{"course":{"slug":"building-with-ai","title":"Building with AI","url":"https://addaly.com/learn/building-with-ai","level":"intermediate","track":"build"},"lesson":{"slug":"disclosure-consent-and-the-law-as-it-stands","title":"Disclosure, consent and the law as it stands","url":"https://addaly.com/learn/building-with-ai/disclosure-consent-and-the-law-as-it-stands","position":70,"of":80,"minutes":10,"answer":"The law on AI features differs by country and is still being written, but a set of minimums is safe everywhere (say it is AI on the surface, get specific consent for data use.","keyIdea":"The law on AI features differs by country and is still being written, but a set of minimums is safe everywhere (say it is AI on the surface, get specific consent for data use, offer a route to a person, make deletion real, keep records) while liability for wrong answers and copyright of outputs remain unresolved and must be presented as such."},"body":{"format":"markdown","text":"## Not legal advice, and why the shape still matters\n\nNothing in this lesson is legal advice, and no course could give it: the rules differ between the European Union, India, the United Kingdom, the United States and its individual states, and they are changing year by year. What a builder can do is know the shape of the obligations that exist, build the minimums that are safe everywhere, and recognise the questions that need a lawyer early rather than late. That is this lesson.\n\n## Telling people they are talking to a machine\n\nThe European Union's AI Act, in force since 2024 with obligations phasing in over the following years, requires that people be told when they are interacting with an AI system unless it is obvious, and that AI-generated content of certain kinds be marked as such. Some US states have bot-disclosure laws for particular uses; other jurisdictions are drafting rules along similar lines. The direction is consistent even where the detail is not.\n\nThe minimum that is safe everywhere is the one this site holds itself to: say it is AI on the surface the person is using, in words, near where they interact. Not in a policy page. Not in an icon. A sentence.\n\n## Personal data\n\nIn the EU, the General Data Protection Regulation governs: a lawful basis for processing, purpose limitation, the rights of access, correction and erasure, and an impact assessment for high-risk processing. India's Digital Personal Data Protection Act of 2023 is built around consent that is specific to a purpose, with rights to correction and erasure and a Data Protection Board; its rules were still being operationalised at the time of writing. The United Kingdom has its own version of the GDPR. The United States has no single federal law and a patchwork of state ones.\n\nWhat is safe everywhere: consent that names the purpose, a privacy notice that names the provider and the retention period (the previous lesson's three sentences) deletion that works end to end, and sending the provider no more than the task needs. The memory lesson's requirement that users can see and delete what is stored about them is not a courtesy in most of these regimes; it is an obligation.\n\n## Sectors with their own rules\n\nHealth: medical-device regulation in many countries applies when software gives clinical advice, and the United States has HIPAA for health records. Finance: the Reserve Bank of India and SEBI issue guidance on automated advice and on data; the UK's FCA and US regulators have their own. Children: the US COPPA, the UK's Children's Code, and specific provisions in the AI Act. Employment: the AI Act treats hiring and evaluation tools as high-risk, and New York City requires bias audits of automated hiring tools. If your feature touches any of these, the conversation with a lawyer happens before the architecture is fixed, because the architecture may be the compliance.\n\n## What is unsettled, presented as unsettled\n\n**Liability for a wrong answer.** In a widely reported Canadian case in 2024, an airline was held to a refund policy its chatbot had described, although no such policy existed; the tribunal treated the chatbot's statement as the company's. Whether that reasoning generalises, and to which jurisdictions, is being worked out case by case. The design lesson is clear even where the law is not: your feature's statements are your statements, and the hallucination lesson's mechanisms (grounding, citation, abstention) are also liability controls.\n\n**Copyright.** Whether training on copyrighted material is lawful, whether AI-generated output can be owned and by whom, and what happens when an output reproduces something protected are all in litigation or legislation in the US, the UK, the EU and India, with different answers emerging in each. Do not resolve this for your users. Keep records of what was generated, with which model, from which inputs, so that whatever the answer turns out to be, you can say what you did.\n\n**Provider claims.** As the earlier lesson said, you cannot verify a provider's training or retention statements. Say what you know and how you know it.\n\n## The minimums, safe everywhere\n\n1. Disclose AI on the surface.\n2. Specific consent for any data use beyond the obvious purpose; a notice that names the processor and the retention.\n3. A way to reach a person, visible, working.\n4. Deletion and export that reach every copy: conversation, traces, memory, derived artefacts.\n5. No automated decision with legal or similarly significant effect on a person without human review.\n6. Know whether minors use the product, and what that changes.\n7. Records: model versions, prompt versions, evaluation results, red-team reports, moderation decisions, incidents.\n\n## Documentation as defence\n\nThe evaluation course describes a system card. For a single feature, a one-page record does the job: purpose, data flows and provider, model and prompt versions, evaluation results and known limitations, moderation policy, red-team findings and accepted risks, incident log. Customers' security teams, auditors and regulators ask for exactly this, and a team that has it answers in a day while a team that does not spends a month reconstructing it. When the law changes (it will) that page is what makes adapting cheap, because it says what you are already doing."},"check":{"question":"A support assistant confidently describes a refund policy that does not exist, and a customer relies on it. Which design lesson follows from how such cases have been treated?","options":[{"text":"Add a disclaimer that the assistant may be wrong, which removes the company's responsibility for its statements and shifts it to the customer who relied on them.","correct":false,"tempting":"A disclaimer has not reliably displaced responsibility in reported cases, and it does nothing to stop the wrong statement being made."},{"text":"Answer only from verified policy documents with citations, and abstain otherwise, because the assistant's statements are the company's.","correct":true},{"text":"Log every conversation so the company can prove the customer was told by a machine rather than a person.","correct":false,"tempting":"Logs establish what was said; they do not change whose statement it was."},{"text":"Route refund questions to a human, since the law forbids AI from discussing policy.","correct":false,"tempting":"No such prohibition exists; routing may be wise for some products, but the reasoning offered is invented."}]},"prev":{"slug":"red-teaming-your-own-feature","title":"Red-teaming your own feature before someone else does","url":"https://addaly.com/learn/building-with-ai/red-teaming-your-own-feature"},"next":{"slug":"the-cost-model-of-a-feature","title":"The cost model of a feature, line by line","url":"https://addaly.com/learn/building-with-ai/the-cost-model-of-a-feature"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Disclosure, consent and the law as it stands', in Building with AI. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/building-with-ai/disclosure-consent-and-the-law-as-it-stands (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Disclosure, consent and the law as it stands","courseTitle":"Building with AI","module":{"index":7,"slug":"safety-security-and-the-adversary","title":"Safety, security and the adversary"},"answer":null,"keyIdea":"The law on AI features differs by country and is still being written, but a set of minimums is safe everywhere (say it is AI on the surface, get specific consent for data use, offer a route to a person, make deletion real, keep records) while liability for wrong answers and copyright of outputs remain unresolved and must be presented as such.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"not-legal-advice-and-why-the-shape-still-matters","runs":[{"text":"Not legal advice, and why the shape still matters"}]},{"t":"p","runs":[{"text":"Nothing in this lesson is legal advice, and no course could give it: the rules differ between the European Union, India, the United Kingdom, the United States and its individual states, and they are changing year by year. What a builder can do is know the shape of the obligations that exist, build the minimums that are safe everywhere, and recognise the questions that need a lawyer early rather than late. That is this lesson."}]},{"t":"h2","id":"telling-people-they-are-talking-to-a-machine","runs":[{"text":"Telling people they are talking to a machine"}]},{"t":"p","runs":[{"text":"The European Union’s AI Act, in force since 2024 with obligations phasing in over the following years, requires that people be told when they are interacting with an AI system unless it is obvious, and that AI-generated content of certain kinds be marked as such. Some US states have bot-disclosure laws for particular uses; other jurisdictions are drafting rules along similar lines. The direction is consistent even where the detail is not."}]},{"t":"p","runs":[{"text":"The minimum that is safe everywhere is the one this site holds itself to: say it is AI on the surface the person is using, in words, near where they interact. Not in a policy page. Not in an icon. A sentence."}]},{"t":"h2","id":"personal-data","runs":[{"text":"Personal data"}]},{"t":"p","runs":[{"text":"In the EU, the General Data Protection Regulation governs: a lawful basis for processing, purpose limitation, the rights of access, correction and erasure, and an impact assessment for high-risk processing. India’s Digital Personal Data Protection Act of 2023 is built around consent that is specific to a purpose, with rights to correction and erasure and a Data Protection Board; its rules were still being operationalised at the time of writing. The United Kingdom has its own version of the GDPR. The United States has no single federal law and a patchwork of state ones."}]},{"t":"p","runs":[{"text":"What is safe everywhere: consent that names the purpose, a privacy notice that names the provider and the retention period (the previous lesson’s three sentences) deletion that works end to end, and sending the provider no more than the task needs. The memory lesson’s requirement that users can see and delete what is stored about them is not a courtesy in most of these regimes; it is an obligation."}]},{"t":"h2","id":"sectors-with-their-own-rules","runs":[{"text":"Sectors with their own rules"}]},{"t":"p","runs":[{"text":"Health: medical-device regulation in many countries applies when software gives clinical advice, and the United States has HIPAA for health records. Finance: the Reserve Bank of India and SEBI issue guidance on automated advice and on data; the UK’s FCA and US regulators have their own. Children: the US COPPA, the UK’s Children’s Code, and specific provisions in the AI Act. Employment: the AI Act treats hiring and evaluation tools as high-risk, and New York City requires bias audits of automated hiring tools. If your feature touches any of these, the conversation with a lawyer happens before the architecture is fixed, because the architecture may be the compliance."}]},{"t":"h2","id":"what-is-unsettled-presented-as-unsettled","runs":[{"text":"What is unsettled, presented as unsettled"}]},{"t":"p","runs":[{"text":"Liability for a wrong answer.","b":true},{"text":" In a widely reported Canadian case in 2024, an airline was held to a refund policy its chatbot had described, although no such policy existed; the tribunal treated the chatbot’s statement as the company’s. Whether that reasoning generalises, and to which jurisdictions, is being worked out case by case. The design lesson is clear even where the law is not: your feature’s statements are your statements, and the hallucination lesson’s mechanisms (grounding, citation, abstention) are also liability controls."}]},{"t":"p","runs":[{"text":"Copyright.","b":true},{"text":" Whether training on copyrighted material is lawful, whether AI-generated output can be owned and by whom, and what happens when an output reproduces something protected are all in litigation or legislation in the US, the UK, the EU and India, with different answers emerging in each. Do not resolve this for your users. Keep records of what was generated, with which model, from which inputs, so that whatever the answer turns out to be, you can say what you did."}]},{"t":"p","runs":[{"text":"Provider claims.","b":true},{"text":" As the earlier lesson said, you cannot verify a provider’s training or retention statements. Say what you know and how you know it."}]},{"t":"h2","id":"the-minimums-safe-everywhere","runs":[{"text":"The minimums, safe everywhere"}]},{"t":"ol","start":1,"items":[[{"text":"Disclose AI on the surface."}],[{"text":"Specific consent for any data use beyond the obvious purpose; a notice that names the processor and the retention."}],[{"text":"A way to reach a person, visible, working."}],[{"text":"Deletion and export that reach every copy: conversation, traces, memory, derived artefacts."}],[{"text":"No automated decision with legal or similarly significant effect on a person without human review."}],[{"text":"Know whether minors use the product, and what that changes."}],[{"text":"Records: model versions, prompt versions, evaluation results, red-team reports, moderation decisions, incidents."}]]},{"t":"h2","id":"documentation-as-defence","runs":[{"text":"Documentation as defence"}]},{"t":"p","runs":[{"text":"The evaluation course describes a system card. For a single feature, a one-page record does the job: purpose, data flows and provider, model and prompt versions, evaluation results and known limitations, moderation policy, red-team findings and accepted risks, incident log. Customers’ security teams, auditors and regulators ask for exactly this, and a team that has it answers in a day while a team that does not spends a month reconstructing it. When the law changes (it will) that page is what makes adapting cheap, because it says what you are already doing."}]}],"check":{"question":[{"text":"A support assistant confidently describes a refund policy that does not exist, and a customer relies on it. Which design lesson follows from how such cases have been treated?"}],"options":[{"text":[{"text":"Add a disclaimer that the assistant may be wrong, which removes the company’s responsibility for its statements and shifts it to the customer who relied on them."}],"correct":false,"tempting":[{"text":"A disclaimer has not reliably displaced responsibility in reported cases, and it does nothing to stop the wrong statement being made."}]},{"text":[{"text":"Answer only from verified policy documents with citations, and abstain otherwise, because the assistant’s statements are the company’s."}],"correct":true,"tempting":null},{"text":[{"text":"Log every conversation so the company can prove the customer was told by a machine rather than a person."}],"correct":false,"tempting":[{"text":"Logs establish what was said; they do not change whose statement it was."}]},{"text":[{"text":"Route refund questions to a human, since the law forbids AI from discussing policy."}],"correct":false,"tempting":[{"text":"No such prohibition exists; routing may be wise for some products, but the reasoning offered is invented."}]}],"order":[3,2,0,1],"why":null},"prev":{"slug":"red-teaming-your-own-feature","title":"Red-teaming your own feature before someone else does","minutes":9},"next":{"slug":"the-cost-model-of-a-feature","title":"The cost model of a feature, line by line","minutes":9}}}