REFERENCE · §9 · LAST REVIEWED 2026-04-27

ACF §9 — Customer Disclosure

Customer disclosure for agent-mediated services is the discipline of informing end-users — clearly, in advance, and through the right channel — that an autonomous AI agent will be taking material actions during their regulated interactions, and capturing meaningful consent where required.

Disclosure obligations vary by jurisdiction and by the materiality of agent involvement. EU AI Act Article 50 requires disclosure when interacting with an AI system in many contexts. FCA Consumer Duty principles imply meaningful consent. GDPR Article 22 governs solely-automated decisions with legal effect. The framework section gives a decision tree: what to disclose, when, through which channel, with what consent capture, and how to evidence the disclosure post-hoc.

Regulatory anchors

• EU AI Act Art. 50
• FCA PRIN 7 / Consumer Duty
• GDPR Art. 22
• CCPA §1798.185
• MAS FEAT

What this covers

• Materiality threshold: when agent involvement triggers disclosure
• Channel and timing of disclosure
• Consent capture and the evidence of consent
• Customer recourse: how to opt out and what alternative exists
• Refresh cadence for ongoing agent-mediated relationships

Common gaps

• No disclosure at all for "back-office" agent involvement that nonetheless makes consequential decisions
• Disclosure buried in T&Cs at onboarding; never refreshed
• No documented opt-out path; the agent is the only path
• Evidence of consent stored as a checkbox state with no provenance

Related sections

• §1 — Identity & Authorisation

  Who or what is permitted to take action; how authorisation flows to agents and is revoked.

• §10 — Data Governance

  Training data, prompt caching, retention, and the regulator-facing posture for each.

• §12 — Incident Response

  When the agent does the wrong thing — runbook, regulator notification, customer remediation.

Reference compiled by Sebastian Heine. Editorial perspective at The SHeine Brief.