Módulo 4: EU AI Act Deep Dive

5. Limited Risk: Transparency Obligations

Siguiente →

Descripción de la cápsula

Limited Risk es la categoría con obligations más livianas: principalmente transparency. Pero no por eso ignorables — non-compliance still triggers fines.

Los sistemas in esta categoría: chatbots, deepfakes, emotion recognition (cuando permitido), biometric categorization (cuando permitido).

Esta cápsula cubre cada uno con sus specific transparency requirements + engineering implementation.

Categoría 1: Chatbots y AI Interactivo

Lo que pide el Act

Art. 50: "Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system."

Engineering action

Disclosure must be:

  • Clear: user knows it's AI, not human.
  • Visible: not hidden in fine print.
  • Timely: at start of interaction, not after.

Implementations:

<!-- Web chatbot -->
<div class="chat-header">
  <p>💬 You're chatting with our AI assistant. <a href="/privacy">Learn more</a></p>
</div>
# Voice assistant intro
"Hi! I'm Aria, your AI assistant from ACME Corp. How can I help?"
# API conversation
return {
    'response': llm_output,
    'metadata': {
        'is_ai_generated': True,
        'model': 'gpt-4',
        'disclaimer': 'Response generated by AI'
    }
}

Excepciones

Disclosure NO required cuando:

  • Use is legally authorized (e.g., undercover police investigations).
  • It's obvious from context (debatable; conservative default = always disclose).

Categoría 2: Deepfakes y AI-Generated Content

Lo que pide el Act

Art. 50(4): Cuando AI generates or manipulates image, audio, or video content that resembles existing persons, places, events y que could mislead observers as to authenticity, deployers debe disclose que content is AI-generated.

Engineering action

Disclosure forms:

  1. Watermarking: invisible technical marker embedded in content.
  2. Visible labeling: "AI-generated" caption or watermark.
  3. Metadata: structured data indicating AI origin.
# When generating image
def generate_image(prompt):
    image = ai_image_generator.generate(prompt)
    
    # Add watermark
    image = add_watermark(image, "AI-generated")
    
    # Add metadata
    image.metadata['ai_generated'] = True
    image.metadata['generation_tool'] = 'DALL-E 3'
    
    return image
# When publishing content
def publish_post(content, is_ai_generated):
    if is_ai_generated:
        content = f"[AI-generated content]\n\n{content}"
    publish(content)

Excepciones

  • Artistic expression (clearly creative work).
  • Authorized law enforcement.
  • Where it's obvious: parody, fiction.

For most commercial uses, disclose.

Categoría 3: Emotion Recognition (cuando permitido)

Recordá: prohibited en workplace y education (cápsula 02). Cuando NOT prohibited (medical, consumer apps), aún high-risk OR limited risk depending on context.

Si limited risk

Disclosure: users must know they're being subject to emotion recognition.

# Consumer app with emotion recognition
def request_consent():
    return show_dialog("""
    This app analyzes your facial expressions to provide better recommendations.
    
    Would you like to enable this feature?
    
    [Enable]  [Skip]  [Learn more]
    """)

Default OFF. Opt-in only. Easy to disable.

Categoría 4: Biometric Categorization (cuando permitido)

Recordá: prohibited cuando categoriza based on sensitive attributes (cápsula 02).

Otherwise, limited risk → disclosure.

# Retail demographic analysis (legal en some contexts)
def biometric_categorization_disclosure():
    return """
    For analytics purposes, our systems may estimate demographic characteristics
    (age range, gender) from camera footage. No personal identification is performed.
    Data is aggregated and anonymized.
    
    If you don't wish to be subject to this, please contact [privacy@acme.com].
    """

Implementation pattern: layered disclosure

For multiple AI features, layered approach:

Level 1: Always visible
   "AI features are used here"
   
Level 2: Click to expand
   "Specifically: chatbot, recommendations, content generation"
   
Level 3: Detailed (click further)
   "Chatbot: GPT-4 based, see model card"
   "Recommendations: collaborative filtering"
   "Content generation: only when explicitly requested"

User can dive as deep as desired.

Cuando high-risk + limited risk se solapan

A high-risk AI may also include limited-risk features. Both apply.

Example: medical chatbot.

  • High-risk: medical advice = essential service.
  • Limited risk: chatbot = transparency required.

Comply with both: full high-risk obligations + chatbot disclosure.

Trampas comunes

1. Buried disclosure

Putting "this is AI" in 10-page Terms of Service. Not visible = not disclosure.

2. Late disclosure

Showing AI disclosure after first response. User already engaged thinking it was human.

3. Avoiding word "AI"

"Smart assistant", "automated system", "virtual helper". User doesn't realize AI. Use the word "AI" or "artificial intelligence" explicitly.

4. Ignoring deepfake disclosure for "obvious" cases

What seems obvious to creator may not be obvious to viewer. Default to disclose.

5. Treating opt-in as opt-out

Pre-checked "enable emotion recognition" violates default-off principle.

Auto-verificación

1. ¿Cómo distinguís entre disclosure efectivo y disclosure cosmético?

Disclosure efectivo:

  • Visible at point of interaction (not buried).
  • Clear language ("AI" or "artificial intelligence", not euphemisms).
  • Timely (before user engages, not after).
  • Specific about what AI does.

Cosmético:

  • Hidden in Terms of Service.
  • Vague language ("automated system").
  • After user has engaged.
  • Generic disclaimer.

Test: would a typical user, after seeing your disclosure, accurately describe to a friend that they're using AI? If yes, effective. If no, cosmetic.

GDPR's transparency requirements have been broadly interpreted. EU AI Act will likely follow same logic. Regulators see through cosmetic disclosure.

2. ¿Cuándo deepfake disclosure NO es required?

Excepciones:

  1. Artistic expression: clearly creative work where authenticity is not implied. (e.g., movie special effects, art installations.)

  2. Authorized law enforcement: undercover operations.

  3. Where it's obviously fictional: clear parody, comedy, satire.

But "obvious" is subjective. Conservative interpretation: when in doubt, disclose. Cost is minimal, exposure significant.

For commercial/general use:

  • News content: always disclose.
  • Marketing: disclose.
  • Social media posts: disclose.
  • AI-generated thumbnails: disclose.

When you might NOT need to disclose (controversial):

  • Stock photos ya AI-generated and used as background.
  • Filters in consumer photo apps (debatable).
  • Auto-completed suggestions (typically not generative content).

Even in unclear cases, building disclosure mechanisms costs little. Choose to disclose.

Resumen y siguiente paso

  • Limited Risk = transparency obligations primarily.
  • Chatbots: disclose AI nature clearly, visibly, timely.
  • Deepfakes/AI content: label, watermark, metadata.
  • Emotion recognition (when permitted): disclosure + opt-in.
  • Biometric categorization (when permitted): disclosure.
  • Layered disclosure patterns balance brevity with detail.

Puente: la cápsula 06 cubre Minimal Risk + General Purpose AI — el resto del Act, including foundation model rules.

Recursos

  1. EU AI Act Art. 50 — Transparency obligations — texto.

Siguiente: 06-minimal-risk-gpai.md — Minimal Risk y GPAI.

Cápsula 05 de 08 — Módulo 4 — AI Ethics & Compliance Guide

← Anterior4. High-Risk Obligations: Las 6 RequisitosSiguiente →6. Minimal Risk y General Purpose AI