The API Doesn't Come With A Disclosure Button

I remember the early 2000s, when firms thought a signed-off checklist was a control. It wasn't. It was theatre. We spent years scrubbing that habit out of the system, only for it to return under a new name: "Vendor Compliance."

The current obsession is the API. Specifically, the EU AI Act’s requirement that chatbot users be told they are interacting with an AI. For the last year, I've seen plenty of internal memos suggesting that because we use a Tier-1 LLM provider, the disclosure requirement is "handled" by the vendor.

It isn't. The EU Commission has made it clear: the disclosure obligation applies to the API builders and the users who deploy them. Your vendor provides the engine; you provide the steering wheel and the dashboard. If you forgot to put a warning light on that dashboard, that is your failure, not theirs.

This is a classic design gap. The mistake is treating a regulatory requirement as a feature of the software rather than a control in the business process.

If you are the person tasked with implementing this, stop looking at your SaaS contract. Your contract is a legal instrument for recovering losses after you've been fined; it is not a technical control that prevents the fine from happening in the first place.

Here is what this actually means for your evidence folder. If an auditor asks how you comply with chatbot disclosure, showing them a SOC 2 report from your AI vendor is useless. That report tells the auditor the vendor's data center has a fence around it and their employees have background checks. It does not prove that a customer in Lyon was told they were talking to a bot at 10:14 AM on a Tuesday.

You need evidence of the interaction layer. I want to see screenshots of the user interface showing the disclosure statement appearing before the first prompt is entered. I want to see the version history of the UI code that pushed those changes live. If you've automated this, show me the logs.

Anything less is just theatre.

The common objection here is that the "platform provides the capability" for disclosure and it’s simply a matter of toggling a switch. That’s exactly where people get tripped up. A "capability" isn't a control. A control is the documented process of ensuring that switch is actually flipped, tested, and remains flipped after the next update.

If you rely on a vendor toggle, your control isn't "the toggle." Your control is the monthly verification that the toggle hasn't been reset by a firmware update or a rogue dev. If you can't produce a log of those checks, you don't have a control. You have a hope.

The cost at year-end for this kind of laziness is steep. Look at DentaQuest. They just had a breach affecting north of 15 million patients. While that's a data theft issue and not an AI disclosure one, the root cause is often the same: relying on the "technical safeguards" promised by a cloud provider without verifying the implementation. When you outsource the infrastructure, you cannot outsource the accountability.

The second-order effect here hits your auditors. Most audit firms are currently terrified of AI because they don't know how to test it. They will likely lean on your vendor's certifications because it's the path of least resistance. This creates a dangerous blind spot. When the regulator eventually decides to sample your user interactions and finds no disclosures, the auditor who signed off on your "vendor-managed compliance" becomes the next target for the PCAOB or the FCA.

We are seeing this already with the Big 4 offshoring high-risk audit work. The regulators are getting twitchy about quality because the people actually doing the work aren't the ones signing the opinion. The same thing is happening here: the person paying the fine isn't the one who wrote the API.

You can keep pointing at your vendor's compliance page if you like. Just make sure your CFO knows that "Vendor-handled" is not a recognized legal defense in an EU administrative hearing.

Check your UI today. If the disclosure isn't there, you aren't compliant. If it is there, find out who verifies it's still there every morning.