Most corporate AI disclosure policies get written backwards. A legal or compliance team decides whether a deployment feels risky enough internally to warrant a customer-facing warning, and if the model is framed as "just a recommendation engine" reviewed by a human, the conversation usually stops there. Dr. Jonah Tebaa argues that this framing gets the entire question upside down — and that the mistake is now colliding with tightening regulation across both the EU and the GCC.
In a recent piece on his approach to AI governance, Tebaa walks through a scenario that will be familiar to anyone who has sat in a bank's credit or risk committee: an AI scoring layer flags loan applications below a threshold for "further review," and in practice, that review is a junior analyst confirming the model's rejection in under ninety seconds, in the large majority of cases, without re-examining the file. The applicant gets a form letter. No one discloses that a model was involved, because a human technically signed off.
The Test He Says Most Organizations Are Applying Wrong
The core of Tebaa's argument is that organizations tend to ask the wrong question when deciding whether to disclose AI involvement in a decision. They ask whether the deployment feels cautious, well-tested, and internally defensible — essentially, whether the team building it is comfortable with it. Tebaa's position is that this internal comfort level says nothing about the experience of the person affected by the decision, and that disclosure obligations should be anchored to that person's stakes, not the deployer's confidence.
In place of the comfort test, he proposes what he calls the Disclosure Test, built on three questions. He argues that when at least two of the three are true, an organization owes the affected person an explanation:
- Whether the outcome materially affects the person's money, opportunity, health, or reputation.
- Whether the model substantially shaped the outcome, as opposed to a human genuinely reviewing it independently rather than deferring to the score under time pressure.
- Whether the person, if informed, could actually do something with that knowledge — appeal, correct a record, negotiate, or take their business elsewhere.
Applied to the bank scenario, Tebaa notes that all three conditions are met: the rejection is financially material, the analyst's ninety-second confirmation does not amount to independent review, and an informed applicant could correct an underlying error or request genuine reconsideration. He frames this not as a close call but as a case that only appears ambiguous because institutions are applying the wrong test to begin with.
Reframing Disclosure as Design, Not Confession
What distinguishes Tebaa's argument from a purely compliance-driven take is his insistence that disclosure, done well, is a narrow and specific act rather than a sweeping one. He is critical of two failure modes he sees playing out in parallel across industries: organizations that disclose nothing because a human was nominally in the loop, and organizations that over-disclose everywhere as a defensive reflex, burying the meaningful instance in generic boilerplate about "AI may be used" that customers learn to ignore.
His alternative is closer to product design than legal drafting: a single plain sentence, delivered at the moment it matters, paired with a concrete path for the person to act on it — for instance, a note that an automated risk assessment contributed to a decision, alongside a clear route to request manual review of the specific factors involved. In his view, this kind of disclosure builds trust rather than eroding it, because it treats the affected person as someone capable of acting on information rather than someone to be managed around.
Why He Thinks the Timing Matters Now
Tebaa situates the argument squarely in the current regulatory moment. With EU AI Act enforcement advancing and data-protection authorities across the GCC sharpening their expectations around automated decision-making, he suggests that executives in banking, HR, healthcare, and lending are past the point of treating disclosure as a hypothetical policy question. Customers, he notes, have already started asking directly whether a machine was behind a given decision — and organizations that wait for a regulator or a legal complaint to force an answer will be doing so under considerably worse terms than the ones available to them today.
The through-line in Tebaa's thinking is a shift in whose experience defines the obligation. Not the model's accuracy, not the internal review process, not how the deployment is described in a compliance memo — but what happens to the person standing on the other side of the decision, and whether they would still have a path forward if they understood what had actually decided their outcome.