Module 4: EU AI Act Deep Dive

5. Limited Risk: Transparency Obligations

Next →

Capsule description

Limited Risk is the category with the lightest obligations: mostly transparency. But that doesn't make them ignorable — non-compliance still triggers fines.

The systems in this category: chatbots, deepfakes, emotion recognition (where permitted), biometric categorization (where permitted).

This capsule covers each one with its specific transparency requirements + engineering implementation.

Category 1: Chatbots and interactive AI

What the Act asks for

Art. 50: "Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system."

The engineering action

The disclosure must be:

  • Clear: the user knows it's AI, not a human.
  • Visible: not hidden in fine print.
  • Timely: at the start of the interaction, not after.

Implementations:

<!-- Web chatbot -->
<div class="chat-header">
  <p>💬 You're chatting with our AI assistant. <a href="/privacy">Learn more</a></p>
</div>
# Voice assistant intro
"Hi! I'm Aria, your AI assistant from ACME Corp. How can I help?"
# API conversation
return {
    'response': llm_output,
    'metadata': {
        'is_ai_generated': True,
        'model': 'gpt-4',
        'disclaimer': 'Response generated by AI'
    }
}

Exceptions

Disclosure is NOT required when:

  • The use is legally authorized (e.g., undercover police investigations).
  • It's obvious from context (debatable; the conservative default = always disclose).

Category 2: Deepfakes and AI-generated content

What the Act asks for

Art. 50(4): when AI generates or manipulates image, audio, or video content that resembles existing persons, places, or events and that could mislead observers as to its authenticity, deployers must disclose that the content is AI-generated.

The engineering action

Forms of disclosure:

  1. Watermarking: an invisible technical marker embedded in the content.
  2. Visible labeling: an "AI-generated" caption or watermark.
  3. Metadata: structured data indicating the AI origin.
# When generating an image
def generate_image(prompt):
    image = ai_image_generator.generate(prompt)
    
    # Add watermark
    image = add_watermark(image, "AI-generated")
    
    # Add metadata
    image.metadata['ai_generated'] = True
    image.metadata['generation_tool'] = 'DALL-E 3'
    
    return image
# When publishing content
def publish_post(content, is_ai_generated):
    if is_ai_generated:
        content = f"[AI-generated content]\n\n{content}"
    publish(content)

Exceptions

  • Artistic expression (clearly creative work).
  • Authorized law enforcement.
  • Where it's obvious: parody, fiction.

For most commercial uses, disclose.

Category 3: Emotion recognition (where permitted)

Remember: prohibited in the workplace and education (capsule 02). Where NOT prohibited (medical, consumer apps), it's still high-risk OR limited risk depending on the context.

If limited risk

Disclosure: users must know they're subject to emotion recognition.

# Consumer app with emotion recognition
def request_consent():
    return show_dialog("""
    This app analyzes your facial expressions to provide better recommendations.
    
    Would you like to enable this feature?
    
    [Enable]  [Skip]  [Learn more]
    """)

Default OFF. Opt-in only. Easy to disable.

Category 4: Biometric categorization (where permitted)

Remember: prohibited when it categorizes based on sensitive attributes (capsule 02).

Otherwise, limited risk → disclosure.

# Retail demographic analysis (legal in some contexts)
def biometric_categorization_disclosure():
    return """
    For analytics purposes, our systems may estimate demographic characteristics
    (age range, gender) from camera footage. No personal identification is performed.
    Data is aggregated and anonymized.
    
    If you don't wish to be subject to this, please contact [privacy@acme.com].
    """

An implementation pattern: layered disclosure

For multiple AI features, use a layered approach:

Level 1: Always visible
   "AI features are used here"
   
Level 2: Click to expand
   "Specifically: chatbot, recommendations, content generation"
   
Level 3: Detailed (click further)
   "Chatbot: GPT-4 based, see model card"
   "Recommendations: collaborative filtering"
   "Content generation: only when explicitly requested"

The user can dive as deep as they want.

When high-risk and limited risk overlap

A high-risk AI may also include limited-risk features. Both apply.

Example: a medical chatbot.

  • High-risk: medical advice = an essential service.
  • Limited risk: a chatbot = transparency required.

Comply with both: full high-risk obligations + chatbot disclosure.

Common traps

1. Buried disclosure

Putting "this is AI" in a 10-page Terms of Service. Not visible = not disclosure.

2. Late disclosure

Showing the AI disclosure after the first response. The user already engaged thinking it was a human.

3. Avoiding the word "AI"

"Smart assistant," "automated system," "virtual helper." The user doesn't realize it's AI. Use the word "AI" or "artificial intelligence" explicitly.

4. Skipping deepfake disclosure for "obvious" cases

What seems obvious to the creator may not be obvious to the viewer. Default to disclosing.

5. Treating opt-in as opt-out

A pre-checked "enable emotion recognition" violates the default-off principle.

Self-check

1. How do you distinguish effective disclosure from cosmetic disclosure?

Effective disclosure:

  • Visible at the point of interaction (not buried).
  • Clear language ("AI" or "artificial intelligence," not euphemisms).
  • Timely (before the user engages, not after).
  • Specific about what the AI does.

Cosmetic:

  • Hidden in the Terms of Service.
  • Vague language ("automated system").
  • After the user has engaged.
  • A generic disclaimer.

The test: would a typical user, after seeing your disclosure, accurately describe to a friend that they're using AI? If yes, it's effective. If no, it's cosmetic.

GDPR's transparency requirements have been broadly interpreted. The EU AI Act will likely follow the same logic. Regulators see through cosmetic disclosure.

2. When is deepfake disclosure NOT required?

The exceptions:

  1. Artistic expression: clearly creative work where authenticity isn't implied. (e.g., movie special effects, art installations.)

  2. Authorized law enforcement: undercover operations.

  3. Where it's obviously fictional: clear parody, comedy, satire.

But "obvious" is subjective. The conservative interpretation: when in doubt, disclose. The cost is minimal, the exposure significant.

For commercial/general use:

  • News content: always disclose.
  • Marketing: disclose.
  • Social media posts: disclose.
  • AI-generated thumbnails: disclose.

When you might NOT need to disclose (controversial):

  • Stock photos that are already AI-generated and used as a background.
  • Filters in consumer photo apps (debatable).
  • Auto-completed suggestions (typically not generative content).

Even in unclear cases, building the disclosure mechanisms costs little. Choose to disclose.

Summary and next step

  • Limited Risk = primarily transparency obligations.
  • Chatbots: disclose the AI nature clearly, visibly, and in a timely way.
  • Deepfakes/AI content: label, watermark, metadata.
  • Emotion recognition (where permitted): disclosure + opt-in.
  • Biometric categorization (where permitted): disclosure.
  • Layered disclosure patterns balance brevity with detail.

Bridge: capsule 06 covers Minimal Risk + General Purpose AI — the rest of the Act, including the foundation model rules.

Resources

  1. EU AI Act Art. 50 — Transparency obligations — the text.

Next: 06-minimal-risk-gpai.md — Minimal Risk and GPAI.

Capsule 05 of 08 — Module 4 — AI Ethics & Compliance Guide

← Previous4. High-Risk Obligations: The 6 RequirementsNext →6. Minimal Risk and General Purpose AI