serious violations — such as deploying AI systems that manipulate people without disclosure — penalties can reach 35 million EUR or 7% of turnover.

Conclusion

Transparency is one of the most immediately actionable areas of the EU AI Act. Unlike high-risk system requirements that demand extensive conformity assessments, many transparency obligations can be met through clear communication design, technical content marking, and thorough documentation.

Organizations should not wait until August 2026 to begin preparing. Building transparency into AI systems from the design stage is both cheaper and more effective than retrofitting disclosures after deployment. Start by inventorying your AI systems, mapping the applicable obligations, and implementing disclosure mechanisms now.