Organizations that utilize Artificial Intelligence (AI) tools, especially Generative AI for public content, should produce an AI Disclosure Statement that informs the public on how AI is used in the organization and what protocols are in place to govern its usage.

Control Type: Administrative

Control Function: Directive

Artificial Intelligence (AI) is by far the most consequential technology of the 2020s. Since 2023, the industry has rapidly expanded, with AI tools being integrated into virtually all aspects of digital life. Many organizations have integrated AI capabilities into their operations, using them for everything from automation to research to employee support.

One of the most controversial uses of AI in business environments is the use of Generative AI to create public content for the organization. Flyers, advertisements, press releases, and logos are increasingly being automatically created by Generative AI tools. We see this especially in small businesses, although organizations of all sizes utilize it.

Even more controversial is the prospect of organizations using customer data with internal AI tools. While the organization's intentions may be to provide better services by using AI to streamline operations, many customers are uncomfortable with the idea of their personal data being fed into an AI model by a company. This sense of discomfort can lead to backlash against the organization and a drop in customer support.

As of 2026, the public has conflicting views on AI, with there being much debate over the ethics of its use. Sometimes, an organization’s customer base may be heavily opposed to AI generated content, and they may even stop supporting the organization due to it. However, many customers likely do not care and may not even notice the increased use of AI.

It should be best practice for organizations to draft and publish a statement disclosing its use of AI. This can bring benefits such as increased customer trust. The statement doesn’t necessarily have to apply to AI usage internal to the organization. In fact, this may be bad security practice since it could give threat actors information about internal components of the organization. However, the AI Disclosure Statement should cover all aspects of AI use regarding public campaigns, publicly accessible materials, advertisements, and the use of customer data. The statement should be published on an easily accessible, open forum such as on the organization’s website. In practice, an AI Disclosure Statement is like a Privacy Policy.

An AI Disclosure Statement may be structured like this:

  1. What Tools are Used? Name the AI model, version, distributor, etc.
  2. Purpose: Why are the AI tools used? What is the business justification for them? How have they helped the organization deliver better customer experience?
  3. Scope: identify what data categories host content created by AI (illustrations, advertisements, website visuals, press reports, etc).
  4. Original Content: identify which data categories do not utilize AI, and which parts of public content are original work
  5. Use of Customer Data: disclose any and all instances where customer data is input to AI tools. List the security mechanisms in place to protect such data, such as data masking, de-identification, etc.
  6. Oversight: disclosure of how much oversight is given to AI prompts and their results. What changes were made to the original output? Is there a system of governance in place to regulate how the AI content is created?
  7. Correction: disclose whether the organization has a policy and process in place to correct errors in AI generated content. Explain incident response measures in place to respond to AI-specific incidents involving the potential compromise of customer data.
  8. Retention (optional): it is in the organization’s best interest to capture and retain all interactions with AI tools, just as it would any other piece of internal data. This should include prompts, output history, and any other data utilized in the content generation process. The AI disclosure statement should specify whether AI related data is logged, how long it is retained for, and whether security controls are in place to protect the retained data.