Explainable AI Is Not the Same as Disclosing That AI Was Used

On 2 August 2026, the EU AI Act's transparency obligations under Article 50 became enforceable. Providers now have to ensure people are told when they're interacting with an AI system, unless that would be obvious to a reasonably attentive person. AI-generated images, audio, video and text have to be marked in a machine-readable way, though systems already on the market before that date get a short additional window, until 2 December 2026, to meet the watermarking specifics. Deepfakes have to be disclosed as such. This is a real, binding requirement, live right now, and it's worth being precise about what it actually covers, because it's narrower than a lot of current commentary suggests.

What Article 50 actually requires

Article 50 is a disclosure rule. It answers one question: does the person interacting with a system know that AI is involved. It does not require a provider or deployer to explain why an AI system produced a particular output, what data or reasoning shaped a specific decision, or whether that decision reflects an organisation's own policies and risk appetite. Those are different questions, and the Act addresses them in a different part of the regulation entirely, with a different timeline.

The provisions that come closer to decision-level explainability sit in Chapter III, covering high-risk AI systems specifically. Article 13 requires high-risk systems to be transparent enough that a deployer can interpret and act on their output appropriately, and Article 14 requires human oversight measures. These were originally scheduled to apply from 2 August 2026 as well, but the EU's Digital Omnibus on AI, formally adopted and in force since 27 July 2026, pushed that back: high-risk obligations for standalone systems under Annex III now apply from 2 December 2027, and for systems embedded in already-regulated products under Annex I from 2 August 2028. So the transparency rule that's live today is about telling people AI is involved. The rules that get closer to explaining what a system actually did, and why, were delayed by more than a year through a formal legislative amendment, and even then only apply to a defined category of high-risk systems.

This distinction matters because a business can meet every current Article 50 obligation, disclosing clearly that a decision involved AI and labelling any generated content correctly, without that disclosure telling anyone in the business, or their client, or their regulator, anything about whether the AI reasoned correctly for that specific case.

A separate framework that does address this

The US National Institute of Standards and Technology's AI Risk Management Framework, published in January 2023, takes a more direct run at decision-level explanation, though it's voluntary rather than binding. NIST treats transparency, explainability and interpretability as three distinct, related characteristics of trustworthy AI, not one idea under different names. In NIST's own framing, transparency addresses what happened in a system; explainability, defined as a representation of the mechanisms underlying the system's operation, addresses how a decision was reached; and interpretability, defined as the meaning of the system's output in the context of its designed purpose, addresses why that output matters to the person using it.

That's a meaningfully different, and harder, target than disclosure. A system can be fully compliant with a "tell people AI was involved" rule while still falling short of NIST's explainability and interpretability characteristics: nobody inside the organisation can actually reconstruct how or why it recommended what it recommended for this client, this transaction, this case.

The distinction that actually matters day to day

Here's the AinTools view on why this distinction is worth taking seriously, separate from what either the EU AI Act or the NIST framework currently requires: knowing an AI system was involved in a decision, and even understanding the system's general mechanics, still doesn't tell a risk officer whether the system had the right business context for that specific case.

Take a hiring recommendation. A compliant disclosure tells the candidate an AI system was used to screen applications. A NIST-style technical explanation might describe which features of the application the model weighted heavily. Neither one answers the question a hiring manager actually needs answered: did the system know this role had an unusual requirement this cycle, that the usual scoring criteria don't apply to internal transfers, or that a particular qualification the model penalised is treated as equivalent to a degree under the company's own policy. A system can be fully transparent about being AI, and fully explainable about its general logic, and still produce a recommendation nobody can evaluate against the organisation's actual standards, because nobody asked whether it had those standards in the first place.

This is the same distinction we drew in an earlier piece on Regulation 10 in the UAE's banking sector: that regulation requires a business to show a decision followed human-defined principles, but showing that on its own doesn't guarantee the business gave the system the right principles for this specific case. The same logic applies here. Disclosure and technical explainability are both necessary. Neither confirms that an AI system was working from the specific context relevant to the specific decision in front of it.

Why this becomes more urgent as systems act with less supervision

A chatbot that produces a generic answer because it lacked the right business context is an inconvenience. An AI system that recommends a credit decision, a claims outcome or a hiring call under the same conditions, one where a person reviews and can override the output, is more consequential but still recoverable. A system empowered to act on that recommendation directly, with less human review in between, has less room for the mismatch to be caught before it affects someone.

Neither the EU AI Act's transparency rule nor NIST's explainability and interpretability characteristics, the two frameworks this article has looked at, are built around checking that specific context match. That's not a criticism of either one. A disclosure rule is designed to tell people AI is involved, and a voluntary technical framework is designed to make a system's general mechanics and outputs understandable. Confirming that a system had the specific business context a specific decision required is a different task again, and closing that distance is left to organisations themselves.

What this means for risk and compliance leaders now

Meeting Article 50's disclosure requirements and preparing for the high-risk provisions still to come are both worth doing properly, and neither substitutes for the other. But the practical question worth asking inside a business today is different from either compliance checklist: for a specific high-stakes decision an AI system supported, could someone in the organisation explain not just that AI was used, and not just how the model generally works, but whether it had the specific business context that decision actually required. If the honest answer is no, disclosure and technical explainability may both have been satisfied, and the decision is still one nobody can properly stand behind.

AinTools works with organisations building AI-assisted decisions that hold up to scrutiny, beyond disclosure requirements alone. Our Secure & Sovereign AI page sets out how we approach it.

Sources

• EU Artificial Intelligence Act, Article 50 (Transparency Obligations) and Article 113 (entry into force dates), read directly: artificialintelligenceact.eu – Article 50
• EU Artificial Intelligence Act, Articles 13 and 14 (high-risk transparency and human oversight): artificialintelligenceact.eu – Article 13
• Digital Omnibus on AI, Regulation (EU) 2026/1744, confirming the postponed high-risk compliance dates (2 December 2027 / 2 August 2028), cited via legal analysis of the adopted regulation: Cloud Security Alliance research note
• NIST AI Risk Management Framework 1.0 (NIST AI 100-1, January 2023), characteristics of trustworthy AI, read via NIST's own AI Resource Center: airc.nist.gov