Case Study 2 of 4SHIPPEDAI Disclosure & Consent System
In May 2026, outside AI-law counsel audited every AI product at Ecolab: the products were out of compliance, and nobody knew what compliance would look like inside the product.
3 wk
From audit to a legal-approved standard: 80 to 90 hours studying AI law and enterprise AI legal patterns, most of it on my own time, then two weeks of design
1 review
One round with outside AI-law counsel, approved on the first pass and robust enough to satisfy the conditions of the entire audit
8
Disclosure and consent patterns in one system, adopted by Legal, engineering, product and the design department, with guidance that keeps future products in compliance as the law changes
With AI legal requirements still ambiguous, I created a system with thorough guidance, not just static components, so the current AI products came into compliance and future products could stay there. It had to reduce risk proactively, for both Ecolab and its users.
I designed it on two separate axes:
Constraints
In May 2026, a month after the assistant in Case Study 1 went live, outside legal counsel who specialize in AI law audited all of Ecolab’s AI products. The design department learned the results in a one-hour meeting with the lawyer:
I disagreed. I had already been studying the AI laws established so far and the AI legal patterns enterprises had put in place to meet them, and not only for chatbots. That distinction mattered: much of the organization believed AI meant agentic and agentic meant chat, so anything outside a chat window was assumed to be out of scope. It is not. A large part of the work was responsible AI guidance and education, not just design.
What the system had to work within:
It was frustrating for many people. For me, it was a lot of fun.
I separated what a message is from how loudly it speaks, so every new AI moment becomes one of eight predefined patterns instead of a debate.
This moment lands in
Disclaimer · Base
"AI-generated" on every response and insight card.
Disclaimer · Info
"Summarized by AI from your site data. Check the source."
Disclaimer · Caution
"Confidence is low. Verify before acting."
Disclaimer · Critical
The action is withheld and routed to a human.
Disclosure · Base
"You're working with an AI assistant." Acknowledge to continue.
Disclosure · Info
"Open full-screen?" The assistant offers; the user chooses.
Disclosure · Caution
A pre-filled case is reviewed and edited before it's sent.
Disclosure · Critical
Consequence first. "Cannot be undone." The one way back is named before the choice.
In chat: A message container with a color hierarchy and, for disclosures, checkboxes and buttons.
On the canvas: A modal, banner or notification that interrupts on purpose.
Color shows how serious the level is. Icons show who speaks and who acts.
Base
Always on.
Info
Worth knowing.
Caution
Verify first.
Critical
Stop and decide.
smart_toy
Disclaimer
Informs. Nothing to do.
AI Label
"AI-generated" on every response and insight card.
Source Note
"Summarized by AI from your site data. Check the source."
Low Confidence
"Confidence is low. Verify before acting."
Safety-Critical
The action is withheld and routed to a human.
smart_toyperson
Disclosure
The user must act.
First Use
"You're working with an AI assistant." Acknowledge to continue.
Mode Shift
"Open full-screen?" The assistant offers; the user chooses.
Review Before Submit
A pre-filled case is reviewed and edited before it's sent.
Irreversible Action
Consequence first. "Cannot be undone." The one way back is named before the choice.
Logged · name + time
Color shows how serious the level is. Icons show who speaks and who acts.
The diagram is the system: how loud it is across the top, what it is down the side.
The cell decides the anatomy, and the anatomy is one component with settings. That is why engineering could build it once and Legal could review it once: there is nothing to argue about in the fifth new AI feature that was not already settled in the first.
I gave the highest-stakes moment its own pattern, because when an agent can act for the user, a yes or no is not enough: the consequence and the way back come first.
The irreversible-action consent pattern received featured treatment because it is where the stakes are highest. Its anatomy is fixed, and its order matters:
Destructive actions add an acknowledgment checkbox that is never pre-checked. The primary button stays disabled until it is checked, Cancel is always available, and the action is recorded with the user’s name and a timestamp.
The user reads what will happen before they see a choice, and knows the escape hatch exists before they decide. It is the mode-shift consent line from Case Study 1 at a higher severity, and in Case Study 4 it is the gate before the agent rearranges a dashboard.
I argued in their vocabulary (statute, precedent and exposure) rather than in design vocabulary, and I wrote it all down so it could outlive me.
The system came with an enterprise reference guide. For each of the eight patterns it gives:
The guide is why a designer with no authority over Legal got a first-pass approval from outside counsel: it did not ask them to trust a design; it showed them the law the design came from. It shipped with the spec pages engineering needed: the 2×4 grid as a one-pager, the consent-modal and card anatomies, and the first-run flow (sign-in, terms, AI consent) for desktop and mobile.
Adoption followed the same logic:
I was told afterward that counsel was shocked at the level of detail, comprehensiveness and thoroughness in the system, and that it was clear to her that I cared. That meant a great deal, because the care was for the user.
The same principle (AI proposes, the user decides) runs through the Insights & Recommendations cards that shipped in Ecolab3D. Each card carries what the agent observed, its source, the problem, the impact level (low, medium, high or safety), the justification and a recommended action. The user reviews, approves, defers, edits, comments or tags someone, and the decision is recorded as the card moves through new, reviewed, approved and deferred states. Deferral carries no penalty, because a user on a site cannot always act right now. That card anatomy is the subject of Case Study 4.
Disclosure, consent, confidence, feedback and escalation are not five separate components. They are one system, and its job is the user’s safety as much as their trust:
One round with outside AI-law counsel, May to June 2026. The system was robust enough to satisfy the conditions of the entire audit of Ecolab's AI products, and the products came into compliance with existing U.S., E.U. and international AI law.
From audit to standard: the hours studying AI law and enterprise AI legal patterns were mostly my own time; the design itself took two weeks.
Legal, engineering, product and the designers across the department adopted it with no mandate, on the strength of the guide. The Insights & Recommendations cards shipped inside Ecolab3D.
Dates and the review outcome are from my own project records. Law references are verified against the primary sources before publish. No card review-rate or was-this-accurate data is published because I do not have it.
