Transparency, Disclosure and User Notification

Introduction
Transparency, Disclosure and User Notification sit within the AI Technologies and Controls domain of the ISACA Advanced in AI Security Management (AAISM) body of knowledge. Together they form the set of controls that ensure people know when an AI system is being used, what it does, how it affects them, and what they can do about it. For the exam, this topic connects AI governance (policies and accountability), AI risk management (trust, legal and reputational risk) and technical controls (labelling, provenance, model documentation). This guide explains why the topic matters, what each concept means, how the controls operate in practice, and how to approach exam questions on it.

Part 1: Why Transparency, Disclosure and User Notification Matter

1. Trust and adoption. AI systems that operate invisibly or make unexplained decisions erode user confidence. When people discover they were interacting with a bot, or were scored by an algorithm without being told, the resulting loss of trust can be greater than the harm of the decision itself. Transparency is the precondition for sustainable adoption of AI in an enterprise.

2. Regulatory and legal obligation. A growing body of law mandates disclosure and notification. Examples the exam expects you to recognise include:
• EU AI Act, Article 50 (transparency obligations): providers and deployers must inform people that they are interacting with an AI system (unless obvious), label synthetic audio, image, video and text (deepfakes), and notify individuals exposed to emotion recognition or biometric categorisation systems.
• GDPR Articles 13, 14, 15 and 22: data subjects must be told about the existence of automated decision-making, including profiling, with meaningful information about the logic involved and the significance and envisaged consequences, plus the right to human intervention and to contest decisions.
• US state and local rules: for example the California Bolstering Online Transparency (BOT) Act requires disclosure when a bot is used to communicate for commercial or electoral purposes; New York City Local Law 144 requires notice and bias audit summaries for automated employment decision tools; the Colorado AI Act requires notification to consumers subject to consequential decisions made by high-risk AI.
• Sector regulators (financial services, healthcare, consumer protection) increasingly require explanations of adverse automated decisions (for example adverse action notices under US fair lending rules).

3. Accountability and contestability. People cannot challenge, appeal or correct an AI-driven outcome they do not know exists. Notification enables the exercise of rights such as human review, correction of inputs and redress. From a security management view, this also creates a feedback channel that surfaces errors, bias, drift and misuse.

4. Security and misuse prevention. Content provenance and labelling (watermarks, cryptographic signatures, metadata) help counter deepfake-enabled fraud, impersonation and disinformation. Disclosing capabilities and limitations prevents users from over-relying on outputs (automation bias) in ways that create safety or security exposures.

5. Ethical alignment. Transparency is a core principle in virtually every AI ethics framework: the OECD AI Principles, UNESCO Recommendation on the Ethics of AI, NIST AI Risk Management Framework (the characteristic Accountable and Transparent), and ISO/IEC 42001 (information for interested parties and communication requirements). ISACA expects candidates to see transparency as a trustworthiness characteristic, not a mere compliance checkbox.

Part 2: What the Concepts Mean

Transparency is the overarching property: the degree to which appropriate information about an AI system, its purpose, its data, its logic, its performance and its limitations is made available to the people who need it. Transparency operates at several levels:
• System-level transparency: the existence, purpose, owner and scope of the AI system (often captured in an AI inventory or register).
• Process transparency: how the system was developed, trained, tested, validated and monitored.
• Outcome transparency: why a specific output or decision was produced for a specific person (this overlaps with explainability).
Be careful to distinguish related terms the exam may test:
• Explainability: the ability to describe in human-understandable terms why the model produced a given output.
• Interpretability: the extent to which the internal mechanics of the model can be understood (for example a decision tree is more interpretable than a deep neural network).
• Transparency is broader than both; a system can be transparent about its use and limits even if the model itself is a black box.

Disclosure is the deliberate act of communicating information about the AI system to a defined audience. Audiences include end users, customers, employees, regulators, auditors, business partners and the public. Typical disclosure artefacts include:
• Model cards: structured documentation of a model's intended use, training data, evaluation results, performance across groups, limitations and ethical considerations.
• System cards: documentation of the whole deployed system, including guardrails, human oversight and integration context.
• Datasheets for datasets: provenance, composition, collection methods, consent basis and known gaps in training data.
• Privacy notices and terms of service: explaining data processing, automated decision-making and user rights.
• Transparency reports: periodic public reporting of AI use, incidents, takedowns or appeals.
• Regulatory filings and conformity declarations: registration of high-risk systems, bias audit summaries, incident reports.
• Vulnerability and incident disclosure: telling affected parties about AI security incidents, data leakage or model compromise.

User Notification is the specific, often real-time, communication delivered to the individual at the point of interaction or decision. It answers questions such as: Am I talking to a machine? Was this content generated by AI? Is a decision about me automated? Is my data being used to train or improve a model? What can I do if I disagree? Common forms include:
• A label or banner that identifies a chatbot or virtual assistant as AI.
• Visible or embedded labels on synthetic images, audio, video and text.
• Just-in-time notices before data is collected or a model acts (for example before voice is recorded for analysis).
• Adverse decision notices that state the principal reasons and the route to human review.
• Notices of material changes to how an AI feature works.
• Opt-out, consent withdrawal and appeal mechanisms attached to the notice.

Part 3: How the Controls Work in Practice

Step 1: Establish policy and ownership. A transparency and disclosure policy, approved by governance (AI governance committee, board or executive sponsor), defines what must be disclosed, to whom, when, in what form and who is accountable. The AI security manager typically ensures the policy aligns with the broader AI governance framework, security policy and privacy programme. ISO/IEC 42001 requires organisations to determine what information interested parties need and how it is communicated.

Step 2: Maintain an AI inventory and classify systems. You cannot disclose what you have not identified. Every AI system, including third-party and embedded AI, is recorded with its purpose, data, risk classification and user population. Risk tiering drives the depth of disclosure: a high-risk system making consequential decisions (credit, employment, healthcare, access to services) needs detailed notices, explanations and appeal routes, while a low-risk spell-checker may need minimal disclosure.

Step 3: Determine disclosure requirements per system. For each system, map applicable laws, contracts and internal standards to concrete requirements: Is interaction disclosure needed? Is content labelling needed? Is automated decision notice needed? What about training-data use notices and consent? Legal, privacy, compliance and security collaborate here, but the output is a documented set of control requirements.

Step 4: Design notifications for the audience. Effective notices are:
• Timely: delivered before or at the moment of interaction or decision, not buried after the fact.
• Clear and plain-language: understandable by the intended audience, avoiding jargon.
• Layered: a short notice up front with links to deeper detail (model card, privacy notice, FAQ).
• Accessible: available in appropriate languages and formats, including for people with disabilities.
• Actionable: telling users what they can do, such as request human review, opt out or correct data.
• Persistent where needed: labels on generated content should survive sharing or downloading where technically feasible.

Step 5: Implement technical mechanisms.
• Interaction labelling in chat interfaces, voice assistants and automated email, including when an AI agent acts on a user's behalf toward third parties.
• Content provenance: visible labels, invisible watermarks, cryptographic signing and metadata standards such as C2PA (Content Credentials) to indicate AI generation or alteration. Candidates should know that watermarks can be stripped and are a detective and deterrent control, not a guarantee.
• Explanation generation: feature attribution, reason codes, counterfactual explanations or rule extraction to populate decision notices.
• Logging and audit trails: so that the organisation can reconstruct what the system did and prove that notices were delivered.
• Consent and preference management integrated with identity and data governance to honour opt-outs, particularly for use of personal data in training.
• Configuration management: notices and labels are treated as controls subject to change control, so an update does not silently remove a disclosure.

Step 6: Balance transparency with security and confidentiality. Full disclosure of model internals, prompts, guardrail logic or training data can enable prompt injection, model extraction, evasion attacks, privacy breaches or intellectual-property loss. The AAISM perspective is proportionate or meaningful transparency: disclose enough for users to understand and act, without exposing details that create exploitable attack surface. Techniques include tiered disclosure (public summary, confidential detail for regulators and auditors under NDA), abstracted explanations (reason codes rather than weights) and red-team review of disclosures before publication.

Step 7: Monitor, measure and assure. Metrics include percentage of in-scope systems with approved disclosures, notice delivery rates, user comprehension testing results, number of appeals and their outcomes, time to notify after an incident, and audit findings. Internal audit or independent assessment verifies that notices exist, are accurate, match actual system behaviour and are delivered as designed. Discrepancies between what is disclosed and what the system actually does are a serious finding, because misleading disclosure can be treated as deceptive practice by regulators.

Step 8: Manage change and incidents. Material changes (new data sources, new purposes, new model, new decision authority) trigger disclosure review and, where required, renewed notice or consent. AI security incidents (model compromise, data leakage, harmful outputs) trigger incident disclosure obligations to affected users, regulators and partners according to defined timelines.

Part 4: Common Pitfalls and Anti-Patterns
• Treating a sentence in a lengthy terms-of-service document as adequate user notification for a consequential decision.
• Disclosing AI use only after a complaint or media report (reactive disclosure).
• Assuming disclosure equals consent; notification informs, consent requires an affirmative choice where law demands it.
• Notices that are technically accurate but not understandable to the audience.
• Removing or breaking labels during integration, redesign or vendor updates.
• Over-disclosure that exposes security-sensitive detail or personal data.
• Relying on vendor assurances without obtaining documentation (model cards, test results) for third-party AI that the organisation deploys; the deployer still owns the duty to notify its users.
• Ignoring internal users; employees subject to AI monitoring or AI-assisted HR decisions also require notification.

Part 5: Mapping to Frameworks
• NIST AI RMF: GOVERN (policies for transparency, roles), MAP (identify context, stakeholders and impacts), MEASURE (evaluate transparency and explainability, track incidents), MANAGE (communicate risks and responses to affected parties). Transparency and accountability are a named trustworthiness characteristic.
• ISO/IEC 42001: requirements for communication, documented information, and controls in Annex A on information for interested parties, including system transparency and explainability, and on communication of incidents.
• ISO/IEC 23894 and ISO/IEC 22989: risk management guidance and terminology, including definitions of transparency, explainability and interpretability.
• EU AI Act: Article 13 (transparency and provision of information to deployers of high-risk systems), Article 50 (transparency obligations for certain AI systems), plus registration and incident reporting duties.
• OECD AI Principles: transparency and explainability principle calling for meaningful information appropriate to the context.

Part 6: Exam Tips: Answering Questions on Transparency, Disclosure and User Notification

Tip 1: Think like an AI security manager, not a developer or a lawyer. ISACA exams reward governance-oriented answers. If options include a technical fix, a legal opinion and a governance action (policy, accountability, risk-based requirement), the governance action is usually the best first step. Technical mechanisms follow policy; they do not replace it.

Tip 2: Identify the audience and the moment. Read the scenario to determine who needs to know (end user, regulator, data subject, employee, partner) and when (before interaction, at decision time, after an incident). The best answer usually delivers the right information to the right audience at the right time. Notices delivered too late or to the wrong party are classic distractors.

Tip 3: Apply proportionality and risk-based thinking. The depth of disclosure should match the risk and impact of the system. If an option proposes identical, exhaustive disclosure for every AI system, or almost none for a consequential-decision system, it is probably wrong. Look for answers that tie disclosure requirements to the AI inventory and risk classification.

Tip 4: Remember the security-transparency balance. When a question asks about publishing model details, prompts, guardrails or training data, the best answer protects against model extraction, prompt injection and privacy exposure while still giving users meaningful information. Choose tiered or abstracted disclosure over either total secrecy or total openness.

Tip 5: Separate notification, consent and explanation. Notification tells people AI is being used. Consent is an affirmative, informed choice where required. Explanation gives reasons for a specific outcome. Questions often test whether you know that one does not substitute for another; for example, a privacy policy mention does not equal an adverse decision explanation with a right to human review.

Tip 6: The deployer keeps the duty. If a scenario involves third-party or vendor AI, remember that using a vendor's model does not transfer the obligation to notify your own users. The best answer typically involves obtaining vendor documentation (model card, test results, contractual assurances) and still issuing your own disclosures.

Tip 7: Watch for the word first, best, most or primary. When asked what should be done first, prefer identification and inventory of AI systems, or establishing policy and ownership, before designing notices. When asked for the primary purpose or main benefit of transparency, prefer trust, accountability and enabling user rights over reputational marketing or purely avoiding fines.

Tip 8: Verify that disclosure matches reality. Scenarios in which notices describe a system differently from how it actually works point to a control deficiency and potential deceptive practice. The best answer is to correct the disclosure or the system and to add assurance (testing, audit) that disclosures remain accurate through change management.

Tip 9: Content provenance questions. Know that watermarking and metadata standards (such as C2PA) support labelling of AI-generated content but can be removed or lost; they are part of a layered control set alongside visible labels, policy, user education and detection. An option claiming watermarking alone guarantees identification is a distractor.

Tip 10: Eliminate extreme or passive options. Answers such as do nothing because the model is a black box, disclose everything publicly, or rely solely on legal to decide are rarely correct. ISACA favours balanced, documented, risk-based, accountable approaches with measurable follow-through.

Tip 11: Recognise regulatory signals in the stem. Mentions of chatbots, deepfakes, emotion recognition, biometric categorisation, profiling, consequential decisions, employment screening or credit scoring are cues that mandatory notification, labelling or explanation obligations apply. Choose the option that satisfies the legal duty while fitting the governance programme.

Tip 12: Connect to incident management. If the scenario is an AI security incident, the best answer usually includes timely notification of affected users and regulators according to a predefined plan, with clear, accurate information and guidance on protective steps, rather than waiting for complete root cause analysis before any communication.

Sample Question Walkthrough
Scenario: An organisation deploys a vendor-supplied AI assistant in its customer service portal. Customers are not told they are interacting with AI, and the assistant occasionally provides account-related recommendations. Which of the following is the BEST action for the AI security manager to recommend first?
A. Replace the vendor model with an in-house interpretable model.
B. Add a clear notice at the start of each session informing customers they are interacting with an AI assistant and how to reach a human, in line with an approved disclosure policy.
C. Publish the vendor's full system prompt and model weights on the company website.
D. Wait for a regulator to request information before changing the interface.
Analysis: A is a disproportionate technical change that does not address the disclosure gap. C creates security and intellectual-property exposure. D is reactive and non-compliant. B delivers timely, clear user notification tied to policy and offers an actionable route to a human, which is the governance-aligned best answer.

Key Takeaways for Revision
• Transparency is a trustworthiness property; disclosure is the communication; user notification is the point-of-interaction delivery.
• Drivers: trust, law (EU AI Act, GDPR, US state and local laws), accountability, security against synthetic media misuse, ethics.
• Controls: policy and ownership, AI inventory and risk tiering, per-system requirements, well-designed layered notices, technical mechanisms (labels, provenance, explanations, logging, consent management), security-aware proportionality, monitoring and assurance, change and incident triggers.
• Exam mindset: governance first, audience and timing, proportionality, deployer accountability, accurate and verifiable disclosure, balanced rather than extreme options.