/legal/ai-transparency
AI transparency and EU AI Act readiness
IICP is an unfunded, non-commercial research project developing an open routing and discovery protocol for AI-capable systems. The website is a public reference, not a hosted AI service. This page explains the intended purpose, current controls and limits. It is a technical readiness statement, not a legal classification, conformity assessment or compliance certificate.
What users should know first
- When you use an IICP AI client or browser model, you are interacting with AI.
- The directory helps find a provider; it does not generate the answer.
- A selected remote provider can read and process the task it executes.
- Model output can be inaccurate and requires review appropriate to the use case.
- IICP is not intended for prohibited practices or unattended decisions with legal or similarly significant effects.
Intended purpose and roles
IICP resolves an intent and policy constraints to candidate providers. A concrete operator can have different EU AI Act roles depending on whether it develops, places on the market, operates or merely transports an AI system. The protocol cannot assign that role for every deployment.
| Component | Working description | Boundary |
|---|---|---|
| Directory | Discovery and routing infrastructure | It stores control-plane metadata and should not receive task prompts. Its legal role depends on the deployment and how scoring is used. |
| Client or SDK | Deployer-side component or part of an AI system | It discovers candidates, applies local policy and sends a task to the selected provider. |
| Provider node | Provider, deployer or processor depending on the operator and backend | It receives and executes the task. The operator remains responsible for the model, intended purpose and use context. |
| Relay or tunnel | Transport infrastructure | It must not be presented as the AI decision-maker. Metadata, confidentiality and processor duties still depend on the path. |
| Browser mode | User-facing AI interaction | Local inference runs on the user's device. Experimental provider mode can serve third-party tasks through a relay. |
Risk boundaries
- Maintained clients and directories refuse a narrow floor of prohibited intent families before routing. This is not a complete legal classifier.
- Employment, education, essential services, law enforcement, migration, justice, healthcare and safety-related uses require a deployment-specific assessment, human oversight and evidence beyond generic public-mesh routing.
- IICP does not authorize social scoring, prohibited biometric uses, unlawful manipulation or individual criminal-risk prediction.
- Operators must define intended purpose, model limitations, monitoring, incident handling, record retention and contestability for their own deployment.
Interaction and generated-content notices
User-facing IICP surfaces should identify an AI interaction no later than the first interaction unless that fact is already obvious. Maintained protocol profiles can carry a generated_by_ainotice, but that field is transparency metadata rather than proof of origin or authenticity.
IICP does not yet claim universal machine-readable marking of every generated text, image, audio or video output. A provider or deployer that publishes generated content must assess the marking and disclosure duties applicable to that content and use case.
Application timeline and readiness
- Prohibited-practice and AI-literacy provisions have applied since 2 February 2025.
- General-purpose AI model obligations began applying on 2 August 2025.
- Article 50 transparency obligations apply from 2 August 2026. The Commission published final implementation guidelines on 20 July 2026.
- Being non-commercial or research-led does not, by itself, settle whether a public deployment is inside or outside the Act. Each maintained surface still needs a role-, intended-purpose- and deployment-specific assessment.
- The existing
generated_by_ainotice helps people recognise AI output, but IICP has not established that it satisfies every machine-readable marking, labelling or evidence duty that may apply. - Later legislative amendments and any transitional rule must be verified in final primary-source text before IICP relies on a changed date or exemption.
Operator checklist
- Classify the concrete system and your role; do not inherit a legal conclusion from the protocol.
- Train staff and operators to an AI-literacy level appropriate to the system and affected people.
- Show clear AI-interaction and generated-content notices where required.
- Keep prohibited and unsupported high-risk uses outside ordinary public-mesh routing.
- Maintain human review, logs, incident reporting and appeal paths appropriate to the consequences.
- Reassess privacy, transfers, processors and data-subject rights separately under the GDPR.
Last reviewed 2026-08-01. This page records a technical interpretation for project documentation. Operators should obtain advice for their jurisdiction, role and intended use.