Authorised access to an interface is just that.

If your organisation has permission from the other organisation to use the XML interface (which neither enforces a disclaimer nor proffers one) then you've fulfilled your obligations as a developer (unless your organisation is located in a country with extremely strong privacy laws - I believe Germany and France are examples - where you may be requred to make sure that your code is compliant with privacy statutes).

If your management feels that the disclaimer (from the non-XML interface) contains information that would be truly important (legally) to your users (and that isn't covered by in-house handbooks or guides), you might have your legal department draft a disclaimer for your own organisation which can be displayed by your application.

Displaying the other organisation's disclaimer does nothing to cover you nor your organisation.

-David