AI Transparency Requirements Under EU Law: What Organizations Must Disclose

1. Why Transparency Is the Foundation of EU AI Regulation

The European legislator chose transparency as the single obligation that applies to every AI system regardless of risk level. Prohibited systems aside, transparency requirements scale with risk: minimal-risk systems face voluntary codes of conduct, limited-risk systems must identify themselves, and high-risk systems must provide full technical documentation and instructions for use. This tiered approach reflects a fundamental principle of EU fundamental rights law — individuals must be empowered to understand how automated systems affect them.

Regulation (EU) 2024/1689 codifies transparency across multiple articles, but two are central: Article 13 (transparency and provision of information to deployers of high-risk AI) and Article 50 (transparency obligations for providers and deployers of certain AI systems, including chatbots, deepfakes, and emotion recognition). Together, they create a disclosure framework more demanding than anything in GDPR, the Digital Services Act, or the Medical Devices Regulation.

2. Article 13: Transparency for High-Risk AI Systems

Article 13 is the most granular transparency provision in global AI regulation. It requires that high-risk AI systems be designed and developed in such a manner that their operation is sufficiently transparent to enable deployers to interpret the system's output and use it appropriately. Specifically, Article 13(3) mandates that high-risk AI systems shall be accompanied by instructions for use that include:

• The identity and contact details of the provider and, where applicable, of the authorized representative
• The characteristics, capabilities, and limitations of performance, including intended purpose, level of accuracy, robustness, and cybersecurity
• Known or foreseeable circumstances that may lead to risks to health, safety, or fundamental rights
• The performance metrics for specific persons or groups on whom the system is intended to be used
• Specifications for input data and any other relevant information regarding training, validation, and testing datasets
• Where relevant, information enabling deployers to interpret the AI system's output and use it appropriately
• Human oversight measures, including technical measures to facilitate the interpretation of outputs
• The expected lifetime of the high-risk AI system and any necessary maintenance and care measures

Who Bears the Obligation?

The transparency obligation under Article 13 falls primarily on providers (those who develop or place the AI system on the market). However, deployers have corresponding obligations under Article 26 to use the system in accordance with the instructions provided and to inform natural persons that they are subject to a high-risk AI system. This creates a bidirectional transparency chain that many organizations overlook during compliance planning.

3. Article 50: Transparency for Limited-Risk AI

Article 50 addresses AI systems that, while not classified as high-risk, interact with people in ways that require specific disclosures. The obligations are organized by AI system type:

Deepfake Labeling: The Technical Challenge

Article 50(4) is particularly demanding because it requires both human-visible labeling and machine-readable watermarking. The technical standards are being developed by CEN/CENELEC and are expected to reference C2PA (Coalition for Content Provenance and Authenticity) standards. Organizations generating synthetic media must implement provenance metadata at the point of creation — retrofitting disclosure after distribution is explicitly insufficient under the regulation.

4. What “Meaningful Transparency” Means in Practice

The EU AI Act deliberately uses the phrase “sufficiently transparent to enable deployers to interpret the system's output” (Article 13(1)). This standard — sufficiency for interpretation — goes far beyond mere disclosure. It requires that transparency be actionable: a deployer who reads the provided information must be able to make informed decisions about when to rely on the AI system's output and when to override it.

In practice, meaningful transparency requires three things: comprehensibility (information presented in a way the intended audience can understand), completeness (all material facts about the system's behavior are disclosed), and timeliness (information is available before or at the point where deployment decisions are made, not retroactively). A 200-page technical specification that no deployer reads does not satisfy the regulation.

5. Technical Documentation Requirements

Annex IV of the EU AI Act specifies what technical documentation must contain for high-risk AI systems. This documentation must be drawn up before the system is placed on the market and kept up to date throughout its lifecycle. The requirements include:

The scope of Annex IV effectively requires organizations to maintain a living compliance dossier that evolves with the system. Static PDF documentation generated at launch and never updated will not satisfy the regulation's lifecycle requirements.

6. Instructions for Use Requirements

Distinct from technical documentation (which may contain proprietary details accessible only to authorities), instructions for use under Article 13(3) must be provided to every deployer. These instructions serve as the deployer's primary tool for responsible AI system operation. They must be:

• Concise and complete — covering all information relevant to the deployer's compliance obligations
• Clear and legible — understandable by a deployer with the expected level of knowledge and experience
• Accurate — reflecting the system's actual capabilities, not marketing claims
• Structured for action — enabling the deployer to configure, monitor, and override the system effectively

Perhaps most critically, instructions for use must include information about known bias risks and foreseeable misuse scenarios. Omitting known limitations is not merely negligent — it is a compliance violation under Article 13 that can trigger fines under Article 99.

7. TRACE: A Framework for Operationalizing Transparency

Meeting Articles 13 and 50 at scale requires more than documentation templates — it requires an architectural approach that makes transparency a system property, not an afterthought. The TAMR+ (Trustworthy AI through Merkle-chain Reasoning) methodology, developed as part of the TraceGov.ai knowledge graph platform, introduces the TRACE framework — five pillars that map directly to EU AI Act transparency obligations:

8. 7-Year Cryptographic Retention via Merkle-Chain

Article 18 of the EU AI Act requires that technical documentation be retained for a period of 10 years after the high-risk AI system has been placed on the market. Logs generated by the system must be kept for an appropriate period of at least 6 months (Article 19), unless otherwise provided by Union or national law. For financial and critical infrastructure applications, sector-specific regulations often mandate 7 years.

TAMR+ addresses this through a Merkle-chain with SHA-256 hashing. Each reasoning trace is serialized, hashed, and linked to the previous trace, creating a tamper-evident chain of decisions. The structure provides:

• Immutability — any modification to a historical record breaks the hash chain, making tampering detectable
• Verifiability — auditors can independently recompute hashes to confirm record integrity
• Efficiency — only hashes are stored in the chain; full records can reside in standard storage, verified on demand
• Patent-protected design — the Merkle-chain architecture is covered by European Patent Application EP26162901.8

This approach transforms compliance from a documentation exercise into a cryptographic guarantee. When a market surveillance authority requests evidence of past AI decisions, the organization can present an unbroken, verifiable chain — not reconstructed logs or after-the-fact explanations.

9. GDPR Transparency vs. AI Act Transparency

Organizations already subject to GDPR Articles 13–14 (information to be provided to data subjects) may assume their existing transparency practices are sufficient. They are not. The AI Act imposes additional and more specific requirements:

The practical consequence is that organizations need parallel transparency programs: GDPR transparency for data subjects (privacy notices, consent mechanisms, data access requests) and AI Act transparency for deployers and authorities (technical documentation, instructions for use, lifecycle logging). These programs should share infrastructure but serve distinct compliance objectives.

10. Practical Implementation Steps

Moving from regulatory text to operational compliance requires a structured approach. Based on our experience with regulated enterprises, we recommend the following implementation sequence:

1. Inventory and classify — Map every AI system to a risk category. For each high-risk system, identify the specific Annex III use case that triggers classification. For each limited-risk system, identify applicable Article 50 sub-paragraphs.
2. Gap assessment — Compare existing documentation against Annex IV requirements item by item. Most organizations discover that design specification and training data provenance documentation are the largest gaps.
3. Build the transparency architecture — Implement structured logging, reasoning trace capture, and documentation generation as system capabilities, not manual processes. A knowledge graph approach (as in TAMR+) ensures that transparency is a system property rather than a documentation burden.
4. Create instructions for use — Draft deployer-facing documentation that covers all Article 13(3) elements. Test with actual deployers for comprehensibility. Iterate until non-technical deployers can explain the system's intended purpose, limitations, and override procedures.
5. Implement Article 50 disclosures — For chatbots, add clear AI identification at the start of every conversation. For generative content, implement C2PA-compatible watermarking. For emotion recognition systems, deploy visible notification mechanisms.
6. Establish cryptographic retention — Deploy a Merkle-chain or equivalent tamper-evident logging system. Define retention policies aligned with both AI Act (10 years for docs, 6+ months for logs) and sector-specific requirements.
7. Integrate with governance — Connect transparency outputs to your AI governance framework, including the fundamental rights impact assessment (Article 27), post-market monitoring (Article 72), and serious incident reporting (Article 73).

11. Frequently Asked Questions

Related Insights