What is AI transparency?

    AI transparency means disclosing when AI is used, how it works and where its limits are. Requirements under the EU AI Act, California and Canadian rules, and the elements of a transparency program.

    AI transparency is disclosing when AI is being used, what it is, how it was built, and what it can and cannot do, to the people who need that information to make decisions about it: users, affected individuals, deployers, auditors and regulators. It runs from a one-line chatbot notice to hundreds of pages of technical documentation and an invisible watermark in a generated image. As of October 2026, much of it is a legal requirement: EU AI Act Article 50 and California's AI Transparency Act have both applied since 2 August 2026.

    Transparency, explainability, interpretability

    Three related terms, often used as synonyms.

    • Transparency is about the system: that AI is in use, who built it, what data it was trained on, its intended purpose, its performance and limits.
    • Explainability is about an output: why this result, for this input, in terms the recipient can act on. It is covered in what is explainable AI (XAI)?
    • Interpretability is about mechanism: how far a human can understand how the model works internally, from a readable decision tree to research that traces circuits inside a large language model.

    Transparency is the precondition for the other two, and for accountability. Nobody can be held to account for a system nobody knows is there.

    The four layers of AI transparency

    • Notice to people. Telling individuals they are dealing with AI, that content is synthetic, or that a decision about them was automated. This is the layer most new law targets.
    • Information to deployers. What a provider must give the organizations that use its system: capabilities, limits, accuracy, intended purpose, and what oversight is needed. Without it, a deployer cannot meet its own obligations.
    • Documentation for regulators and auditors. Technical documentation, logs, risk assessments and test results. This is not public, but it must exist and be producible. See AI audit.
    • Content provenance. Machine-readable signals (metadata, watermarks, fingerprints) that travel with generated content so platforms and tools can detect it.

    EU AI Act Article 50: what applies since 2 August 2026

    Article 50 sets four transparency duties that apply to AI systems whatever their risk tier. The 2026 Digital Omnibus deferred the high-risk obligations, but it did not delay Article 50.

    Duty Who What Status (October 2026)
    50(1) Interaction notice Providers Design systems that interact with people (chatbots, voice agents) so people are informed they are dealing with AI, unless that is obvious to a reasonably well-informed person Applies since 2 August 2026
    50(2) Machine-readable marking Providers Mark synthetic audio, image, video and text so it is detectable as AI-generated or manipulated, using solutions that are effective, interoperable, robust and reliable as far as technically feasible. Assistive editing that does not substantially alter the input is excluded Applies since 2 August 2026; grace period to 2 December 2026 for generative systems on the market before 2 August 2026
    50(3) Emotion recognition and biometric categorization Deployers Inform the people exposed to the system Applies since 2 August 2026
    50(4) Deepfakes and public-interest text Deployers Disclose that deepfake image, audio or video content is artificial. Disclose AI-generated or manipulated text published to inform the public on matters of public interest, unless it has had human review or editorial control and someone holds editorial responsibility. Evidently artistic, satirical or fictional works get a lighter disclosure Applies since 2 August 2026

    Under Article 50(5), the information must be clear, distinguishable and accessible, and given at the latest at the first interaction or exposure.

    Grace period. The Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026) gives generative systems already on the market before 2 August 2026 until 2 December 2026 to meet the 50(2) marking duty. Systems placed on the market on or after 2 August 2026 get no grace period. Neither do the other three duties.

    Penalties. Breaches of Article 50 fall under Article 99(4): fines of up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (the lower of the two for SMEs).

    The Code of Practice on marking and labelling

    The Commission published the final Code of Practice on Transparency of AI-generated Content on 10 June 2026, after a first draft in late 2025 and a second on 5 March 2026. The Commission and the AI Board confirmed its adequacy on 8 and 9 July 2026. It is voluntary, and signing it is a way to demonstrate compliance with Articles 50(2) and 50(4), not proof of it.

    • Providers (Section 1). Mark outputs with at least two machine-readable layers: digitally signed, time-stamped metadata (in practice, C2PA content credentials) plus an imperceptible watermark. Fingerprinting or logging may be added but is not sufficient alone. Free-form text over 200 tokens must be watermarked. Providers must preserve markings, prohibit tampering in their terms, offer a free detection tool (with a limited fee allowed for providers under one million monthly users facing high costs), and have a watermark-detection interoperability solution by 2 February 2027.
    • Deployers (Section 2). Label deepfakes and public-interest text with a common EU icon carrying the capitalized acronym "AI". Adding "generated" or "modified" is encouraged but optional. Audio-only content needs an audible disclaimer at the start. Labels must be visible at first exposure without further interaction. Deployers need an internal process to apply labels, train staff and fix mislabelled content on substantiated reports. Publishers of AI-generated text who are not regulated media must name the person with editorial responsibility.

    The Commission adopted final Guidelines on Article 50 on 20 July 2026 (draft 8 May 2026). They clarify scope questions such as what counts as a deepfake. Resemblance to a real person, object or event that would falsely appear authentic is judged from the audience's point of view, not the creator's intent.

    EU AI Act transparency beyond Article 50

    • Article 13: transparency to deployers. High-risk systems must be designed so deployers can interpret the output and use it appropriately, and must ship with instructions for use. Those cover the provider's identity, intended purpose, accuracy metrics, known limitations and foreseeable misuse, performance on specific groups, human oversight measures, and logging. This applies on the high-risk timetable: 2 December 2027 for Annex III systems and 2 August 2028 for AI in products covered by Annex I. Deployers can request it from vendors ahead of that date.
    • Article 49: registration. High-risk systems must be registered in a public EU database before they are placed on the market or put into service.
    • Article 53: general-purpose AI models. GPAI providers must keep technical documentation, give downstream providers the information they need, and publish a summary of training content using the AI Office's template, published 24 July 2025. The template asks for data modalities and sizes, main datasets, a narrative of scraped sources including the top domains, and how opt-outs and copyright were handled. The obligations have applied since 2 August 2025. The Commission's enforcement powers began on 2 August 2026, and models placed on the market before 2 August 2025 must comply by 2 August 2027.

    California: SB 942, AB 853, AB 2013 and SB 53

    Status as of October 2026:

    • AI Transparency Act (SB 942, as amended by AB 853). It applies to "covered providers": generative AI systems producing image, video or audio content, with more than one million monthly visitors or users and publicly accessible in California. They must embed a latent (machine-readable) disclosure in generated content, offer users the option of a manifest (visible) disclosure, and provide a free public AI detection tool. They must also contractually require licensees to keep the disclosure capability, and revoke the licence within 96 hours if a licensee removes it. Penalties are USD 5,000 per violation, per day of violation. The law was originally due on 1 January 2026. AB 853, signed on 13 October 2025, moved the operative date to 2 August 2026. It also added duties for large online platforms and generative AI hosting platforms from 1 January 2027, and for capture-device manufacturers (cameras, phones) from 1 January 2028.
    • AB 2013 (training data transparency). In force since 1 January 2026. Developers of generative AI systems available to Californians must post high-level documentation of the data used to train them.
    • SB 53 (Transparency in Frontier AI Act). Signed 29 September 2025, in force since 1 January 2026. Large frontier developers must publish a frontier AI framework and transparency reports for new frontier models, and report critical safety incidents to the state.

    These state laws sit under federal pressure. Executive Order 14365 (December 2025) directs federal action against state AI laws, and the DOJ AI Litigation Task Force was formalized on 9 January 2026. State laws remain binding unless a court or Congress displaces them.

    Canada: what applies as of October 2026

    Canada has no general AI transparency statute, but the obligations are more extensive than most organizations assume.

    • Federal government. The Directive on Automated Decision-Making requires notice before automated decisions, a meaningful explanation afterwards, and publication of Algorithmic Impact Assessment results. It was amended on 24 June 2025 to strengthen transparency and senior accountability, and existing systems had until 24 June 2026 to comply. On 28 November 2025 the government launched its first federal AI Register, listing more than 400 AI systems across 42 institutions. The Treasury Board Guide on the use of generative AI asks institutions to tell users when content or interactions are AI-generated.
    • Quebec. Section 12.1 of the private sector privacy act, as amended by Law 25 and in force since 22 September 2023, requires organizations to inform a person when a decision about them is based exclusively on automated processing. On request, they must also explain the personal information used, the reasons and principal factors behind the decision, and the person's right to have it reviewed.
    • Ontario. Since 1 January 2026, employers with 25 or more employees must state in publicly advertised job postings whether they use AI to screen, assess or select applicants (Employment Standards Act, 2000, s. 8.4).
    • Voluntary and privacy-regulator guidance. The federal Voluntary Code of Conduct on generative AI (2023) commits signatories to transparency, including ways to identify AI-generated content. The privacy commissioners' principles for generative AI set openness expectations under existing privacy law.
    • What is coming. The national AI strategy, AI for All (4 June 2026), commits to "improving AI transparency" and to watermarking AI-generated content. Bill C-34, the Safe Social Media Act (tabled 10 June 2026), includes AI chatbot duties such as a ban on chatbots posing as humans and crisis-intervention requirements. Bill C-36, the Protecting Privacy and Consumer Data Act (tabled 15 June 2026), would replace PIPEDA. As of October 2026, neither is law, and no general AI transparency statute has been enacted.

    Model cards, system cards and datasheets

    Voluntary documentation predates the law and is still where most practical transparency lives.

    • Model cards (Mitchell et al., 2019) describe a model's intended uses and out-of-scope uses, training data, evaluation results (including disaggregated performance across groups), limitations and ethical considerations.
    • Datasheets for datasets (Gebru et al.) do the same for training data: motivation, composition, collection process, labelling, recommended uses and maintenance.
    • System cards extend the idea to a deployed system. Frontier labs now publish them for major releases, covering safety evaluations, red-teaming and safeguards.

    Quality varies widely. Stanford's 2025 Foundation Model Transparency Index scored 13 major developers and found the average fell from 58 out of 100 in 2024 to 40 in 2025. Developers were least transparent about training data, training compute, and post-deployment use and impact.

    The limits of transparency

    • Disclosure fatigue. Labels applied to everything tend to be ignored. Disclosure is most effective at the moments where it changes a decision.
    • Security trade-offs. Publishing system prompts, guardrail logic or detection thresholds helps attackers. See OWASP Top 10 for LLMs. Transparency to regulators and auditors can be deeper than transparency to the public.
    • Trade secrets. These are legitimate but not absolute. In Dun & Bradstreet Austria (C-203/22, February 2025), the EU Court of Justice held that where a controller claims trade secrecy, the information goes to the court or authority, which balances it against the individual's rights. See explainable AI.
    • Transparency without accountability. A published model card does not make anyone answerable for a harmful outcome. Disclosure is necessary and not sufficient.

    Building a transparency program

    1. Inventory and classify. For each AI system, record whether it interacts with people, generates content, makes or supports decisions about people, or is high-risk. Each answer triggers different duties.
    2. Map obligations by jurisdiction. EU Article 50 and Article 13, California SB 942, AB 2013 and SB 53, Quebec s. 12.1, Ontario job postings, sector rules.
    3. Standardize notices and labels. Use the EU icon and C2PA rather than bespoke marks, and write notices in plain language.
    4. Demand vendor transparency. Contract for instructions for use, model or system cards, change notifications and marking capabilities.
    5. Test it. Check that labels survive download, re-encoding and re-upload, and that chatbot notices appear on every channel, voice included.
    6. Keep the records. What was disclosed, where, when and to whom.

    For individual decisions, see what is explainable AI (XAI)?. For who answers when disclosure is not enough, see AI accountability. For the personal data side, see AI privacy. For synthetic media threats, see deepfakes and AI identity fraud. For the full regulation, see the EU AI Act.

    Sources and references

    Frequently asked questions

    What is AI transparency?

    AI transparency is disclosing when AI is being used, what it is, how it was built, and what it can and cannot do, to the people who need that information: users, affected individuals, deployers, auditors and regulators. It ranges from a chatbot notice to technical documentation and machine-readable labels on AI-generated content.

    What is the difference between AI transparency and explainability?

    Transparency is about the system: that AI is used, how it was built, its data, purpose and limits. Explainability is about a specific output: why the system produced this result for this input. A system can be fully disclosed and still unable to explain an individual decision, and the law increasingly asks for both.

    What does Article 50 of the EU AI Act require?

    Since 2 August 2026, providers must tell people they are interacting with an AI system unless it is obvious, and must mark synthetic audio, image, video and text in a machine-readable, detectable way. Deployers must inform people exposed to emotion recognition or biometric categorization, and must disclose deepfakes and AI-generated text published to inform the public on matters of public interest. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the marking duty.

    Do I have to label AI-generated content?

    In the EU, deployers must label deepfakes and AI-generated text published on matters of public interest, unless a human has editorially reviewed the text and someone holds editorial responsibility. Providers must machine-mark all synthetic output. In California, large generative AI providers must embed latent provenance data in images, video and audio and offer a free detection tool. Ordinary internal or marketing use of AI-assisted text is not generally subject to a labelling duty.

    Does the California AI Transparency Act apply to my business?

    Its core duties apply to covered providers: those whose generative AI system producing image, video or audio content has more than one million monthly visitors or users and is publicly accessible in California. As amended by AB 853, those duties became operative on 2 August 2026. Duties for large online platforms and model-hosting platforms start on 1 January 2027, and for capture-device makers on 1 January 2028.

    What is a model card?

    A model card is a short document published with a machine learning model that describes its intended use, out-of-scope uses, training data, evaluation results including performance across groups, limitations and ethical considerations. System cards extend the idea to a whole deployed system, including safety testing and safeguards.

    Is AI transparency required in Canada?

    There is no general federal AI transparency law yet, but specific duties exist. Federal institutions must give notice and explanations under the Directive on Automated Decision-Making. Quebec's Law 25 requires notice of decisions made exclusively by automated processing. Ontario requires employers with 25 or more employees to disclose AI use in publicly advertised job postings from 1 January 2026. The June 2026 national AI strategy commits to further transparency and watermarking measures, and Bill C-34, tabled in June 2026 and not yet law, would add duties for AI chatbots.

    Share on LinkedIn