AI Disclosure: What You Legally Have to Tell Clients & Their Customers

There is a quiet assumption baked into a lot of agency work: that a convincing AI is a better AI. When it comes to disclosure, the law increasingly says the opposite. Under EU AI Act Article 50, transparency obligations require disclosing AI interaction and AI-generated content in defined cases, and those rules ride alongside the Act becoming fully applicable on 2 August 2026. In the US, the FCC has treated AI-generated voices as "artificial or prerecorded voice" under the TCPA and has a 2026 AI-call disclosure rule proposed. The direction is unmistakable: people are entitled to know when they are dealing with a machine.

This post is general information, not legal advice. Disclosure rules vary by channel, jurisdiction, and use case, so confirm your specific obligations with a qualified attorney before you ship.

Why disclosure is becoming non-negotiable

Transparency sits at the heart of both the EU and US approaches, for the same reason: undisclosed AI erodes the ability of a person to make an informed choice. A customer who thinks they are chatting with a human may share things they would not share with a bot. A voter or consumer who hears a synthetic voice they believe is real can be manipulated. The regulators' answer is disclosure, and for agencies that means the build is not done until the "this is AI" signal is in place.

The stakes differ by regime. In the EU, Article 50 is a transparency obligation within a risk-based framework. In the US, TCPA liability is strict and mechanical, $500 to $1,500 per violation, which turns a missing voice disclosure into a per-call math problem that scales alarmingly fast.

Chat: when a chatbot must announce itself

Under Article 50, systems that interact with people generally need to make clear that the person is dealing with an AI, unless it is obvious from the context. For a support widget, a lead-qualification bot, or a booking assistant, that usually means a plain statement at the start of the conversation. The disclosure should be visible, not buried in a terms link, and written in language the user actually reads.

The practical build note: put the disclosure in the opening message and keep it honest even when the bot is impressively human. "You're chatting with an AI assistant" costs you almost nothing and removes a whole category of risk. If a client resists because they think it hurts conversion, the data rarely supports that fear, and the legal exposure of hiding it is not worth the marginal lift.

Voice: the highest-risk channel in the US

AI voice is where disclosure carries the sharpest teeth. The FCC has made clear that AI-generated voices count as artificial or prerecorded voice under the TCPA, which means prior express consent is required for many calls, and violations are strictly liable at $500 to $1,500 each. A proposed 2026 rule would add explicit AI-call disclosure requirements on top of the consent regime.

For agencies deploying outbound voice agents, this is the area to be most careful. Build consent capture and a clear AI disclosure into the call flow, and keep records of both. The economics are brutal if you get it wrong: a single campaign can generate thousands of calls, and at up to $1,500 per violation, exposure can exceed a year of retainers in an afternoon. We go deeper on this in our AI voice agent TCPA compliance guide.

Content: labeling AI-generated media

Article 50 also addresses AI-generated content, requiring disclosure in defined cases, particularly for synthetic media and content that could mislead. For agencies producing AI-written articles, generated images, or synthetic audio and video on a client's behalf, the safe posture is to label content as AI-generated where the rules call for it and to build that labeling into the publishing workflow rather than adding it manually.

The nuance is that not all content triggers a disclosure obligation, and the exact contours depend on the use case. Deepfake-style synthetic media is treated more strictly than an AI-assisted product description. This is a good place to get specific legal input, because over-labeling is harmless but under-labeling can be a violation.

Email and outbound: the gray zone

Email sits in a less codified space than voice, but the same principle of honesty applies, and other laws still govern it. Automated cold outbound must respect anti-spam rules, accurate sender identification, and unsubscribe mechanics regardless of whether AI wrote the copy. Where AI generates the message, transparency norms and platform policies are tightening, and a client whose deliverability depends on trust is not served by deception.

The pragmatic stance for agencies: treat AI-drafted outbound like any other outbound for legal purposes, keep sender identity accurate, honor opt-outs, and avoid implying a personal human touch that is not there. The transparency habit you build for chat and voice should carry into email as a matter of consistency.

Building disclosure in, not bolting it on

The recurring lesson across every channel is that disclosure is a design decision, not a checkbox at launch. Decide the disclosure language during the build, put it where users will actually see or hear it, and keep the records that prove it was present. When you demonstrate a system to a client, showing the disclosure live builds trust and sets the expectation that it stays in. A platform like Ciela lets you walk a prospect through exactly how the disclosed experience feels, which makes it easier to sell the honest version rather than the sneaky one.

Bake the disclosure requirements into your intake, too. Knowing a client's channels and end markets up front tells you which rules apply, the same way our EU AI Act explainer maps risk tiers to obligations.

A short disclosure checklist for agency builds

Before any AI system ships, confirm the essentials. For chat, is there a clear AI notice at the start of the conversation? For voice, is prior express consent captured, is an AI disclosure present, and are both logged? For content, is AI-generated media labeled where the rules require it? For email, is sender identity accurate and are opt-outs honored? And across all of them, do you have records showing the disclosures were live? Run that list every time, and the transparency problem largely takes care of itself.

Disclosure is one of the cheapest forms of compliance and one of the most neglected. The agencies that make honesty the default, and can prove it, will look far more credible to clients and regulators alike. When the use case is high-stakes, especially anything involving voice or synthetic media, get a qualified attorney to confirm exactly what you must say and where.