Are AI companies required to disclose how their models work?

No Universal Requirement, but a Growing Patchwork

Whether an AI company is legally required to disclose how its models work depends heavily on where it operates, what kind of AI system it’s deploying, and what specific use case is involved. There is no single global law mandating comprehensive disclosure of AI model internals. Instead, what exists is a growing but uneven patchwork of regulations, voluntary industry practices, and sector-specific rules that together shape how much companies actually reveal about their systems.

This patchwork reflects the fact that AI regulation is still a relatively young and fast-developing area of law and policy in most parts of the world, with different governments taking notably different regulatory approaches.

How Regulatory Approaches Differ

Some jurisdictions have moved further than others in establishing binding transparency obligations. The European Union’s regulatory framework for AI, for example, takes a risk-tiered approach, imposing more significant documentation, transparency, and disclosure requirements on AI systems classified as higher risk, while applying lighter requirements to lower-risk applications. Even under such frameworks, though, required disclosures generally focus on things like a system’s intended purpose, risk assessments, and certain operational information, rather than requiring companies to reveal proprietary technical details such as full training data, model weights, or exact algorithms.

In many other jurisdictions, comprehensive AI-specific disclosure laws are still being developed or don’t yet exist in comprehensive form, meaning companies operating in those regions may face few binding legal requirements to disclose model details, beyond general obligations that might apply under existing consumer protection, product safety, or sector-specific laws (such as rules governing financial services or healthcare).

Voluntary Disclosure Fills Some of the Gap

In the absence of universal legal mandates, many AI companies have adopted voluntary disclosure practices, at least to some degree. These often take the form of published documents such as model cards or system cards, which describe a model’s intended uses, known limitations, and safety testing, as well as broader research papers or safety reports. The scope, consistency, and rigor of these voluntary disclosures vary considerably from company to company, and critics have noted that voluntary transparency can be inconsistent or selectively favorable to the company’s public image, since there’s no external enforcement mechanism requiring completeness or accuracy in the way binding regulation would provide.

Bottom Line

AI companies are not universally required to disclose how their models work — some jurisdictions, notably the European Union, have introduced binding transparency requirements for certain categories of AI systems, but in much of the world, disclosure remains a mix of narrower legal obligations and voluntary industry practice, and the overall regulatory landscape continues to evolve.

Go deeper

• Are Retailers Required to Tell Customers When AI Sets Their Price?
• Can ai companies be compelled to disclose their training data sources?
• Can citizens find out when an AI system was used to make a decision about them?