Introduction
Welcome back. In our previous lesson, we examined the comprehensive compliance framework for "high-risk" AI systems under the EU AI Act. We covered the seven pillars of compliance, from risk management to human oversight, and the conformity assessment process that providers must navigate to earn the CE marking. A key pillar we discussed was Article 13, which mandates transparency to ensure that users can understand and properly deploy these systems.
Today, we will significantly deepen our understanding of transparency, focusing on some of the most visible and impactful AI applications today. Our learning outcome is to analyze the transparency obligations for general-purpose AI and systems like chatbots and deepfakes.
This lesson explores a different layer of the AI Act's regulatory scheme. Unlike the rules for high-risk systems, which are contained in a single chapter, these transparency obligations are more targeted. They apply to systems based on their function—how they interact with us or what they create—rather than their overall risk classification. We will examine two main sets of rules:
- Downstream obligations (Article 50) for specific applications like chatbots and synthetic media.
- Upstream obligations (Article 53) for the powerful General-Purpose AI (GPAI) models that often power these applications.
Your experience in implementing chatbots and your interest in the technical underpinnings of AI will be particularly relevant as we unpack the legal requirements that govern these technologies.
A Layered Approach to Transparency
The EU AI Act recognizes that even AI systems not classified as "high-risk" can still pose specific societal risks, such as deception or the spread of misinformation. To address this, it establishes a set of specific transparency obligations.
For a quick overview of where these systems fit into the AI Act's broader risk pyramid, let's watch a short segment from the "EU's AI Act Explained" video.
This clip introduces the 'limited risk' category, which is the home for many of the systems we will discuss today, like chatbots and deepfakes.
Please watch from 01:05 to 01:32. Pay attention to the core principle of transparency mentioned for these systems.
As the video highlights, the fundamental rule for these "limited-risk" systems is transparency. Users need to know when they are interacting with AI or viewing AI-generated content. This principle is primarily codified in Article 50 of the AI Act.
To help you visualize how these rules are structured, the following diagram provides a clear map of the transparency obligations under Article 50. It usefully distinguishes between the duties of providers (those who create the AI system) and deployers (those who use the AI system in a professional capacity).
We will now use this map to explore the specific obligations for chatbots and deepfakes in more detail.
Deconstructing Article 50: Obligations for Interactive and Synthetic Content
The core of the EU's transparency regime for specific AI applications is found in Article 50. To understand its nuances, we will consult a detailed analysis of this provision.
Transparency Obligations for All AI Systems: Article 50 of ...
This paper, 'Transparency Obligations for All AI Systems,' provides a deep dive into Article 50. It's an excellent resource for understanding the legal text, its rationale, and its ambiguities, which is crucial for someone with your goal of developing deep expertise.
Please read the following sections to build a comprehensive understanding of Article 50: Introduction (pages 3-5): Focus on how transparency is defined in Recital 27. This sets the stage for the entire article. Scope of Article 50 (pages 7-8): Note the crucial point that these obligations apply based on the use case, not the system's risk classification. Section 3.1, 'Obligations Vis-à-Vis Interactive AI Systems' (pages 9-11): This covers chatbots. Pay close attention to the main obligation and its exceptions. Section 3.4, 'Deep Fakes' (pages 18-22): This details the rules for synthetic media. Understand the definition of a 'deep fake,' the disclosure requirement for deployers, and the important exemptions for art, satire, and fiction.
Based on your reading, let's break down the key obligations.
1. Interactive Systems (e.g., Chatbots)
The rule here, under Article 50(1), is straightforward and directly relevant to your consulting experience.
- Who: Providers of AI systems intended to interact directly with people.
- What: They must design their systems so that users are informed they are interacting with an AI.
- When: The information must be provided "at the latest at the time of the first interaction."
- Exceptions: This obligation does not apply if the interaction is "obvious" to a reasonably well-informed person (e.g., interacting with a robot in a factory) or for authorized law enforcement purposes.
This legal requirement formalizes the practice of including disclaimers like "I am a virtual assistant" in the chatbot systems you've helped implement. The goal is to prevent deception and impersonation.
2. Deepfakes and Synthetic Content
The AI Act creates distinct but related obligations for synthetic media, targeting different actors in the value chain.
For Providers: Marking Synthetic Content (Article 50(2))
- Who: Providers of AI systems that generate synthetic audio, image, video, or text.
- What: They must ensure the AI's output is marked in a machine-readable format (e.g., metadata, watermark) and is detectable as artificially generated or manipulated.
- Why: This creates a technical foundation for traceability, allowing other systems to identify synthetic content automatically.
For Deployers: Disclosing Deepfakes (Article 50(4))
- Who: Deployers of an AI system that generates or manipulates content constituting a "deep fake."
- What: They must disclose to the viewer that the content has been artificially generated or manipulated.
- Definition of "Deep Fake": The Act defines this as AI-generated content that resembles existing people, places, or events and would falsely appear to a person to be authentic or truthful.
- Important Exceptions: The disclosure obligation is limited for "evidently artistic, creative, satirical, fictional or analogous work." For these, disclosure must be done in a manner that "does not hamper the display or enjoyment of the work." This is a crucial carve-out to protect freedom of expression and the arts.
Test your understanding!
A political campaign team uses a powerful generative AI model to create media. Consider two scenarios:
- They use the AI to create a hyper-realistic video of their candidate walking on Mars to use in a satirical online ad.
- They use the AI to subtly manipulate a video of an opponent, making them appear to slur their words during a speech, and plan to release it anonymously online.
How do the transparency obligations under Article 50 apply to the deployer in each case?
Show answer
-
Satirical Ad: This falls under the exception for "evidently artistic, creative, satirical, [or] fictional" work. The deployer (the campaign team) still has a transparency obligation, but it's limited. They must disclose the manipulation in a way that doesn't ruin the ad's satirical effect, perhaps with a small watermark or text at the end, like "Made with AI."
-
Manipulated Opponent Video: This is a classic "deep fake." It is designed to appear authentic and truthful when it is not. The deployer has a clear and unavoidable obligation to disclose that the video has been artificially manipulated. Releasing it without this disclosure would be a direct violation of Article 50(4). The satirical/artistic exception does not apply because the intent is deceptive, not creative.
Upstream Transparency: Rules for General-Purpose AI (GPAI) Models
So far, we've focused on the applications people see. But what about the powerful foundation models that power them? The AI Act introduces a separate set of transparency rules for these General-Purpose AI (GPAI) models under Article 53. These rules are aimed at the model providers—the organizations that build and train these large-scale systems.
Taking the EU AI Act to Practice Decoding the GPAI Code ...
This article, 'Taking the EU AI Act to Practice,' explains how the high-level principles of the Act are translated into concrete actions for GPAI providers through Codes of Practice and official templates. It's a great practical guide.
Please read the following sections to understand this 'upstream' transparency: Section 2: Focus on the four core obligations for GPAI model providers under Article 53(1). Section 2.1: Understand how the GPAI Code of Practice (CoP) provides a framework for documentation and sharing information with downstream providers (e.g., a chatbot company using a GPAI). Section 2.3: Pay close attention to the requirement for a 'Training Data Summary' (TDS) and the role of the official template. This is a novel and very important transparency measure.
The key takeaway is that the AI Act imposes significant transparency duties directly on the creators of GPAI models. As you read, the two most important transparency-related obligations are:
-
Technical Documentation and Information Sharing (Art. 53(1)(a)-(b)): GPAI providers must create extensive technical documentation and provide downstream providers (who build systems on top of the GPAI model) with the information they need to understand the model's capabilities and limitations. This enables the downstream provider to build safe and compliant applications.
-
Training Data Summary (Art. 53(1)(d)): This is a landmark requirement. GPAI providers must "draw up and make publicly available a sufficiently detailed summary about the content used for training" the model. As the article explains, the official Training Data Summary (TDS) Template operationalizes this by requiring narrative descriptions of the data sources (e.g., large public datasets, licensed data, web-scraped content). This rule strikes a balance, providing public insight into what a model was trained on without forcing the disclosure of every single data point or revealing protected trade secrets.
These upstream duties are designed to ensure transparency flows down the entire AI value chain, from the foundational model to the final application.
Conclusion
In this lesson, we have analyzed the multi-faceted transparency obligations within the EU AI Act, moving beyond the general requirements for high-risk systems. You are now equipped to distinguish between the different layers of transparency rules that apply to modern AI.
Key Takeaways:
- Downstream Transparency (Article 50): The Act imposes specific disclosure duties for certain AI applications. For chatbots, users must be informed they are interacting with an AI. For deepfakes, deployers must disclose that the content is manipulated, with important exceptions for art and satire.
- Upstream Transparency (Article 53): The providers of General-Purpose AI models have their own set of transparency obligations. Most notably, they must provide technical documentation to downstream developers and publicly release a summary of the data used to train their models.
- Layered Responsibility: The AI Act strategically assigns responsibility to different actors. Providers are responsible for building-in transparency features (like machine-readable marking), while deployers are responsible for using those features to inform end-users (like disclosing a deepfake).
Preview of the Next Lesson:
We have now covered the prohibited, high-risk, and limited-risk/transparency tiers of the EU AI Act. But a crucial question remains: who do these rules actually apply to? In our next lesson, we will evaluate the extraterritorial application of the EU AI Act and its potential impact on Indian businesses. This will bring together your knowledge of the Act's substance with your background in international relations and experience working across different legal jurisdictions.