The Disclosure

I need NovaAssist switched to human-only routing immediately. All chatbot auto-responses disabled. Every query goes to a live agent.

That's going to triple the queue. We've got three agents on shift until 1 PM.

I know. Prioritise urgent queries. Anyone who called about account fees in the last 48 hours gets a callback today.

Amir, I need a complete list of every piece of content you've published using AI tools. Blog posts, email copy, chatbot scripts, social posts. Everything from the last 11 months. I need it by 11 AM. No judgment — I need the facts.

Elena, I'm really sorry. It's... basically everything. I'll get you the list.

Elena, I heard you're doing an audit. Good. But the chatbot is still live. And you just sent an email campaign to 28,000 people. If any of that content is inaccurate, every hour it stays out there is additional exposure. An audit without action is just documentation of a problem you knew about and didn't fix.

Elena, I just saw your email to the FT journalist. You told her we have "human editorial oversight at every stage." Do we?

I—

Because if we don't, and she can prove we don't, that response becomes evidence of misleading a journalist about our AI practices. Under Article 50(4), deployers must not misrepresent the AI-generated nature of content. And under Article 99, providing misleading information can carry fines up to EUR 7.5 million or 1% of turnover. You've turned a transparency problem into a deception problem.

Elena, what's happening with the FT thing?

[Summarises the situation — journalist, chatbot, customer complaint, the scope of AI-generated content]

How bad is it?

127 blog posts, 34 email campaigns, all chatbot scripts. Eleven months. No disclosure on any of it.

Right. Look, I'm back Thursday evening. Can we hold everything until then?

The journalist's deadline is Friday.

Then tell her we'll have a full response by Thursday. Buy us a day. And Elena — don't tell her more than you have to. This isn't a confession, it's a PR situation.

Fiona, Niamh says it's a compliance situation. Article 50 of the AI Act—

The AI Act isn't fully enforced yet. We have until August. Let's not overreact.

The transparency provisions are already in force for general-purpose AI output. And the chatbot gave a customer wrong information. He's threatening the Central Bank.

Fine. Loop in Niamh. But I'm telling you, if we put out a statement saying "we used AI and didn't tell anyone," that's the headline. Let's be smarter than that.

I heard the call. Fiona wants to manage the narrative. I understand why. But here's what she's not factoring in: Article 50 transparency obligations for AI-generated content that could be mistaken for human-generated content are already enforceable for general-purpose AI systems. We're not in a grey area. And the chatbot — that's Article 50(1). Persons interacting with an AI system must be informed they're interacting with AI. Our chatbot doesn't disclose that it uses AI at all. Not in the interface, not in the terms, nowhere.

What about the customer? Robert Acheson.

The Air Canada precedent is clear. A tribunal held the airline responsible for every statement its chatbot made. Our chatbot told him there was no maintenance fee. If we don't make this right, he has a strong case — and not just under the AI Act. This is basic consumer protection.

Mr. Acheson, my name is Elena Vasquez. I'm the Director of Marketing at NovaTech. I'm calling about your experience with our chatbot.

Finally, someone who isn't reading from a script.

I've reviewed what happened. Our chatbot gave you incorrect information about the premium account fee waiver. That fee waiver was discontinued six months ago, but our chatbot's information wasn't updated. That's our error, not yours.

So what are you going to do about it?

Three things. First, we're reversing the EUR 49 charge immediately. Second, we're honouring the fee waiver the chatbot offered you — no maintenance fee for 12 months. Third, we're reviewing every automated response in the chatbot to make sure the information is current.

That's... fair. That's what I was asking for from the start. Your support team kept telling me the chatbot wasn't binding.

They shouldn't have said that. If our system gives you information and you act on it in good faith, we should stand behind it.

I appreciate the call. I'll take down the tweet.

That was the right approach. The Air Canada tribunal found the airline liable because they tried to distance themselves from the chatbot's statements. You just did the opposite — and that's defensible. If this goes to the Central Bank, we can show we identified the problem, contacted the customer, and made it right within 24 hours.

Elena, the journalist is going to ask about the specific article. She already knows the answer. If Fiona tells her on Friday that the article was reviewed by a human editor, and the journalist has evidence it wasn't, we've gone from a transparency issue to a credibility issue. And the customer — a refund without an acknowledgment that the chatbot is AI-powered isn't enough under Article 50(1). We've fixed the charge but not the disclosure.

Elena, we've lost control of this. The journalist is publishing tomorrow with or without our input. The customer has escalated to the Central Bank. And Fiona isn't back until tonight. If she walks into that journalist call on Friday with a "nothing to see here" posture, this becomes the lead story, not a sidebar.

What do we do?

We needed to do it yesterday. Article 50 required transparency from the moment we deployed these systems. Every day we delay, the regulator's patience shrinks. I need to brief the board. This is no longer a marketing problem.

You want me to go on a call with the FT and say we've been using AI without disclosure for 11 months?

I want you to go on the call and say we identified a gap, we've built a framework, and we're implementing it. The story is the framework, not the gap.

Fiona, I need to add something. If the Central Bank opens an investigation — and I think there's a 60% chance they do, based on the chatbot complaint — the first thing they'll ask is what we did when we found out. If we can show a comprehensive governance framework adopted within 72 hours of identification, that's the difference between a warning letter and a formal investigation.

What's the cost?

The chatbot relaunch: approximately EUR 40,000, including compliance review and redesign. The audit of existing content: I'll need one contractor for two months, maybe EUR 15,000. Staff training: we can do that internally. Total: under EUR 60,000.

And the cost of not doing this?

Article 99. Up to EUR 15 million, or 3% of global turnover — that's the higher tier for deployer obligation violations, not just misleading information (which carries the lower 1% tier). For NovaTech, that's EUR 10.2 million. And that's the AI Act alone — the GDPR exposure from the chatbot logs is separate.

Build the framework. I'll do the call.

Elena... I want to help. I know I caused a lot of this. I should have asked about a review process. I should have checked the chatbot responses against the fee schedule. Can I help build the training module?

Yes. You're going to help build it because you understand exactly what went wrong. That's not punishment — that's the most useful thing you can do.

This I can work with. Labels on the blog, review checklist, chatbot disclosure. We can tell the journalist we're already rolling this out. What's the timeline?

Labels within a week. Chatbot disclosure banner within two weeks.

Elena, this addresses the visible symptoms but not the root cause. We have no documentation of which content was AI-generated. No training for the team on what requires disclosure. No process for chatbot response verification. And the GDPR issue with the conversation logs — you haven't addressed that at all.

We'll handle GDPR separately. This gets us past the journalist deadline.

And what about the Central Bank? If Robert Acheson files his complaint, they won't ask whether we added a banner to the chatbot. They'll ask whether we have a risk management system. Whether we have human oversight processes. Whether we trained our staff. Under Article 9, a risk management system must be "established, implemented, documented, and maintained." A checklist isn't a system.

Here's what we do. The journalist call tomorrow — I'll position us as leaders. "NovaTech has been at the forefront of AI adoption in fintech, and we're now at the forefront of AI transparency. We're launching a disclosure initiative." No mention of the chatbot issue. No mention of how long we've been running without oversight.

Fiona, Niamh has flagged serious—

Niamh is doing her job. I'm doing mine. The board doesn't need to know the details until we've got the narrative right. Elena, tell your team — especially Amir — that nobody discusses our content processes externally. That includes LinkedIn, that includes former colleagues, that includes friends at other fintechs.

Fiona, I need to formally advise you that instructing staff not to discuss compliance concerns externally could be interpreted as suppression of whistleblowing. Under the EU Whistleblower Directive, which Ireland transposed in 2022, employees who report breaches of EU law — including the AI Act — are protected from retaliation. If Amir or anyone on Elena's team raises this concern through an external channel and we've told them not to talk, our position becomes indefensible.

I'm not suppressing anything. I'm asking for message discipline.

A regulator won't see it that way.

Thank you, Fiona. That's helpful. Just to clarify — your customer-facing chatbot, NovaAssist, does it use generative AI?

Our chatbot uses advanced natural language processing, yes. It's designed to help customers with routine queries.

Does it disclose to users that they're interacting with AI?

We're... in the process of adding enhanced transparency features.

So currently, no?

We're implementing industry-leading transparency measures across all our AI touchpoints.

I understand. One more thing — Robert Acheson, a customer in Cork, says your chatbot gave him incorrect fee information and NovaTech wouldn't honour it. Are you aware of this?

I'm not aware of specific customer cases, but NovaTech takes all customer feedback seriously.

The Central Bank's Regulatory Affairs team called me at 7:15. They've seen the FT article. They want to understand our AI governance framework. I told them we'd provide documentation within 48 hours. Elena — what documentation do we have?

We have a ChatGPT subscription and 127 unpublished blog post drafts with no version history.

Then we have 48 hours to build a framework we should have built 11 months ago. And we're building it under regulatory scrutiny, not ahead of it.