The four extra disclosures AI products need
- Whether prompts and outputs are used for training. If yes, disclose explicitly and provide an opt-out — the EU and California regulators are watching.
- Which foundation models you call. Name the provider (OpenAI, Anthropic, Google, Mistral) and link to their data-handling docs.
- Retention of prompt logs. Default OpenAI Enterprise retention is 30 days unless you opt for zero-retention; disclose your tier.
- Automated decision-making notice (GDPR Article 22). If a model output materially affects the user without a human in the loop, you must say so.
EU AI Act transparency duties
The EU AI Act (Regulation (EU) 2024/1689) entered into force in August 2024 with a phased application. From August 2026 onward, deployers of high-risk AI must keep technical documentation and inform affected users. From August 2025, general-purpose AI providers must publish a summary of training data. Your privacy policy is a good place to surface those notices for end users.