AI is already part of everyday business. Chatbots handle customer enquiries, generative AI produces text, images and video, and AI tools support everything from marketing and journalism to software development and training.
We have previously covered the key obligations under the EU AI Act and their phased introduction (in Finnish), as well as the use of AI in marketing (in Finnish). This article takes a closer look at the Act’s transparency obligations: when do you need to tell users or the public that AI is involved?
The AI Act’s transparency obligations have applied since 2 August 2026. Their main purpose is to help people recognise when they are interacting with AI or encountering content that AI has generated or manipulated. Disclosure is not required for every use of AI, however. The obligations apply to specific situations defined in the Act.
The European Commission published more detailed guidance on applying these obligations in July 2026. The Finnish Transport and Communications Agency, Traficom, has also published practical guidance for organisations in Finland.
When must people be told they are interacting with AI?
As a general rule, if an AI system is designed to interact directly with people, users must be told that they are dealing with AI rather than a human. This covers, for example, AI-powered website chatbots, voice assistants, interactive AI agents and AI avatars.
Users must receive this information no later than their first interaction with the system, unless the use of AI is already obvious in the circumstances. A reference buried in the terms of use, or a technical marker that users cannot see, will generally not be enough. Simply displaying the service provider’s name may not make it clear that the user is talking to AI either.
How must AI-generated content be technically marked?
The AI Act sets out a separate technical marking obligation for providers of generative AI systems. In practice, this applies to companies such as OpenAI and Anthropic when they offer AI systems in the EU that generate text, images, audio or video.
As a rule, providers must ensure that content generated or manipulated by their systems can be identified as such in a machine-readable format. This obligation therefore generally falls on the AI provider, rather than a business using tools such as ChatGPT or Claude.
The technical method can vary depending on the type of content. For supported AI-generated images, OpenAI uses C2PA provenance metadata and an invisible SynthID watermark. An image can be uploaded to OpenAI’s verification tool, which checks the file for signals indicating its OpenAI origin. The watermark itself is invisible to the human eye.
AI-generated text can also carry machine-detectable markings. Anthropic, for example, has described a text watermarking approach for Claude that creates a detectable statistical pattern in the model’s word choices. To a reader, the text looks ordinary, but the provider’s detection method can identify the watermark.
Technical marking is different from a disclosure that users or the public can see. It does not mean that a business using ChatGPT or Claude must add a visible “AI” label to every piece of content.
When do AI-generated images, video or audio need a disclosure?
One of the most practically significant transparency obligations concerns deepfakes. When AI is used in a professional or other non-personal context to generate or manipulate a deepfake, the content must be accompanied by a clear disclosure that it has been artificially generated or manipulated.
A deepfake is AI-generated or manipulated image, audio or video content that resembles existing people, objects, places, entities or events and falsely appears authentic or truthful.
The term therefore covers more than fabricated videos of celebrities. The obligation may also arise in ordinary commercial or creative work. For example, a realistic AI-generated reconstruction in a documentary, or an apparently authentic scene created with AI for an advertisement, may require disclosure. However, not every AI-generated image or video automatically qualifies as a deepfake.
The Act allows some flexibility for creative works. If a deepfake forms part of an evidently artistic, creative, satirical or fictional work, the use of AI-generated or manipulated content must still be disclosed. The disclosure can, however, be made in a way that does not unnecessarily interfere with the presentation of the work. For more on transparency obligations concerning AI-generated audio, particularly in radio broadcasting, see RadioMedia’s blog (in Finnish).
What about AI-written text?
Not every text written with the help of AI needs a visible AI label.
The disclosure obligation applies to AI-generated or manipulated text published to inform the public about matters of public interest. These may include public administration, fundamental rights, public health, environmental protection, and significant economic, political, scientific or cultural developments. The obligation may therefore cover news articles, scientific publications, investor reports and public notices issued by authorities.
Ordinary advertising content, by contrast, generally falls outside this particular obligation.
There is also an important exception: disclosure is not required if the text has undergone human review or editorial control and a person or legal entity holds editorial responsibility for its publication.
Using AI to draft a news article, for example, does not automatically mean that the finished article must carry an AI label, provided the editorial team reviews the content and takes responsibility for publishing it. Proofreading or correcting grammar alone is not enough. The exception requires substantive review or editorial oversight.
What about emotion recognition and biometric categorisation?
Transparency obligations also apply to emotion recognition and biometric categorisation. People exposed to these systems must be informed clearly and prominently, no later than their first exposure.
Emotion recognition may involve, for example, AI analysing a customer’s voice during a customer service interaction to infer whether they are angry or impatient. Biometric categorisation involves assigning a person to a particular group based on biometric characteristics, such as estimating their age group from facial features.
Informing people does not, in itself, make the use of a system lawful. AI systems used to infer emotions in workplaces and educational institutions are generally prohibited, subject to limited exceptions for medical or safety purposes.
Permitted emotion recognition systems and certain biometric categorisation systems also fall within the AI Act’s rules on high-risk AI. In these cases, both the provider and the deployer—the organisation using the system—face extensive obligations beyond transparency.
Who enforces the obligations, and what are the consequences of a breach?
In Finland, compliance with the transparency obligations is supervised by market surveillance authorities. Traficom is generally responsible, although supervision involving high-risk AI systems may fall to the relevant sector-specific authority.
Intentional or negligent breaches of the transparency obligations may result in an administrative fine. For businesses, the maximum fine is €15 million or 3% of total worldwide annual turnover in the preceding financial year, whichever is higher. For small and medium-sized enterprises, the lower of these two limits applies.
These are maximum amounts. Whether a fine is imposed, and its size, is assessed on a case-by-case basis. Under Finnish law, no fine is imposed if the breach is considered minor or if imposing a fine would be manifestly unreasonable.
What should businesses do now?
Start by identifying where customers, users or the wider public encounter AI in your business. Pay particular attention to customer-facing AI systems and externally published content generated or manipulated using AI.
Practical steps include:
Mapping how AI is used in interactions and content that customers or other external audiences encounter.
Giving staff clear guidance on when disclosure is required, how to provide it and who is responsible.
Establishing a clear process for reviewing AI-generated text where needed.
Addressing transparency obligations in contracts with external partners that supply AI solutions or AI-generated content.
The AI Act does not require businesses to disclose every AI-assisted step in their workflow. The key is to recognise when people need to know they are interacting with AI, and when the AI-generated or manipulated nature of content must be explicitly disclosed.
Need help applying the AI Act or assessing how your organisation uses AI? We can help you identify the obligations that apply and put practical processes in place to meet them.
Lila Kallio
Counsel
+358 41 465 1365
“Environmentally friendly”, “carbon neutral” and “responsible” have become established terms in marketing. Environmental claims have not been allowed to be misleading before either, but from 27 September 2026 the rules will become more specific and certain practices will be prohibited in all circumstances. The new rules on green claims mean that companies should review their consumer-facing environmental claims, sustainability labels, climate targets and product information.
What rules are changing?
The reform is based on Directive (EU) 2024/825, which amends the EU directives on unfair commercial practices and consumer rights. In Finland, the Directive has been implemented through an amendment to the Consumer Protection Act and a new Government Decree. The reform applies to consumer-facing marketing and practices in customer relationships, regardless of the size of the company. The rules may apply to websites, advertising, commercial content on social media, packaging, product information in online stores and other sustainability communications aimed at consumers.
The Directive should not be confused with the separate Green Claims Directive proposal. Its legislative process is currently stalled, and the proposal has neither been adopted nor formally withdrawn.
When will the new rules apply?
The new provisions will apply from 27 September 2026. A limited transitional rule applies to marketing included on goods, or on their packaging, that were placed on the market before that date. Certain prohibitions concerning sustainability labels, generic environmental claims and the scope of environmental claims will only apply to such marketing from 27 March 2027. This is not a general extension for all green claims. The transitional rule does not apply, for example, to online advertising, new packaging or other practices prohibited under the new rules.
What kinds of environmental claims can be used?
Generic expressions such as “environmentally friendly”, “green”, “ecological” and “climate friendly” will generally be prohibited unless the company can demonstrate recognised excellent environmental performance that is relevant to the claim. Such performance may be based, for example, on the EU Ecolabel or an officially recognised Type I ecolabel compliant with EN ISO 14024.
A generic claim can be made more specific by clearly explaining, in the same communication, which characteristic or part of the product the claim relates to. Even a specific claim must be truthful, up to date and verifiable. A company must not market an entire product or business as environmentally better if the claimed benefit relates only to the packaging or to one particular function.
The assessment of the term “responsible” depends on the overall impression created by the communication, as the term may refer not only to environmental impacts but also to social characteristics. If it creates the impression of a positive environmental impact, the rules on environmental claims may apply.
What about carbon neutrality and offsetting?
A product or service must not be marketed as having a neutral, reduced or positive environmental impact if the claim is based on greenhouse gas emissions offsetting. For example, offsetting-based claims such as “carbon-neutral product”, “carbon-neutral delivery” and “climate compensated” will be prohibited.
A company may still communicate genuine emissions reductions and the financing of climate projects, provided that the information is presented accurately and without misleading consumers. Offsetting must not, however, be presented as an environmental characteristic of the product itself or as a way of cancelling out the emissions caused by the product.
What is required for sustainability labels and climate targets?
A sustainability label may only be used if it is based on a qualifying third-party certification scheme or has been established by a public authority. The scheme’s conditions must be publicly available, transparent and non-discriminatory, and compliance with the requirements must be independently monitored. A company’s own assessment or internal scoring system is not, on its own, sufficient to support a “Green Choice”-type label.
A future-looking environmental claim, such as “we will be carbon neutral by 2030”, requires public and verifiable commitments as well as a detailed and realistic implementation plan.
The plan must include a measurable timeline, an assessment of the resources needed and regular monitoring by an independent expert. The expert’s findings must also be made available to consumers.
What else does the reform cover?
The new prohibitions also concern product durability, software updates and repairability. For example, it is prohibited to market goods if the company has information about a feature that limits their durability, or to claim that goods are repairable when they cannot be repaired. A software update that merely enhances functionality must not be presented as necessary.
Before a contract is concluded, consumers must be provided with new information, including information about the statutory liability for defects. Where the conditions laid down by law are met, information must also be provided about a producer’s free-of-charge durability guarantee lasting more than two years, the minimum period for software updates, the repairability score, and the availability of spare parts and repair instructions.
What can happen if the rules are breached?
Compliance with the rules is supervised by the Finnish Consumer Ombudsman.
Non-compliant practices may be prohibited, and the prohibition may be reinforced with a conditional fine. A penalty payment may also be imposed for breaches of the rules. In certain situations, the Market Court may require a company to correct its marketing.
A consumer may also be entitled to a reasonable price reduction if an unfair commercial practice can be assumed to have influenced the purchasing decision. An intentional or negligent breach may also result in liability for damages.
What should companies do now?
Before 27 September 2026, companies should:
review environmental claims used on websites, in campaigns, on social media and on packaging;
specify which product, characteristic or stage of the product life cycle each claim relates to;
compile up-to-date evidence supporting the claims and document the calculation methods used;
review offsetting claims, proprietary sustainability labels and future environmental targets;
ensure that product information flows properly from manufacturers to sellers and online stores; and
assign clear responsibility for approving and monitoring environmental claims.
The reform does not mean the end of sustainability communications. However, broad promises will increasingly need to be replaced with specific, understandable and verifiable information.
Folks helps companies identify risks related to environmental claims and packaging labels and build practical processes for marketing that complies with the new rules.
Anna Paimela
Partner
+358 40 1648626
If you would like to receive our articles directly in your inbox, subscribe to the Folks newsletter here.
Updated: Aug 5
Electronic direct marketing is a key part of sales and customer communications for many companies. However, newsletters, promotional emails and marketing automation only work when there is also a valid legal basis for sending them. Recently, automated marketing calls have attracted particular attention in supervisory practice. In practice, a company should answer three questions before sending a message: who is the recipient, does the message constitute marketing or customer communication, and what is the legal basis for sending it? Electronic direct marketing includes emails, text messages, multimedia messages, voice messages and automated calls used to market products or services to the recipient. The format of the message is not decisive. What matters is its purpose and content. If the objective is to promote the sale of a product or service, the message will generally constitute direct marketing.
A newsletter will usually constitute direct marketing if it contains offers, presentations of services, invitations to events, campaigns or other content intended to promote sales. Even content that appears purely informative may constitute marketing if its main purpose is to encourage the recipient to make a purchase, book a demonstration, download sales materials or attend a commercial event.
However, not every message sent to customers constitutes direct marketing. Order confirmations, delivery notifications, service interruption notices and other messages relating to the performance of a contract or the provision of a service are generally considered customer communications. If sales-oriented content is added to the message, it may nevertheless become direct marketing. For example, adding an offer to “upgrade to the premium version” to a service interruption notice may change how the message is assessed.
Marketing to a personal address generally requires prior consent
As a general rule, electronic direct marketing may only be sent to a natural person if they have given their prior consent. This is the main rule for electronic direct marketing aimed at consumers. The same applies, for example, to automated calling systems. Marketing through automated calls requires the recipient’s prior consent.
Consent must be freely given, specific, informed and unambiguous. In practice, the recipient must take an active step themselves, such as ticking a box to subscribe to a newsletter. A pre-ticked box, silence or the fact that the individual has not specifically objected to marketing does not constitute valid consent.
The requirement that consent be freely given does not necessarily prevent direct marketing consent from being linked to participation in a voluntary prize draw. The Finnish Data Protection Ombudsman has considered that consent to direct marketing requested as a condition for participating in a prize draw may be valid if participation is genuinely voluntary, choosing not to participate causes no detriment and the prize draw is not connected to a service that is essential to the data subject. However, the assessment must always be made on a case-by-case basis.
Separate consent is not always required. If a customer has purchased a product or service from a company and provided their electronic contact details in connection with the purchase, the company may, subject to certain conditions, market its own similar products or services to that customer.
However, this exception cannot be treated as a general authorisation for all marketing. It requires that the contact details were obtained directly from the customer in connection with a sale, that the marketing concerns the same company’s own products or services, and that the products or services being marketed are similar to the customer’s previous purchase. For example, if a customer has purchased a particular software service, it may, depending on the circumstances, be permissible to market additional features within the same service package or other similar services to them. The same contact details do not, however, permit the marketing of services offered by an entirely different group company, products offered by a business partner or products belonging to a completely different category.
The customer must also be given an easy and free opportunity to object to marketing both when their contact details are collected and in every subsequent marketing message.
In B2B marketing, it is not enough that the recipient works for a company
In business-to-business marketing, the assessment depends on the type of address to which the message is sent and the recipient’s role. As a general rule, electronic direct marketing may be sent without prior consent to general company addresses, such as info@company.com or sales@company.com. However, the message must still provide an opportunity to object to further marketing.
If the message is sent to a named individual, such as firstname.lastname@company.com, the sender must assess whether the product or service being marketed is materially related to the recipient’s professional duties. For example, marketing financial administration services to a person responsible for financial decision-making may be justified. The same message cannot, however, be sent as a precaution to every individual whose contact details can be found at the company.
The essential point is that the recipient’s role and the content being marketed must correspond with one another. A mere assumption that the recipient might be interested is not enough. In B2B marketing, it is also important to remember that a personal work email address does not become a freely available marketing channel simply because the address is publicly available or can be found on LinkedIn, a website or an event participant list. The sender must still be able to explain why the message sent to that particular person relates to their professional duties and why the marketing has been appropriately targeted.
Companies must be able to demonstrate consent
A company must be able to demonstrate the basis on which it sends electronic direct marketing. If the marketing is based on consent, the documentation should indicate at least when the consent was given, through which channel it was given, the type of marketing to which it applies and the information provided to the recipient when consent was requested.
Every electronic direct marketing message must include an easy and free method of objecting to the marketing or withdrawing consent, such as a functioning unsubscribe link. Withdrawing consent must be as easy as giving it. In practice, recipients should not be required to contact customer service separately or log in to a complicated system merely to unsubscribe from a newsletter.
Electronic direct marketing usually involves the processing of personal data, which means that the requirements of the General Data Protection Regulation also apply. The recipient must therefore be clearly informed about how their personal data is processed.
In practice, a company should ensure that its privacy notice explains who processes the personal data, the purposes for which the data is used, the legal basis for the processing, the source of the data, how long the data is retained and how the recipient can exercise their rights.
The regulation of electronic direct marketing does not prevent effective marketing, but it does require companies to handle the fundamentals carefully. Before launching a campaign, a company should verify where the recipients’ contact details came from, the legal basis for sending the messages and how marketing objections and withdrawals are implemented in practice.
Lila Kallio
Counsel
+358 41 465 1365
To receive our articles directly in your inbox, subscribe to the Folks newsletter here.