When Do You Have to Tell Customers You Used AI?
The legal answer is narrow and moving. The commercial answer is simpler, and it is the one that will actually cost you.
Erin Moore
Fractional Chief AI Officer
Disclose when a reasonable customer would change their behaviour if they knew. That single test resolves most cases faster than a legal memo, and it happens to point the same direction as the regulation that does exist.
Nothing here is legal advice, and the statutory picture moves — verify anything specific against primary sources and your own counsel.
Where the law is actually firm
Two areas are settled enough to plan around.
You may not misrepresent what your product does. Claims about AI capability are advertising claims, and the US Federal Trade Commission's advertising and marketing guidance applies to them exactly as it applies to any other performance claim. "AI-powered" attached to something that is not, or an accuracy figure you cannot substantiate, is the ordinary kind of trouble, not a novel kind.
Some interactions must be identifiable as machine. The EU AI Act carries transparency obligations for systems that interact directly with people and for synthetic media; the official text is authoritative on scope and timing. Several other jurisdictions have chatbot-disclosure rules of their own.
Outside those, general-purpose disclosure duties are thin. Which is why the commercial test matters more.
The test that actually decides it
Would a reasonable customer behave differently if they knew? Apply it honestly and the cases sort themselves:
Disclose. A person believes they are talking to a human and is not. AI materially influences a decision about that person — credit, hiring, eligibility, pricing. Their content or data trains a model. A deliverable they are paying for as bespoke human work was substantially machine-generated.
Usually no disclosure needed. AI drafted something a named human reviewed, edited and stands behind. It routed a ticket, ranked search results, or flagged an anomaly for a person to act on. It is somewhere in your internal workflow with no bearing on what the customer receives.
The dividing line is agency, not technology. Customers care whether a machine decided something about them or replaced a human they thought they were dealing with. They do not care which tool helped draft the email.
Why silence is the expensive option
The risk is not a regulator. It is being found out by a customer who then reconsiders everything else you have told them. Disclosure costs a sentence. Discovery costs the relationship — and it arrives at the worst possible moment, usually when something has already gone wrong.
This is also the internal argument. Organisations that will not tell customers are usually not telling staff either, which is how shadow AI takes hold and why employees hide AI use.
How to say it
Plainly, near the thing it concerns, in the customer's language. "You're chatting with our AI assistant. Type 'agent' any time for a person." "This summary was generated by an AI system and reviewed by your account manager." "We use automated analysis to screen applications; every decline is reviewed by a person."
Three things to avoid. Do not bury it in terms of service — that is technically disclosure and practically concealment. Do not over-disclose everything, because a company that announces AI on every touchpoint trains customers to ignore the notice that matters. And never claim human review you are not actually performing; that is the one version of this that converts a disclosure question into a misrepresentation problem.
Your acceptable use policy should name who decides these cases, and the standing answer belongs in whatever your AI governance committee has ratified. The OECD's AI Principles frame transparency as an accountability obligation rather than a courtesy, which is the right way to hold the internal argument.
Frequently asked questions
Do we legally have to disclose AI use to customers? Rarely as a blanket duty. Firm obligations cluster around not misrepresenting capability, and around systems people interact with directly or that produce synthetic media. Requirements vary by jurisdiction and are changing — check with counsel.
What is a simple test for when to disclose? Would a reasonable customer behave differently if they knew? If yes, disclose. That covers impersonation, decisions made about the customer, training on their data, and bespoke work that was machine-generated.
Do we disclose AI that only drafts internal work? No, provided a named human reviews it and stands behind the output. Disclosure is about agency and substitution, not about which tools your staff use.
What is the biggest disclosure mistake? Claiming human review that does not happen. It turns a transparency question into a misrepresentation problem, which is a far more serious category.
Further reading
Tagged with:
Ready to Automate Your Business?
Let's discuss how AI automation can deliver measurable ROI for your organization in 90 days or sooner.