--- title: "Article 50 compliance checklist for SMEs: ten steps with the law behind each" canonical: "https://nordvec.com/blog/article-50-checklist-for-smes" lang: "en" claims: "https://nordvec.com/api/trust/claims" --- # Article 50 compliance checklist for SMEs: ten steps with the law behind each Source: https://nordvec.com/blog/article-50-checklist-for-smes This file is rendered from the same message catalogue as the page, at request time; the HTML page is the canonical document. Statements about the processing chain are bound to the claim record at https://nordvec.com/api/trust/claims, which says which of them the register currently supports. Rasmus Kjær Damgaard, Founder · Published August 3, 2026 This article was produced with AI assistance, and no review of it by a person is on record. Digital source type (IPTC): https://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia A working checklist for the EU AI Act's transparency duties: scope, role, triggers, exemptions, notices, marking, evidence. Each step cites its legal basis. **TL;DR:** Article 50 compliance for a typical SME is a bounded, checkable job: settle scope and role, identify which of the four duties your use triggers, test the exemptions honestly, put up the notices, verify your provider's marking, and keep the evidence. The ten steps below each cite their legal basis. Steps 1 through 4 are exactly what our free [Article 50 checker](/tools/article-50-checker) automates, and steps 5 through 10 land in the policy our [AI policy generator](/tools/ai-policy-generator) produces. ## The checklist [#the-checklist] 1. **Confirm scope (Art. 2).** The Act reaches systems placed on the EU market, put into service in the EU, or whose outputs are used in the EU. Outputs used here are enough, wherever the system runs. 2. **Settle your role per system (Art. 3).** Deployer for the vendor tools you use under their branding; provider for anything you build, and, the commonly missed case, for any third-party model you offer under your own name or trademark. 3. **List your triggers.** People interacting directly with AI (50(1)), synthetic content generation (50(2)), emotion recognition or biometric categorisation (50(3)), deepfakes or AI-written public-interest text (50(4)). Several can be true at once. 4. **Test exemptions as the cumulative tests they are.** Obviousness for a reasonably well-informed person (50(1)); standard editing including machine translation, per the Commission's final Guidelines (50(2)); the three-condition business carve-out (50(2)); human review plus editorial responsibility (50(4) text); evidently artistic works get a reduced, not removed, duty (50(4) deepfakes). Unsure means the duty applies. 5. **Put up the interaction notice.** Clear, at the latest at first interaction, accessible (50(5)). 6. **Verify your provider's machine-readable marking.** Ask for the documentation; remember their embedded marking never satisfies your own visible disclosure duties. 7. **Check the transitional date honestly.** Systems on the market before 2 August 2026 have until 2 December 2026 for the 50(2) marking duty only; everything else applies now. 8. **Label what needs labelling.** Deepfake disclosures the audience can actually perceive; a label on AI-written public-interest text unless the editorial-responsibility test genuinely holds. 9. **Keep the evidence record.** Notice copies, placement screenshots, timing, accessibility, provider marking documentation, editorial-control records. This is what you show a supervisory authority or an enterprise customer. 10. **Write it into your AI policy and train on it.** The duties, the approved-tools register that operationalises them, and the Art. 4 literacy hook that has applied since February 2025. ## The fine print worth knowing [#the-fine-print-worth-knowing] Penalties for Article 50 violations reach EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher; for SMEs the cap reverses to the **lower** of the two (Art. 99(6)). In Denmark, which authority supervises Article 50 is not yet settled; the duties and levels follow the Regulation itself either way. ## Do steps 1 to 4 with the checker [#do-steps-1-to-4-with-the-checker] Our [Article 50 checker](/tools/article-50-checker) runs the scope gate, the role branch and the cumulative exemption tests, and returns an evidence record with citations per finding. It runs entirely in your browser, and nothing you answer leaves your device. ## Sources [#sources] - [Regulation (EU) 2024/1689, Articles 2, 3, 50, 99](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689#art_50) - [Commission Guidelines on transparency obligations (adopted 20 July 2026)](https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems) - [Commission FAQ on Article 50](https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act) - [Our full Article 50 guide](/blog/eu-ai-act-article-50) ## Frequently asked questions ### Where should an SME start with Article 50? With scope and role: is your AI use in the EU at all (Art. 2), and are you a provider or a deployer for each system? Everything downstream, duties, exemptions and deadlines, depends on those two answers. A structured checker settles both. ### Do SMEs get lighter Article 50 obligations? The duties are the same, but the fine cap reverses: for SMEs the maximum is the LOWER of EUR 15,000,000 or 3% of worldwide turnover (Art. 99(6)), where larger companies face the higher of the two. ### What evidence should we keep? A copy of each disclosure text, where it is shown, that it appears at first interaction, its accessibility, your provider's marking documentation, and your editorial-control record if you rely on that exemption. An evidence record is what an audit can check. ### What if we are not sure whether an exemption applies? Treat the duty as applying until the exemption is established. The exemptions are cumulative tests with specific criteria; an unanalysed exemption is not an exemption. [All articles](/blog)