AI service gives users no information for proper use (how it works, limits, prohibited uses, data policy, reliability) and no sources for its answers

Link a use-information notice from the AI feature and return the sources each generated answer relied on to the user.

Two pieces. In the AI feature's interface, a short notice or link (an 'About this AI' panel, help page or terms section) that states how the service works and its limits, the uses it must not be put to, the policy for the data it collects and trains or learns on, a caution that output can be wrong and how far to rely on it, and where to send questions. In the answer path, when the reply is built from retrieved documents or web search, return the source list with the answer (citations, URLs or document ids from the retriever or the model's annotations) and render it next to the reply instead of discarding it.

Where it goes: 9 AI output handling, 14 user-facing text.

What reviewers look for: the AI feature's UI links or renders the use-information notice with all four elements; the response schema of a retrieval or web-search answer carries sources and the UI renders them.

@app.post('/ask')
def ask(body: AskIn):
    r = client.responses.create(model=M, tools=[{'type': 'web_search'}], input=body.question)
    return {'answer': r.output_text}

@app.post('/ask')
def ask(body: AskIn):
    r = client.responses.create(model=M, tools=[{'type': 'web_search'}], input=body.question)
    sources = [a.url for item in r.output if item.type == 'message'
               for c in item.content for a in (c.annotations or []) if a.type == 'url_citation']
    return {'answer': r.output_text, 'sources': sources, 'about_ai': '/help/about-this-ai'}

Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.