Transparency obligations

Transparency obligations come from two directions. Under the EU AI Act (Art. 50), providers must design systems that interact with people so users know they are dealing with AI, unless obvious, and must mark synthetic audio, image, video and text in a machine-readable way. Deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, and must tell people exposed to emotion recognition or biometric categorization. These duties apply regardless of risk tier.

Data protection law adds the duty to tell data subjects, in clear language, who the controller is, the purposes and legal basis, recipients, retention and rights, including meaningful information about automated decision-making (GDPR Arts. 12 to 14; LGPD Art. 9). Providers of general-purpose AI models carry separate documentation duties toward downstream providers.

Example: a retailer's customer service chatbot opens with a notice that the customer is talking to an AI assistant and links to the privacy notice.