AI Disclosure Requirements: What You Must Tell People
Last Updated: November 2026
An AI disclosure requirement is a rule that makes you tell a person when AI sits behind what they read, hear or get judged by. Some of these rules are law, and others are platform terms, client deals or the posting rules of a group you write in. The shape stays the same: say it plainly, say it early, and put it where the reader cannot miss it. What shifts is which uses get caught.
AI Smart Ventures has guided growing businesses through AI adoption since the first wave of these tools landed. One pattern shows up again and again. The question of what to tell people arrives late, once a tool is live and a buyer has asked something awkward. Sorting it out early costs less, and it is kinder on the team.
This stopped being a manners problem in 2026. The EU now treats some of these notices as a legal duty, and there is a watchdog behind it. US states keep adding smaller rules of their own. A founder-led firm that cannot say where AI touches its buyers cannot answer a client or a regulator who asks.
Key Takeaways
- The EU duty is live, not pending: the European Commission says the AI Act applied from 2 August 2026. Its transparency rules took effect that month.
- Four duties sit in one article: Article 50 covers AI people talk to, marks on AI output, deepfakes, and AI text on public-interest topics.
- Obvious counts as told: the chatbot duty drops where the AI is plain to a well-informed person, so labelling every pixel is the wrong move.
- The US has no single statute: MultiState’s tracker counted 1,561 AI bills introduced across 45 states by March 2026. Your duty follows your markets.
- Buyers expect it anyway: in Cint’s October 2026 report, 74% of US buyers said brands have a duty to disclose AI use in ads.
- Keep a list, not just a policy: one page naming every place AI meets a buyer makes the notices easy to find and to show.
Read those six together, and the job turns out to be list-making, not drafting. Each duty attaches to a place where AI meets a person, so the rule you need is the one that fits that place. Teams that open with a wording debate stall, while teams that open with a list finish.
What does the AI transparency rule require you to disclose?
Four things, all set out in Article 50 of the EU AI Act. Providers must build AI that people talk to so those people know it is AI. If a tool makes text, images, sound, or video, the provider must mark that output so machines can read the mark. Deployers must tell people they are exposed to emotion recognition or biometric sorting. They must also disclose deepfakes, plus AI text put out to inform the public on matters of public interest.
Two details do more work than the list. The notice must reach people in a clear and distinguishable way, at the latest when they first deal with the tool. A line buried three clicks deep in a policy page fails that test. The chatbot duty also drops where the AI is already plain to a reasonably well-informed, observant and circumspect person. Timing and placement trip teams up more often than wording does.
Which AI uses actually trigger a duty to disclose?
Any use where a person is on the other side of the AI, or where AI output reaches someone who assumes a human made it. In practice that means your chatbot and voice agent, plus AI-made images or video in marketing. Add a fake voice in an ad and tools that rank job seekers. Work drafted inside the firm and then checked and signed off by a named person sits outside most of these rules.
The carve-outs matter as much as the triggers. Article 50 leaves out output where the AI only helps with standard editing. It drops the public-interest text duty where a person or firm took charge of what went out. So a human in the loop is not a loophole; it is the thing that earns the break. Write down who that person is for each workflow, because that name is your answer if anyone asks who decided.
How do US rules differ from the EU duty?
The US has no single AI statute, so the duty arrives through many narrow rules. MultiState’s tracker recorded 1,561 AI bills introduced across 45 states by March 2026, from algorithmic rules to non-consensual explicit deepfakes. The real difference is scope. The EU rule asks what kind of AI you run, while US rules ask who your buyer is and where they live.
That changes how you keep up. In Europe, you read one text and map your tools against it. In the US you track the states you sell into, then watch the subjects that keep coming back. Consumer law sits under all of it, so a notice that is there but misleading still counts as deceptive. Most owner-operators get further with a short list of their own markets than with a national summary.
| Question | EU AI Act | Typical US rule |
|---|---|---|
| What sets the duty | The kind of AI you run | The sector, state and buyer |
| Who it binds | Providers and deployers | Usually the firm facing the buyer |
| What it asks for | Notice at first contact, plus marking | Notice, consent or a record |
How do you word a notice people actually read?
Short, early, and in the buyer’s own words: name the AI, say what it does, and say how to reach a person. One line at the top of a chat window beats a page of policy, because the rule turns on first contact. It does not turn on whether the words sit somewhere on your site. Skip the hedging, because “may use automated tools” tells a reader nothing.
Test the wording on someone outside your business. If they cannot tell you who they are talking to and how to reach a human, rewrite it. Two habits help after that. Keep the phrasing the same everywhere, so the chat box, the email footer, and the help page do not describe one tool three ways. Date the notice too, because tools change and a dated line shows when the words last matched reality.
How do you keep your disclosure list current?
Build one page listing every place AI meets a buyer, then give each row an owner and a review date. The columns that earn their place are the touchpoint, the tool, the market, the notice you show, and who signs off. Review the page when a tool changes, when you enter a new market, and once a quarter. The list is the control. The policy doc is only the wording behind it.
Most teams already hold the raw material, spread across a tool sheet, a vendor folder and someone’s memory. Pulling it onto one page takes an afternoon, and it often turns up two or three uses nobody had counted as buyer-facing. Treat the work as change management and AI literacy, not paperwork. Generic AI consultants often start with a policy template, which leaves you a doc and no list. Start from where buyers actually meet your tools instead.
AI Advisory builds that map with you and names who signs off on each notice. Bring your tool list to a first call, and ask for each decision in writing.
Frequently Asked Questions
Is there one global AI disclosure law?
No. The closest thing to a broad rule is the EU AI Act, whose notice duties the European Commission says applied from 2 August 2026. Everywhere else the duty comes from smaller laws: consumer rules, election rules, hiring law and platform terms. Your duty depends on where your buyers are, not on where the firm is based, so one global checklist will not work.
Which US states have AI disclosure rules?
Enough that the question is better asked market by market. MultiState’s tracker counted 1,561 AI bills introduced across 45 states by March 2026, with the session still running. Rather than learn a national list, write down the states you sell into and check only those. Four or five markets is a job most owners finish in a morning, and it is the only list that binds you.
What counts as a deepfake you must label?
Content that looks or sounds like a real person, place or event but was made or changed by AI. Under Article 50 the firm deploying the AI must disclose that the content was artificially generated or manipulated. Clearly artistic, satirical or made-up work gets lighter treatment: you note that such content exists, in a way that does not spoil the work.
Does a human edit remove the duty?
Sometimes, and only in the narrow cases the article actually names. Article 50 drops the duty on AI-written text on matters of public interest where a person or firm took editorial responsibility for it. The marking duty also leaves out output where AI only helps with standard editing. Neither break touches a chatbot or a deepfake, so human review is not a general get-out.
Does Steam make game makers disclose AI use?
Yes. Valve’s rules, announced on 10 January 2024 and reported by MobileSyrup, split the question in two. Pre-generated covers art, sound and other assets built with AI tools while the game is made. Live-generated covers content the AI makes while someone plays, and makers must also describe the guardrails they put on it. Both answers go into the survey Valve asks for before release.
Do community posting rules count as disclosure?
They are not law, but they bind you just as tightly in practice. Big discussion sites tend to leave AI labelling to each forum, so the rule that applies is the one your group wrote. Check the sidebar or the posting rules before you publish. A ban there costs you the audience, and it lands faster than any regulator would.
Does the EU duty apply to a US-only firm?
Only if your AI output reaches people inside the EU. The AI Act follows the market, not the head office, so a US firm whose chatbot serves EU buyers is in scope. A firm selling only at home is not. Check where your users are, not where your servers sit, because your sign-up data answers this faster than a lawyer can.
Who discloses, the tool vendor or you?
Both, for different duties. Article 50 puts the chatbot design duty and the marking duty on providers, meaning whoever builds and supplies the tool. It puts the deepfake, public-interest text and emotion-recognition notices on deployers, which is you whenever you run someone else’s tool in your firm. Ask every vendor in writing which of these they handle, then keep the reply.
When did marking AI output become required?
For newly launched tools, from the day the duty started. Providers whose AI systems reached the EU market before 2 August 2026 got a four-month transition on machine-readable marking. It runs to 2 December 2026, as Morgan Lewis records. Anything placed on the market after that first date had to comply at launch, and deployer duties were never put off. Ask your vendor which date applied to the build you run.
What happens if you disclose nothing?
Two things, and the slower one often costs more. The European Commission says the AI Office and Member State authorities enforce the Act. So there is a route to act on a breach. The money damage lands sooner, and it does not wait for a ruling. In Cint’s report, 44% of US buyers said learning a brand had not disclosed AI-made ads would lower their trust.
Is a line in your privacy policy enough?
No, not on its own. Article 50 wants the notice clear and easy to spot, no later than the first time someone deals with the tool. A policy page the reader must go hunting for fails that test, even when the wording in it is perfect. Keep the policy page for the detail, and put the short notice where the contact begins.
What does getting your disclosures in order involve?
Three passes, and the first is the longest. You map every place AI meets a buyer, then decide what each one must say. After that you set an owner and a review date for each row. Scope drives the effort more than team size does, so ask any adviser for named stages and a clear finish point. Schedule a consultation with AI Smart Ventures to start with the map.
Executive Summary
AI disclosure is a legal duty in Europe and a patchwork of smaller rules elsewhere. The EU AI Act’s transparency article has applied since 2 August 2026. It covers four things: AI people talk to, marks on AI output, deepfakes, and AI text put out on public-interest topics. Timing and placement decide whether you comply. The notice must land at first contact. In the US the duty tracks your markets rather than your tools. Practical AI work makes both easier: one list of every place AI meets a buyer, each row owned and dated.
What Should You Do Next?
This week, open a blank page and list every place AI reaches a buyer: chat, voice, email, images, screening. Mark which of those a person would assume a human made, then write the one-line notice for each. Put a name and a review date beside every row.
AI Smart Ventures offers AI Advisory for growing businesses that need their AI disclosures to match what their tools really do. Schedule a consultation to turn that list into notices you can stand behind.
People Also Read
- AI Tools for Food and Beverage Manufacturers: What Actually Works
- AI Content Marketing for Mental Health Brands in 2026
About the Author
Nicole A. Donnelly is the Founder of AI Smart Ventures and an AI Adoption Specialist with 20 years of experience as a founder and CEO and over a decade leading AI adoption initiatives. She helps businesses integrate artificial intelligence with clarity and confidence, driving innovation and sustainable growth. Nicole has trained over 20,217 professionals in Applied AI, delivered 624 workshops, and worked with close to 1,000 organizations across diverse industries.
Expertise: AI Transformation, AI Strategy, AI Implementation, AI Adoption, Applied AI, Marketing, Business Operations
Disclaimer: This content is for informational purposes only and does not constitute professional business or technology advice. Results vary based on industry, existing systems and implementation commitment. Contact AI Smart Ventures for a consultation regarding your specific situation.
