Do you have to tell the customer AI was used? Five questions to find the UK rule for your case

A firm has used an AI tool for a piece of work and wants to know whether the customer has to be told. No single UK rule answers that, because the answer depends on what the work is: a letter, a chatbot, an advert, a review or a decision about a person. This questionnaire asks what the AI was used for and then one or two questions about that use. It gives one of eight outcomes with the rule behind it, from UK GDPR, the Digital Markets, Competition and Consumers Act 2024, the ICO and the ASA, each read at its source on 2 October 2026. Nothing you choose leaves the page.

Free tool

Telling customers about AI: which rule applies

Answer each question. Some questions appear only when an earlier answer makes them relevant. Nothing you choose leaves this page.

1. What was the AI tool used for?ChooseAn email, letter or document that a person sendsA chatbot or automatic reply that the customer talks toAn advert, image or marketing postA customer review or testimonialA decision about a person: accept, refuse, price or shortlist
2. Did the customer's personal details go into the tool, or does it collect them?ChooseYes, a name, address, order or account detailsNo, nothing that identifies a person
3. Could people be misled about the product or a person if they did not know AI made it?ChooseYes, or it shows a result or person that is not realNo, it shows the product as it is
4. Does the decision have a legal or similarly significant effect on the person?ChooseYes: credit, a job, a tenancy, insurance or a priceNo: a suggestion or a sort order with little at stakeNot sure
5. Does a person look at each decision, with the power to change it, before it takes effect?ChooseYes, a named person reviews each one and can change itNo, or the person approves them unread

Start again

The outcome is the rule as our guides and the sources named set it out, applied to the answers you gave. It is not advice on your own case.

Works in your browser. Nothing you type leaves this device.

The questions, and why each is asked

1. What was the AI tool used for? The rules differ by use. Data protection law covers what happens to a person's details, consumer law covers what a customer is told, and the advertising codes cover adverts however they were made.

2. Did the customer's personal details go into the tool, or does it collect them? The ICO says a privacy notice must give the recipients of personal data, including anyone that processes it on the firm's behalf, and that privacy information is due when data is collected from the person. This question appears only when an earlier answer makes it relevant.

3. Could people be misled about the product or a person if they did not know AI made it? The ASA asks whether the audience is likely to be misled if the use of AI is not disclosed. Its examples are an image of results a product cannot give and a celebrity endorsement that never happened. This question appears only when an earlier answer makes it relevant.

4. Does the decision have a legal or similarly significant effect on the person? Article 22A of UK GDPR covers significant decisions. The ICO's examples of a similarly significant effect are the automatic refusal of an online credit application and e-recruiting with no meaningful human involvement. This question appears only when an earlier answer makes it relevant.

5. Does a person look at each decision, with the power to change it, before it takes effect? Article 22A says a decision is based solely on automated processing if there is no meaningful human involvement. The ICO's draft guidance says involvement must be active and not just a token gesture. This question appears only when an earlier answer makes it relevant.

Every outcome, and the rule behind it

It cannot be posted, with or without a label

Reached when: "What was the AI tool used for?" answered "A customer review or testimonial".

Paragraph 13 of Schedule 20 to the Digital Markets, Competition and Consumers Act 2024, in force since 6 April 2025, bans submitting a fake consumer review or commissioning someone to write one. A fake consumer review is one that purports to be, but is not, based on a person's genuine experience, and the Schedule says writing includes creating by any means. A review written by an AI tool and posted as a customer's is banned whether or not it says AI was used.

• Take down any review or testimonial that no real customer wrote.
• Ask real customers for reviews; one given in return for a reward must make that plain.
• Use AI only to draft the firm's own reply to a review, signed as the firm.

Source: Digital Markets, Competition and Consumers Act 2024, Schedule 20, paragraph 13, legislation.gov.uk, read 2 October 2026. The working is in Do you have to tell customers you used AI? What UK rules say about emails, chatbots, adverts and automated decisions.

You must tell the person, and offer them a human

Reached when: "What was the AI tool used for?" answered "A decision about a person: accept, refuse, price or shortlist"; "Does the decision have a legal or similarly significant effect on the person?" answered "Yes: credit, a job, a tenancy, insurance or a price" or "Not sure"; "Does a person look at each decision, with the power to change it, before it takes effect?" answered "No, or the person approves them unread".

A significant decision taken with no meaningful human involvement falls under Articles 22A to 22D of UK GDPR, fully in force since 5 February 2026. Article 22C says the firm must give the person information about the decision, let them make representations, let them obtain human intervention and let them contest it. Where a firm cannot be confident which decisions have a significant effect, the ICO's draft guidance says to apply the safeguards to all of them.

• Tell the person, when the decision is given, that software made it and what it was based on.
• Give a name and address for asking a person to look at the decision again.
• Say in the privacy notice that decisions of this kind are made by software.
• Check whether a data protection impact assessment has been done for the tool.

Source: UK GDPR Articles 22A and 22C, legislation.gov.uk; ICO draft guidance, Automated decision-making, including profiling; read 2 October 2026. The working is in Do you have to tell customers you used AI? What UK rules say about emails, chatbots, adverts and automated decisions.

The automated decision rules do not bite while the review is real

Reached when: "What was the AI tool used for?" answered "A decision about a person: accept, refuse, price or shortlist"; "Does a person look at each decision, with the power to change it, before it takes effect?" answered "Yes, a named person reviews each one and can change it".

Articles 22A to 22D of UK GDPR, fully in force since 5 February 2026, apply to a decision based solely on automated processing, meaning one with no meaningful human involvement. A named person who looks at each decision and can change it takes the firm outside them. The ICO's draft guidance says that involvement must be active and not just a token gesture, so a person who approves every result unread does not count. The privacy notice still has to say who receives the person's data.

• Write the reviewer's name into the firm's AI policy, with the decisions they review.
• Keep a note of each decision the reviewer changed, to show the review is real.
• Name the AI supplier, or its category, in the privacy notice.

Source: UK GDPR Article 22A, legislation.gov.uk; ICO draft guidance, Automated decision-making, including profiling; read 2 October 2026. The working is in AI policy for a small UK firm.

Not a significant decision, so no duty to tell under Article 22C

Reached when: "What was the AI tool used for?" answered "A decision about a person: accept, refuse, price or shortlist".

The safeguards in Articles 22A to 22D of UK GDPR apply to significant decisions: those with a legal or similarly significant effect on the person. The ICO's example of one that normally falls outside is a video service recommending what to watch next. With no person involved and nothing significant at stake, Article 22C does not require the firm to tell anyone. The ICO adds that the same kind of decision can be significant for some people and not for others.

• Write down why the decision is not significant, and keep the note.
• Look again if the tool starts to affect price, credit, a job or access to a service.
• Name the AI supplier, or its category, in the privacy notice if personal data goes in.

Source: UK GDPR Article 22A, legislation.gov.uk; ICO draft guidance, What does the UK GDPR say about ADM?; read 2 October 2026. The working is in Do you have to tell customers you used AI? What UK rules say about emails, chatbots, adverts and automated decisions.

A label will not rescue it: change the advert

Reached when: "What was the AI tool used for?" answered "An advert, image or marketing post"; "Could people be misled about the product or a person if they did not know AI made it?" answered "Yes, or it shows a result or person that is not real".

The ASA said on 29 May 2025 that disclosure alone is very unlikely to mitigate the harm caused by a fundamentally misleading message. Its example is an AI-generated image of a cosmetic product's effect that does not reflect real-world results. On 11 June 2026 it added that an AI-generated celebrity endorsement real enough to mislead is likely to breach the code, and that the advertiser remains responsible for any AI output used in its ads.

• Replace the image or claim with one that shows what the product does.
• Get written permission before using a real person's face, voice or name.
• Have one named person check every AI-made advert before it runs.

Source: ASA and CAP, Disclosure of AI in Advertising (29 May 2025) and AI and Deepfakes (11 June 2026), read 2 October 2026. The working is in Do you have to tell customers you used AI? What UK rules say about emails, chatbots, adverts and automated decisions.

No label is required on the advert

Reached when: "What was the AI tool used for?" answered "An advert, image or marketing post".

The ASA said on 29 May 2025 that there is no blanket legal requirement in the UK to disclose the use of AI in ads. The advertising codes have no AI-specific rules, and the existing ones apply in the same way however the advert was made. The test is whether the audience is likely to be misled if the use of AI is not disclosed. An advert that shows the product as it is passes that test without a label. The ASA has said its approach may change.

• Check every claim and image in the advert against the real product before it runs.
• Keep the prompt and the final file with the campaign records.
• Record in the firm's AI policy whether adverts will carry a label anyway.

Source: ASA and CAP, Disclosure of AI in Advertising: Striking the Balance Between Creativity and Responsibility (29 May 2025), read 2 October 2026. The working is in Do you have to tell customers you used AI? What UK rules say about emails, chatbots, adverts and automated decisions.

No label on the message, but the privacy notice must name the supplier

Reached when: "Did the customer's personal details go into the tool, or does it collect them?" answered "Yes, a name, address, order or account details".

UK GDPR is about what happens to a person's data, not about who or what chose the words. The ICO's guidance on the right to be informed says a privacy notice must give the recipients of personal data, and that this includes anyone that processes it on the firm's behalf. An AI supplier that receives customer details is one of them. A chatbot that takes a name or an order number must also give privacy information at the time it collects it.

• Add the AI supplier, or the category it falls in, to the recipients section of the privacy notice.
• Link the privacy notice from the chatbot's first screen if it asks for personal details.
• Check the tool is on a business plan with a data processing agreement in place.

Source: ICO, What privacy information should we provide?, read 2 October 2026. The working is in Is it legal to put customer data into ChatGPT, Claude or Copilot? What UK GDPR asks of a small firm first.

No UK rule requires you to say AI was used

Reached when: any other set of answers.

With no personal data in the tool, nothing we read in the ICO's pages, the ASA's pages or the Digital Markets, Competition and Consumers Act 2024 requires a label on an AI-drafted letter or a chatbot. Section 226 of that Act, in force since 6 April 2025, still makes it a misleading action to give a consumer false or misleading information, so a chatbot must not invent a price or a right. Whether one that claims to be a person misleads is our reading, not a ruling.

• Have a person check every figure, date and promise before a letter or email goes out.
• Do not let a chatbot say it is a person; an opening line that says it is automated is a safe choice.
• If the chatbot serves customers in the EU, check the EU AI Act's transparency rules.

Source: Digital Markets, Competition and Consumers Act 2024, section 226, legislation.gov.uk, read 2 October 2026; ICO and ASA pages named in the linked guide. The working is in Do you have to tell customers you used AI? What UK rules say about emails, chatbots, adverts and automated decisions.

How to use the result

Answer for one use at a time; a firm that runs a chatbot and also sends AI-drafted letters should go through it twice. Where the outcome is a duty, the list under it is what to put in place before the next customer is affected. Where no rule applies, telling customers anyway is the owner's choice, and the place to record that choice is the firm's AI policy. A regulated firm should check its own regulator's rules as well, because they can ask for more. Run it again when the firm starts a new use.

The outcome applies the rule to the answers given; it cannot see the facts behind them. Where an answer is a judgement, or the facts are unusual, the outcome may not fit. This page is general information, not legal advice.

Overlyft is an AI agency that sets up AI office assistants for small firms in ten trades: the work is priced after a fixed-price audit, the firm pays Anthropic directly for its own Claude plan, and a person approves anything that goes to a customer.