Playbook 4 — Transparency & Disclosure
The Article 50 duties that are live right now
The transparency duties are the part of the AI Act most SMBs are already inside, and most are out of compliance without having made a decision about it. The obligations are live, and they apply to limited-risk systems — the tier a company is most likely to actually run.
Three duties matter at SMB scale, and they are all notice problems rather than model problems. That is what makes them cheap to fix and easy to overlook.
The first is interaction disclosure. If a person is talking to an AI — a support chatbot, a voice assistant, an automated agent — they have to be told it is an AI, unless it is obvious from context. Most companies assume it is obvious. It is obvious to the people who built it; it is not always obvious to a customer at 11pm who cannot tell whether they are in a queue for a human.
The second is content labelling. AI-generated or manipulated content — images, audio, video, and text published where it could mislead — must be marked as such. This is where the Act’s watermarking requirements bite, and they take effect on a near date regardless of company size. The practical version for an SMB is a rule for anything published externally: if it was generated or materially altered by AI, it carries a label.
The third is disclosure of emotion recognition or biometric categorisation. If a system infers emotion or categorises people by biometric data, the people affected have to be informed. Few SMBs run this, but a few do, often without thinking of it as a regulated use — a tool that reads tone in support calls, or analyses sentiment from faces in a room.
The mechanism is worth seeing clearly. None of these require you to change what the system does. They require you to say what it is doing. That is why they are the wrong thing to postpone: the fix is a sentence, a label, and a line in a policy, and the exposure is a complaint that starts from a customer discovering the thing you did not say.
A disclosure check:
- Every customer-facing AI interaction tells the person it is AI.
- Externally published AI-generated or altered content carries a label.
- Any emotion-recognition or biometric use is disclosed to those affected.
- The rule is written down, so it survives the person who remembered it.
- Someone owns staying current, because the labelling rules and dates moved once already.
This is general information, not legal advice.
Next: Playbook 5 collects all of it into one file that proves the work.