AI Act2 November 2026DILAIG

OCR, LLMs and the AI Act: Must You Tell Your Client?

Processing client documents with OCR coupled to an LLM? The AI Act rarely requires disclosure; the GDPR and your contracts far more often do.

Article written with the help of artificial intelligence — learn more about Article 50

Last updated: November 2026 · Reading time: 6 minutes

In short. In the most common case, background data extraction, the AI Act does not require you to tell your client that their documents go through OCR and an LLM. The GDPR, professional secrecy and your contracts often do. And if the tool feeds a decision about a person, such as a loan or a hiring, the analysis changes completely.

Invoices, ID documents, payslips, contracts. More and more firms, insurers and local authorities have these documents read by OCR, then structured by a large language model. The question comes up in every audit. Must the client be told?

Step 1. Is your OCR and LLM chain an AI system?

Template-based OCR with fixed layouts can stay outside the definition. As soon as a learned model recognises the characters or an LLM classifies, summarises or extracts fields, you are dealing with an AI system.

Your role depends on where the tool comes from. If you buy it, you are a deployer. If you assembled it yourself and use it for your business, you are putting it into service and become a provider, even if you never sell it.

Step 2. What Article 50 requires, and why it rarely targets OCR

Article 50 groups together the AI Act's transparency obligations, applicable since 2 August 2026. It contains four, and none directly targets background document extraction.

Paragraph	What it requires	Applies to OCR and LLM extraction?
50(1)	Inform a person that they are interacting with an AI	No, unless the client submits documents through a conversational assistant
50(2)	Mark generated content in a machine-readable format	Provider obligation, excluded where the system does not substantially alter the input data
50(3)	Inform people exposed to emotion recognition or biometric categorisation	No
50(4)	Flag deepfakes and generated text published to inform the public	No, internal processing is not publication

Paragraph 2 deserves a word. A faithful transcription does not alter the substance of the document. The Commission's final guidelines, published on 20 July 2026, also exclude short outputs, machine-to-machine outputs and intermediate steps in a closed workflow. And when it does apply, this paragraph requires technical marking, not informing the client.

Step 3. When the answer changes: decision-making use

Everything shifts if the extracted data is used to decide about a person in an Annex III area. This is the case for creditworthiness assessment, life and health insurance pricing, eligibility for public benefits or application screening.

The system is then probably high-risk. The Article 6(3) exception may cover a purely procedural extraction that does not materially influence the decision, but never a system that performs profiling.
From 2 December 2027, a deployer that takes or helps take decisions concerning individuals will have to inform them that they are subject to a high-risk system (Article 26(11)).
A person affected by a deployer's decision based on such a system, producing legal effects or similarly significantly affecting them, will be able to obtain from the deployer clear explanations of the role of the AI in the procedure and the main elements of the decision (Article 86).
A FRIA will be required from public bodies and private companies providing a public service, as well as deployers of systems assessing creditworthiness or pricing life and health insurance.

Step 4. What the GDPR already requires

Your documents almost always contain personal data. The GDPR then applies in full, independently of the AI Act.

Informing individuals (Articles 13 and 14). Your privacy policy must mention the recipients or categories of recipients, including the OCR or LLM provider, and any transfers outside the EU.
Processing contract (Article 28). It must rule out reuse of the data to train models and specify where the data is located.
If you are yourself your client's processor, for example for payroll or accounting, you need their prior written authorisation, specific or general, and must inform them of any new sub-processor so they can object. Here, informing the client is not optional.
Impact assessment (Article 35) if the processing is likely to result in a high risk, for example if it involves sensitive data on a large scale.
Automated decision-making (Article 22) if the tool decides alone with a legal effect on the person.

Step 5. Professional secrecy and contracts

Lawyers, accountants, healthcare professionals. Professional secrecy requires you to control every provider with access to the documents. In France, entrusting the hosting of health data to a third party also requires a certified HDS provider. Finally, re-read your engagement letters and client contracts, which sometimes forbid any subcontracting without consent.

The answer by situation

Situation	AI Act	GDPR and contract
Invoice extraction between businesses, no sensitive personal data	No disclosure required	Mention in the privacy policy if personal data is processed
You process the data on behalf of your client	No disclosure required	Client's prior written authorisation
The client submits documents through a conversational assistant	Disclosure mandatory (50(1))	GDPR information
Extraction feeds a credit, insurance, hiring or benefits decision	Probably high-risk, informing individuals on 2 December 2027	Article 22, impact assessment
Medical documents	Depends on use	HDS host, impact assessment

Our recommendation: tell them anyway

Even when nothing requires it, a sentence in your engagement letter or terms and conditions costs little and reassures. Public buyers and large accounts increasingly ask for it. Here is an example to adapt with your counsel.

Some documents you send us are processed by an optical character recognition and automated analysis tool based on artificial intelligence. This processing is carried out under our control, by a provider bound by a processing contract that rules out any reuse of your data to train models. Every result is checked by a member of our team before use.

FAQ

Does the AI Act require me to tell my clients I use OCR?

No, in the case of background extraction. The obligation arises if the client interacts directly with the AI, or if the tool is used for a high-risk decision from 2 December 2027.

Must an LLM-generated summary sent to the client carry a notice?

Not under the AI Act for the deployer, as long as it is not a text published to inform the public. Technical marking falls on the provider of the generative AI system.

Does the GDPR require me to name my LLM provider?

It requires stating the recipients or their categories, and transfers outside the EU. If you are your client's processor, you must obtain their authorisation before using the provider.

Must I train staff who use the tool?

Yes. Article 4 requires measures to support their AI literacy, in particular checking the extracted results.

What now?

The free DILAIG audit qualifies your OCR and LLM tool and checks Article 50 and high-risk status. With the paid plans, including the Essential plan with its first month free, DILAIG generates a transparency notice ready to include in your client documents.

Start the free audit · See the plans · Generated documents

Do your clients know today that their documents go through an AI?