AI Transparency Requirements

Overview

AI transparency operates at the intersection of two regulatory frameworks: the GDPR's data subject information rights (Arts. 13-14) and the EU AI Act's transparency obligations (Arts. 13-14, 50). Together they require controllers and deployers to provide meaningful, accessible information about AI system capabilities, limitations, decision logic, and personal data processing. This skill implements the combined transparency framework, addressing both the technical explainability challenge of complex ML models and the legal obligation to communicate AI processing in plain language to affected individuals.

GDPR Transparency for AI Systems

Art. 13-14 Information Requirements Applied to AI

When personal data is processed by AI systems, data subjects must receive:

Art. 13(2)(f) / 14(2)(g) — Meaningful Information About Automated Logic

This is the most challenging transparency requirement for AI systems. The EDPB and Article 29 Working Party have clarified:

What "meaningful information about the logic involved" requires:

1. System-level explanation: General description of how the AI system works — what factors are considered, what methodology is used, how the model was trained
2. Purpose and context: Why the AI system is used and what role its output plays in decisions
3. Key variables: The main data points or features that influence the AI output, without requiring disclosure of proprietary algorithms
4. Decision criteria: How the model output translates into a decision (e.g., score thresholds, classification categories)
5. Significance: What the decision means for the data subject in practical terms
6. Consequences: The potential effects (both intended and foreseeable) of the AI-driven decision

What it does not require:

• Full disclosure of source code or model weights
• Mathematical description of the algorithm
• Proprietary trade secrets (but this does not exempt from meaningful explanation)
• Explanation of individual model predictions in real-time (though this may be required under Art. 22)

Layered Approach to AI Transparency

The EDPB recommends a layered transparency approach:

EU AI Act Transparency Obligations

Art. 13 — Transparency and Provision of Information to Deployers (High-Risk)

High-risk AI systems (Annex III) must be designed and developed to ensure:

Art. 14 — Human Oversight (High-Risk)

High-risk AI systems must be designed to enable effective human oversight:

• Clear indication of AI system outputs and confidence levels
• Ability to correctly interpret AI outputs in context
• Ability to override or reverse AI decisions
• Ability to intervene or stop the system ("stop button")
• Awareness of automation bias risk

Art. 50 — Transparency for Specific AI Systems

Art. 50(1) — AI Interaction Notification

Controllers must inform natural persons that they are interacting with an AI system. This applies to:

• Chatbots and virtual assistants
• AI-powered customer service systems
• Automated email or message generation
• AI-driven recommendation systems with direct user interface
• Voice-based AI assistants

Exceptions: where it is obvious from the circumstances and context that the person is interacting with AI (e.g., a robot in a factory setting).

AI Transparency Documentation Framework

Model Card Requirements

For each deployed AI model, maintain a model card containing:

AI System Transparency Register

Organisations operating multiple AI systems should maintain a central register:

Explainability Techniques for Compliance

Global Explainability (System-Level)

Techniques for providing Art. 13(2)(f) "meaningful information about the logic":

Local Explainability (Individual Decision)

For Art. 22 right to explanation of individual decisions:

Enforcement Precedents

• Garante v. OpenAI (2023): Required transparency about AI training data processing, model capabilities, and limitations — privacy notice deemed insufficient for AI system transparency.
• CNIL v. Clearview AI (SAN-2022-019, 2022): EUR 20M fine — complete absence of transparency about facial recognition AI processing; data subjects had no notice their images were scraped and processed.
• Austrian DPA v. CRIF (DSB-D213.636, 2023): Credit scoring AI — insufficient explanation of automated decision-making logic per Art. 13(2)(f); data subject received only a score without meaningful information about factors.
• Dutch DPA v. Tax Authority (SyRI, 2020): Court found algorithmic fraud detection lacked transparency — citizens could not understand how the system assessed them, violating right to private life.
• AEPD v. CaixaBank (PS/00421/2020, 2021): EUR 6M fine — automated credit decision-making without adequate transparency about the logic involved and significance for data subjects.

Integration Points

• ai-automated-decisions: Art. 22 explanation requirements integrate with transparency obligations
• ai-dpia: Transparency assessment is part of DPIA necessity and proportionality analysis
• ai-act-high-risk-docs: Art. 13 AI Act documentation requirements overlap with transparency framework
• ai-deployment-checklist: Pre-deployment transparency validation is a checklist item