Article 13: Transparency and Instructions for Use Explained

If you provide a high-risk AI system, Article 13 is the obligation that makes your deployer able to use it safely. It requires two things: the system must be sufficiently transparent for deployers to interpret its output and use it appropriately, and it must come with instructions for use that tell the deployer everything they need to run it within the law. This is a provider duty, owed to the deployer — and it is a different obligation from the public-facing transparency of Article 50. The high-risk version applies from 2 December 2027.

This page explains what Article 13 actually demands, what must go in the instructions, and why it is not the same as Article 50.

---

What Article 13 requires

Article 13 has two limbs.

Limb one — interpretability. High-risk systems must be designed and developed so their operation is sufficiently transparent to enable deployers to interpret the system's output and use it appropriately. The output should not be an unexplained number; the deployer must be able to understand what it means and act on it sensibly. This is what makes the deployer's own duties — human oversight under Article 14, monitoring under Article 26 — actually possible. A system whose output a deployer cannot interpret cannot be overseen.

Limb two — instructions for use. The system must be accompanied by instructions for use in an appropriate format, containing concise, complete, correct and clear information that is relevant, accessible and comprehensible to deployers. The instructions are the contractual-grade handover document; if they are missing or wrong, the provider has breached Article 13, regardless of how good the model is.

---

What goes in the instructions for use

Article 13 specifies the content. The instructions for use must include, among other things:

• the identity and contact details of the provider (and any authorised representative);
• the system's characteristics, capabilities and limitations of performance — including its intended purpose, the level of accuracy (and the relevant accuracy metrics), robustness and cybersecurity, and any known or foreseeable circumstance that may affect those;
• known or foreseeable circumstances that may lead to risks to health, safety or fundamental rights;
• where relevant, the system's behaviour on specific persons or groups, and input-data specifications;
• the human-oversight measures built in under Article 14, including the technical measures that help deployers interpret the output;
• the expected lifetime of the system and any necessary maintenance and care measures, including software updates;
• a description of the mechanisms that let deployers collect, store and interpret the logs, where relevant.

In plain terms: the provider must hand the deployer a document that says who built it, what it is for, how well it works, where it breaks, how to keep a human in the loop, how long it lasts, and how to maintain it. Anything a deployer needs to run the system within the rules belongs here.

---

Article 13 vs Article 50 — don't conflate them

This is the distinction that trips people up. Both articles use the word "transparency", but they protect different people and bind different actors.

Article 13 is provider-to-deployer transparency for high-risk systems: give the professional user the means to operate the system correctly. Article 50 is public-facing transparency for limited-risk systems: tell a person they are talking to a chatbot, mark AI-generated content as machine-readable, disclose a deepfake. A chatbot that is only limited-risk owes Article 50, not Article 13. A high-risk diagnostic tool owes Article 13 to its hospital deployer — and, if it also generates synthetic media or interacts with patients directly, may owe an Article 50 duty too. Different obligations, different triggers; check whether one, the other, or both apply.

Both, incidentally, sit in the same penalty band: breaches of Article 13 and Article 50 fall under Article 99(4) — up to €15 million or 3% of total worldwide annual turnover.

---

Worked example: MedSignal GmbH

MedSignal GmbH is a Munich medtech provider, ~45 employees, ~€7M turnover, selling a high-risk clinical-triage AI to hospitals. Article 13 is its handover obligation. MedSignal must design the triage output so a clinician can interpret it — a "priority score" with the factors that drove it, not a bare number — and ship instructions for use that state the intended purpose (triage support, not diagnosis), the validated accuracy and its limits, the patient groups where performance is weaker, the human-oversight measures the clinician must apply under Article 14, the expected lifetime and update cadence, and how to read the logs.

If MedSignal also runs a patient-facing chatbot to collect symptoms, that component additionally owes an Article 50(1) disclosure that the patient is interacting with AI — a separate, limited-risk duty layered on top. Skipping the Article 13 instructions would expose MedSignal to Article 99(4): up to €15 million or 3%, capped for an SME at the lower figure under Article 99(6).

---

How Confir helps

Confir assesses transparency and human oversight as one of its four review areas (Articles 13, 14, 27 and 50), so a provider sees the Article 13 instruction-for-use requirements and the deployer-interpretability test alongside any Article 50 duty that also applies — and isn't left conflating the two. It assembles the instructions-for-use content against the Article 13 checklist and the Annex IV documentation pack. The engine is deterministic and rule-based: same intake, same finding, each cited to the article that fired.

Related guides

• Article 13 in the regulation
• Article 50 limited-risk transparency
• Instructions for use, explained
• The transparency obligation
• Human oversight under Article 14
• Provider obligations under the EU AI Act