Missing information for deployers and users

What it is

A system is safe to use only within limits, and the people using it have to know what those limits are. They need to be told what the system is for, what it should not be used for, how accurate it is and for whom, what its outputs mean, when to distrust it and what checking is expected of them. Developers know these things, and the knowledge often stops with them. This entry concerns information passed to operators and users inside an organisation, or from an organisation to those who use its system. Information that a supplier fails to give is covered in missing provider documentation.

How it happens

• The system is released with a guide to its features and nothing on its limitations.
• Known weaknesses found in testing are recorded in a validation report users never see.
• The meaning of a score or confidence figure is not explained.
• Instructions are not updated when the system changes.

Why it matters

Users treat the system as more capable than it is, apply it outside its purpose, and omit the checks its designers assumed. For high-risk systems the EU AI Act requires providers to supply instructions for use and deployers to follow them.

Warning signs

• Users cannot say what the system should not be used for.
• No document for users states the system's accuracy or known limitations.
• Staff interpret the same score in different ways.
• Guidance predates the current version.