AI disclosure, consent and privacy checklist

Tell people they are interacting with AI

EU AI Act Article 50(1), addressed to providers.

• A chatbot, voice agent or other AI system that talks to people tells them they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person in that context.

  This is the Article 50(1) duty for systems “intended to interact directly with natural persons”. When in doubt, assume it is not obvious. EU AI Act, Article 50(1) (EUR-Lex)

• The notice appears at the latest at the first interaction, in a clear and distinguishable way, not in the terms of service.

  Article 50(5): the information must be given “in a clear and distinguishable manner at the latest at the time of the first interaction or exposure”. EU AI Act, Article 50(5) (EUR-Lex)

• The notice is accessible: readable by screen readers, announced in voice interfaces, and not shown only as an icon or colour.

  Article 50(5) also requires the information to “conform to the applicable accessibility requirements”. EU AI Act, Article 50(5) (EUR-Lex)

• The AI is never presented as a person: no human name and photo without a clear AI label, no claims of being human when asked.

  Apple: never trick someone into thinking they're interacting with, or viewing content authored by, a human when they aren't. PAIR gives the same advice. Apple HIG: Generative AI

• When a conversation moves between AI and a human agent, the change is shown.

  People share different things with a person than with a bot; they should know which one is reading.

Label AI-generated content

Article 50(2) for providers, Article 50(4) for deployers.

• If you provide a system that generates synthetic audio, images, video or text, its outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.

  Article 50(2). It doesn't apply where the system only performs an assistive function for standard editing or doesn't substantially alter the input. Provenance standards such as C2PA Content Credentials are one way to attach machine-readable marks. EU AI Act, Article 50(2) (EUR-Lex)

• If you publish AI-generated or manipulated images, audio or video that resemble real people, objects, places or events and could pass as authentic (a deep fake), you disclose that it was generated or manipulated.

  Article 50(4), first subparagraph, addressed to deployers. For evidently artistic, creative, satirical or fictional work, the duty is limited to disclosing it in a way that doesn't spoil the work. EU AI Act, Article 50(4) (EUR-Lex)

• If you publish AI-generated or manipulated text to inform the public on matters of public interest, you disclose it, unless it went through human review or editorial control and someone holds editorial responsibility.

  Article 50(4), second subparagraph. Newsrooms, public bodies and companies publishing public-information content should decide which side of the exception each workflow is on. EU AI Act, Article 50(4) (EUR-Lex)

• AI-generated content inside your product (summaries, replies, images) is labelled where it appears, so people can tell it from human-written content.

  Apple: clearly identify when and where you use AI. Labels next to the content work better than a notice in settings. Apple HIG: Generative AI

• Labels and metadata survive export, download, copy and share where you control the format.

  AI content travels. A label that only exists inside your app disappears the moment someone shares the image.

• If you use emotion recognition or biometric categorisation, the people exposed to it are told, and their data is handled under the GDPR.

  Article 50(3), addressed to deployers. Note that some uses of emotion recognition, such as in workplaces and education, are prohibited outright under Article 5. EU AI Act, Article 50(3) (EUR-Lex)

Explain data use

• Before people use the feature, they can see which of their data it uses (messages, files, photos, location, usage) and why.

  Apple asks apps to clearly disclose how the app and its model use and store personal information, and to explain the benefit concisely. Apple HIG: Generative AI

• People are told when their data is sent to a server or a third-party model provider, and what is shared.

  Apple: make sure people know their information may be sent to a server, show what is shared, and help them understand what may be stored off-device. Apple HIG: Generative AI

• You state plainly whether people's content is used to train or improve models, and the answer matches what actually happens.

  Apple asks you to articulate whether the model uses personal information for training. The FTC has warned that model-as-a-service companies that break their privacy commitments may be liable. FTC: AI Companies: Uphold Your Privacy and Confidentiality Commitments

• Retention is stated: how long prompts, outputs and uploaded files are kept, and what deleting them does.

  People can't make an informed choice about sharing without knowing how long it's kept.

• Outputs are checked for the risk of exposing personal or sensitive information, such as one user's data appearing in another's results.

  Apple notes model outputs can inadvertently contain sensitive information. Apple HIG: Generative AI

Consent, opt-outs and control

• Permission is asked before personal or usage data is used by the AI feature, and explicit permission before sensitive data is used for model improvement.

  Apple: ask permission before using personal information and usage data; get explicit permission for sensitive data used for improvement or storage. Under the GDPR you also need a lawful basis for each purpose. Apple HIG: Generative AI

• There is a clear, findable way to opt out of the AI feature, of personalisation, and of training use, and opting out doesn't break the rest of the product.

  Apple asks for a clear way to opt out after permission is given. PAIR recommends letting people reset personalisation or turn features off entirely. PAIR: Feedback + Control

• The opt-out is as easy as the opt-in: no pre-ticked boxes, no buried toggles, no repeated nagging after someone says no.

  Consent obtained through a design that steers people isn't the free choice it claims to be.

• If you change how data is used (for example, starting to train on user content), you tell people directly and before it happens, not by quietly editing the privacy policy.

  The FTC has said it may be unfair or deceptive to adopt more permissive data practices and inform people only through a surreptitious, retroactive change to the terms or privacy policy. FTC: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive

Automated decisions about people

• If the AI makes decisions with legal or similarly significant effects on people (credit, hiring, insurance, access to services) without human involvement, you have checked GDPR Article 22.

  Article 22(1) gives people the right not to be subject to such decisions based solely on automated processing; where they are allowed, Article 22(3) requires at least the right to human intervention, to express their view and to contest the decision. GDPR, Article 22 (EUR-Lex)

• People can see that a decision was automated, ask for a person to review it, and contest it, from the screen where the decision is shown.

  The safeguards in Article 22(3) only help if people can find them. ICO: Guidance on AI and data protection

• The decision screen explains the main factors behind the outcome in plain language.

  Microsoft's G11: make clear why the system did what it did. For decisions covered by GDPR Article 22, Articles 13 to 15 also require meaningful information about the logic involved. Microsoft HAX: Guidelines for Human-AI Interaction