What is an AI Disclosure And How a Business Can Do It Right in 2026
AI disclosure is the practice of telling customers where and how a business uses artificial intelligence in the products and services they interact with. A company that uses AI to set prices, recommend products, screen orders, or answer support questions explains that use in terms a customer can understand.
The practice has moved from optional to expected, because customers increasingly assume a business uses AI somewhere and want to know where.
This guide explains what AI disclosure covers, what a business needs to disclose, how to write a disclosure statement, and the step that separates a disclosure customers believe from one they quietly doubt. The aim is a clear account a business can act on, written for the people running that business rather than for a compliance file.
What AI disclosure is
AI disclosure is a written statement in which a business identifies the ways it uses artificial intelligence in its dealings with customers. The statement records each use of AI that bears on a customer, describes what the system does, and sets out what the customer may expect as a result. Where a privacy policy governs the handling of personal data, an AI disclosure governs the conduct of the automated systems that act on that data.
A privacy policy and an AI disclosure answer different questions, and businesses often treat one as if it covers the other. Most standard privacy policies were written before AI shaped customer experiences this directly, which is why they leave the AI questions unanswered. A complete approach uses both documents.
| Privacy policy | AI disclosure | |
|---|---|---|
| What it covers | The data a business collects, stores, and shares | The automated decisions that data is used to make |
| Question it answers | What do you know about me? | What does AI decide about me? |
| Worked example | We collect your purchase history | Your purchase history feeds a system that sets the products and prices you see |
| Governs | The handling of personal data | The conduct of the automated systems acting on that data |
What a business needs to disclose
A business discloses any AI use that affects a decision about the customer, their money, their data, or their access to a service. That standard draws a clear line. Uses that touch a customer directly belong on the disclosure. Internal tools that a customer never encounters do not.
The test for each AI use is one question. Does this system affect a decision the customer would want to know about. A pricing system that adjusts figures based on demand affects the customer, so it goes on the disclosure. A recommendation engine that determines which products a customer sees affects the customer, so it goes on the disclosure. An automated check at checkout that can hold or decline an order affects the customer, so it goes on the disclosure. A support system that ranks and routes requests affects the customer, so it goes on the disclosure as well.
The systems that stay off a public disclosure are the ones a customer never experiences. An AI tool that schedules warehouse staff makes no decision about a customer, so it does not require a public statement. The line holds wherever AI shows up in an operation. A system that decides something about a person belongs on a disclosure that person can read. A system that runs in the background of internal operations does not.
How to write an AI disclosure statement
An AI disclosure statement is the page a customer reads to understand how a business uses AI. Written well, it answers the questions in a customer's head before they have to ask. Written in vague or legal language, it raises more doubt than it settles. The standard is plain language at a level any customer can read, with one short entry for each AI use the business has identified.
| AI use | Affects a customer decision? | Disclose it? |
|---|---|---|
| Pricing that shifts with demand | Yes | Yes |
| Product recommendations | Yes | Yes |
| Automated order screening at checkout | Yes | Yes |
| Support chatbot | Yes | Yes |
| Warehouse staff scheduling | No | No |
| Internal sales forecasting | No | No |
What to include in the statement
A disclosure statement documents each customer-facing use of AI as a separate entry. Every entry addresses three elements:
Function. The specific task the system performs. Name it precisely. A statement that a business uses AI "to improve the customer experience" discloses nothing, because it identifies no system and describes no behavior.
Purpose. The business reason the system is in use, which gives the customer the context to judge whether that reason is reasonable.
Effect on the customer. What the system does to the customer's experience, and any control the customer holds over it, such as the ability to opt out or request human review.
A well-drafted entry also anticipates the customer's primary concern about that particular system and addresses it directly.
For a dynamic pricing system, the concern is whether the customer is being charged more than others; the entry should state whether personal data influences the price shown. For an automated support channel, the concern is whether the customer knows they are not speaking to a person; the entry should state plainly that the assistant is automated. Naming the concern and answering it is what separates a disclosure that builds confidence from one that merely satisfies a formality.
The completeness of the statement is judged by a single standard. A customer should finish it able to identify every point at which AI affects them, with no material use omitted and no ambiguity about what each system does.
Where to place it on your website
A disclosure a customer cannot find provides little value. The placement should match the moment a customer would want the information.
A short line near a chatbot window noting that the assistant is automated.
Context-specific notices then catch the customer where each AI use occurs.
A one-sentence note on a pricing page about demand-based pricing, linked to the full statement.
A link in the main footer makes the full statement reachable from every page, which is the baseline.
The full page carries the detail, and the in-context notices reach the customer at the exact moment the question would occur to them.
Why disclosure alone is often not enough
A disclosure statement establishes what a business says about its AI use. It does not establish whether that statement is true. A customer reading a disclosure has only the company's word that the account is complete and accurate, and the company writing the description is the same company that benefits from appearing transparent. That structure limits how much a self-written disclosure can prove.
This is where writing your own claims, without outside review, shows its weakness. A business using AI carelessly can publish a disclosure that reads identically to one published by a business using AI well. From the outside, a customer cannot tell the two apart, because the words are all they have to judge. A polished statement and an honest practice are not the same thing, and a disclosure on its own cannot show which one a customer is looking at.
Unverified disclosure can also work against the business that publishes it. A statement that a company uses AI responsibly, offered with nothing to confirm it, invites a customer to ask what the company chose not to say. The disclosure raises the question of AI use while supplying no evidence of careful practice. A vague statement can leave a customer more skeptical than no statement at all.
How verified disclosure works
Verified disclosure closes the part a self-written statement cannot. It adds two components to the disclosure itself: independent review and a public registry.
Independent review means an outside party checks the disclosure against a defined standard. The reviewer confirms that the account matches what the systems actually do and that it covers every customer-facing use. A statement a third party has examined and confirmed carries weight that a self-written claim cannot, because the reviewer has no stake in a favorable result.
A public registry records the finding where anyone can check it. A customer or partner looks up the business and confirms its status directly, without depending on the company's own site. SiteTrust operates as the standard for AI disclosure and maintains the public registry where verified companies are listed. A verified business displays a badge that links to its registry entry, which turns a disclosure claim into a status a customer can confirm.
The mechanism mirrors the difference between a certification badge that links to a live verification page and a badge that exists only as an image. The first can be checked. The second asks to be trusted.
Why verified disclosure becomes an advantage
The businesses that verify their AI disclosure early will set the standard their competitors are later measured against. Verification produces results a self-written statement cannot. It wins the customers who research a business before buying, since those buyers find proof rather than assurances. It separates a business from competitors who offer only self-claims, because a verifiable badge stands apart from an unverifiable one. And it positions a business ahead of rising expectations, so it is ready when customers and partners begin to treat verified disclosure as the default.
The advantage builds over time. Each customer who verifies a business and proceeds is a customer the business might have lost to doubt under a self-written claim. Verified disclosure stops being a marketing line and becomes the reason a customer chose one business over another that asked to be taken at its word.
Get certified for AI transparency with SiteTrust.
Frequently asked questions about AI disclosure
What is an AI disclosure?
AI disclosure is a written statement in which a business identifies the ways it uses artificial intelligence in its dealings with customers. The statement records each use of AI that bears on a customer, describes what the system does, and sets out what the customer may expect as a result. Where a privacy policy governs the handling of personal data, an AI disclosure governs the conduct of the automated systems that act on that data.
How do you write an AI disclosure statement?
Write one short entry for each AI use, in plain language a customer can read quickly. Each entry names three things: what the AI does, why the business uses it, and what the customer can expect or choose as a result. Name the specific use rather than saying the business uses AI to improve the experience, which tells a customer nothing. Close the worry each use is most likely to raise, such as whether a pricing system charges a customer more based on their personal data. The finished statement should leave a customer understanding exactly where AI touches them.
Do you legally have to disclose AI use?
Disclosure obligations for AI are expanding, and the direction is moving toward more disclosure rather than less, particularly for AI that makes decisions about customers, their data, or their access to a service. Beyond any specific obligation, disclosure has become a trust expectation. Customers increasingly assume a business uses AI and want to know where. A business that discloses before it is required to signals that it chose openness on its own terms, which reads very differently to a customer than a disclosure that appears only under pressure. The practical position is to disclose any AI use that affects a decision about a person.
What are AI disclosure requirements for businesses?
The core requirement is to disclose any AI use that affects a decision about a customer, their money, their data, or their access to a service, in language the customer can understand. A complete disclosure identifies each customer-facing AI use, explains what each system does, and describes what the customer can expect or choose. Strong practice goes further by having the disclosure independently verified, so a customer can confirm its accuracy rather than relying on the business's own word. Internal AI systems that never reach a customer do not require a public statement. The standard centers on decisions that affect people, not on AI use in general.
What should an AI disclosure statement include?
A disclosure statement should include a separate entry for each AI use that affects the customer, written in plain language. Each entry covers what the AI does, why the business uses it, and what the customer can expect or choose. It should name specific touchpoints, such as pricing, recommendations, support, and order screening, rather than offering a general statement about using AI. It should close the question each use is most likely to raise in a customer's mind. The statement should be complete enough that a customer finishes it without the sense that an AI use was left out.
What is the difference between disclosing AI use and verifying it?
Disclosing AI use means publishing a statement about how a business uses AI. Verifying it means having an independent party confirm that the statement is accurate and complete. Disclosure establishes what a business says. Verification establishes whether what it says is true. A self-written disclosure carries only the company's word, and the company benefits from appearing transparent. Verified disclosure adds independent review and a public registry, so a customer can confirm the business's status through a source the company does not control. The difference matters most to a skeptical customer, who has no way to judge a self-written statement on its own.
Where should you place an AI disclosure on your website?
Place an AI disclosure where customers will find it naturally, starting with a link in the main footer so the full statement is reachable from every page. Add short, context-specific notices at the moments each AI use occurs, such as a line near a chatbot noting it is automated, or a note on a pricing page about demand-based pricing linked to the full statement. The full page carries the detail, while the in-context notices reach the customer at the moment the question would occur to them. Burying disclosure in a deep footer link technically present but practically hidden defeats the purpose, and discoverability itself signals that a business has nothing to conceal.
How does a business prove its AI disclosure is accurate?
A business proves its disclosure is accurate through independent verification recorded in a public registry. A self-written statement cannot serve as its own proof, because the business making the claim benefits from being believed. Independent review means an outside party checks the disclosure against a standard and confirms it matches what the systems actually do. A public registry then records the result where any customer or partner can confirm it directly. SiteTrust maintains this kind of registry and operates as the standard for AI disclosure, allowing a business to display a verified badge that links to its registry entry, which turns a disclosure claim into a status a customer can check independently.
Ready to become a founding member?
Apply for certification todayFree AI tools
Assess your AI readiness
Use these quick assessments to spot trust, governance, and disclosure gaps.
