Transparency & Documentation

EU AI Act: Art. 13 (Instructions for use), Art. 50 (Transparency for certain AI systems), Art. 53 (Obligations for providers of general-purpose AI models)
NIST AI RMF: GOVERN-1.3 (Documented policies), MAP-2.1 (Context documentation), Explainable and Interpretable (trustworthiness characteristic)
ISO 42001: A.10.3 (Communication)
GDPR: Art. 12–14 (Transparent information to data subjects)

Disclosure Obligations by System Type

System Type	Article	Requirement	Timing
High-Risk AI	Art. 13	Instructions for use: identity, purpose, capabilities/limitations, accuracy, human oversight, maintenance, logs	At deployment
Chatbots / Conversational agents	Art. 50(1)	Inform users they interact with AI	First interaction
Emotion recognition	Art. 50(2)	Inform natural persons	Before processing
Biometric categorisation	Art. 50(3)	Inform natural persons	Before processing
Deepfake / synthetic content	Art. 50(4)	Disclose AI-generated/manipulated	At generation/dissemination
GPAI (All)	Art. 53(1)(a)–(d)	Technical documentation; information for downstream providers; copyright policy; public summary of training content	On request (downstream) / Public
GPAI — Systemic Risk	Art. 55	Model evaluation; adversarial testing; incident reporting; cybersecurity	Pre-market + ongoing

Primary source: Regulation (EU) 2024/1689, Arts. 13, 50, 53, 55. EUR-Lex

Note: Art. 52 is Procedure (notification of general-purpose AI models meeting the systemic-risk threshold), not a transparency obligation. GPAI documentation, copyright-policy and training-content-summary duties are Art. 53(1).

System Card (EU AI Act Annex IV)

Section	Required Content
1. Identification	System name, version, provider, intended purpose, deployment context
2. Risk Classification	Prohibited / High-risk (Annex III ref) / Limited / Minimal
3. Architecture	Components, data flows, model types, integration points
4. Training Data	Sources, volumes, preprocessing, bias assessment, provenance, licensing
5. Model Details	Architecture, framework, hyperparameters, training compute, hardware
6. Performance	Accuracy, robustness, fairness, latency, throughput (with 95% CIs)
7. Risk Assessment	Summary of risk register; residual risks accepted with justification
8. Human Oversight	Mechanisms, escalation paths, fallback procedures
9. Monitoring & Logging	Metrics collected, retention, alerting thresholds
10. Incident Response	IR plan reference; serious incident notification procedure
11. Supply Chain	Third-party components, SBOM references, SLSA levels
12. Conformity	Assessment route (self / notified body); certificate reference
13. Post-Market	Monitoring plan; update/decommission criteria

Format: PDF + machine-readable JSON/YAML. Storage: NestVault365 / Git with signed commits.

Model Card (Mitchell et al. / Google Model Cards)

Section	Content
Model Details	Name, version, architecture, framework, licence, date, contact
Intended Use	Primary uses, out-of-scope uses, user demographics
Factors	Relevant groups, environments, evaluation conditions
Metrics	Per-factor performance (accuracy, F1, fairness, robustness) with 95% CIs
Evaluation Data	Datasets, splits, preprocessing, known limitations
Training Data	Sources, size, preprocessing, known biases, licensing
Quantitative Analyses	Per-factor breakdowns, intersectional, adversarial robustness
Ethical Considerations	Bias, privacy, safety, environmental impact
Caveats	Known failure modes, monitoring needs, update cadence

Data Sheet (Gebru et al. "Datasheets for Datasets")

Section	Content
Motivation	Purpose, creators, funding
Composition	Instances, features, labels, recommended splits
Collection	Source, method, timeframe, consent, ethics review
Preprocessing	Cleaning, transformation, filtering, augmentation
Uses	Recommended, out-of-scope, fairness considerations
Distribution	Licence, access restrictions, DOI/URL
Maintenance	Update cadence, versioning, contact

User-Facing Transparency (Art. 50 / 53)

Requirement	Implementation
Inform users they interact with AI	Persistent UI indicator ("AI Assistant"); clear onboarding
Label synthetic content	Visible watermark (images/video); audible tone (audio); C2PA metadata
GPAI training data summary	Publicly accessible: main datasets, volume, provenance, licences
GPAI copyright policy	Public statement: opt-out mechanism, DSM Directive Art. 4 compliance
Systemic-risk GPAI: model card	Public: evaluation, adversarial testing, incident summary

NIST AI RMF Transparency Alignment

RMF Subcategory	Transparency Action
GOVERN-1.3	Document policies, roles, risk appetite; publish summary
MAP-2.1	Document context, stakeholders, assumptions; share with assessors
MEASURE-3.3	Report metrics, drift, incidents to governance body
MANAGE-4.3	Communicate residual risks to affected stakeholders

ISO 42001 A.10.3 Communication

Requirement	Implementation
Internal	AI policy, risk register, incident reports accessible to authorised roles
External	Conformity statement, system card summary, contact for inquiries
Interested Parties	Regulators, customers, auditors, data subjects — tailored artefacts

Citation Register

Claim	Instrument	Provision	URL
High-risk instructions	EU AI Act	Art. 13	https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Limited-risk transparency	EU AI Act	Art. 50	https://eur-lex.europa.eu/eli/reg/2024/1689/oj
GPAI provider obligations	EU AI Act	Art. 53(1)	https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Systemic-risk GPAI	EU AI Act	Art. 55	https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Technical documentation	EU AI Act	Art. 11, Annex IV	https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Documentation	NIST AI RMF	GOVERN-1.3, MAP-2.1	https://doi.org/10.6028/NIST.AI.100-1
Explainability / interpretability	NIST AI RMF 1.0	Explainable and Interpretable	https://doi.org/10.6028/NIST.AI.100-1
Communication	ISO 42001	A.10.3	https://www.iso.org/standard/81230.html
Transparent information	GDPR	Art. 12–14	https://eur-lex.europa.eu/eli/reg/2016/679/oj