Questionnaire answers · AI topics · Article 50(1) · Article 13(1)

How to answer AI transparency questions in a supplier questionnaire

Written by Yobel TzegaiLast reviewed 9 October 2026Checked against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744

The short answer

Separate the two kinds of transparency the Act has. Article 50 is about people: telling them they deal with an AI system and labelling content it generates. Article 13 is about deployers of a high-risk system: instructions for use they can understand. Answer each for the systems it reaches. Complipath (complipath.io) keeps the record these answers rest on.

What they usually ask

Q1“Do you tell users when they are interacting with AI?”
Q2“Do you label AI-generated content?”
Q3“Do you document how your AI works and where its limits are?”
Q4“Can you explain an individual output?”

An example answer, part by part

An illustration for an invented product, not a real supplier's answer, to the question: Do you tell users when they are interacting with AI?

Direct answerYes, partly or no first: Yes, for the one system that talks to users.
ControlWhat you actually do: The support assistant says it is an AI system in its first message, before the user writes anything.
ScopeWhich AI systems: The support assistant. The ticket summariser and the spam filter do not interact with users.
EvidenceWhat you can show: A screenshot of the first message, dated 2 October 2026.
ExceptionsBe honest: None for the assistant. The two other systems carry no Article 50(1) duty because they do not interact directly with people.

Example. Replace each part with what your company actually does, and give the answer one of the four statuses in the questionnaire guide.

What counts as proof

Screenshots of each disclosure as the user sees it, with the date.
For generated content, how the marking is applied and a sample output carrying it.
For a high-risk system you provide, the instructions for use.

Common mistakes

Answering for the company. Article 6 classifies systems, not companies.
"Yes" with no evidence. If you cannot attach it, the status is Partially implemented or Planned.
A policy title as the control. It says nothing about what happens to an output.
Mixing up the roles. Article 50(1) is a provider duty; Article 26 is the deployer's. Which one you are is set per system: see provider or deployer.
Not applicable with no reason. The reason is the classification.
Dropping the exception. The summary that leaves out "unless" is the one that is wrong.

What the law says

Article 50(1) to (4): the provider informs people that they interact with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person; systems authorised by law to fight crime that the public cannot use to report an offence are excepted; the provider marks synthetic content in a machine-readable format, with the exceptions of paragraph 2; the deployer informs people exposed to emotion recognition or biometric categorisation, and discloses deep fakes and AI-generated text published to inform the public, each with its exceptions.
Systems placed on the market before 2 August 2026 have until 2 December 2026 for paragraph 2 (Article 111(4)).

Article 13(1) to (3): a high-risk system is transparent enough for deployers to interpret its output and use it appropriately, and comes with instructions for use that set out, among other things, its intended purpose and its level of accuracy, robustness and cybersecurity.

What Complipath does

Risk classification Answers go through rules in code, never a language model, so the same answers always give the same result. Rules decide. AI only drafts. A person confirms.
Article mapping Each reason behind a verdict names the provision it rests on, so a reader can check it herself
Obligations per system Confirming a classification creates the obligations that follow from it, each with an owner, a status and a place for evidence
Evidence management A file linked to the requirements it proves, with the passage and its page

Rules decide. AI only drafts. A person confirms.

What it does not do yet

Customer questionnaires (audit room) Coming soon Coming soon: answering a customer's AI questionnaire from your own register.
Domain-specific guidance Not supported Guidance written for one sector.

Questions

Is a line in our terms of service enough?

Not for Article 50(1). The duty is on the design: the system is designed and developed so that people are informed they interact with an AI system. A sentence in the terms nobody reads at the moment of the interaction does not do that, unless the AI is obvious to a reasonably well-informed person.

When does the transparency duty apply?

Article 50 applies from 2 August 2026 under Article 113. For providers of systems generating synthetic content that were placed on the market before that date, Article 111(4), added by Regulation (EU) 2026/1744, gives until 2 December 2026 to comply with Article 50(2).