Article 50 compliance checklist for SMEs: ten steps with the law behind each

Rasmus Kjaer Damgaard, Co-founder · 3. elokuuta 2026

Tämä artikkeli on tuotettu tekoälyn avustuksella ja ihmisen tarkastama. Rasmus Kjaer Damgaard vastaa sisällön toimituksellisesta laadusta.

TL;DR: Article 50 compliance for a typical SME is a bounded, checkable job: settle scope and role, identify which of the four duties your use triggers, test the exemptions honestly, put up the notices, verify your provider's marking, and keep the evidence. The ten steps below each cite their legal basis. Steps 1 through 4 are exactly what our free Article 50 checker automates, and steps 5 through 10 land in the policy our AI policy generator produces.

The checklist

Confirm scope (Art. 2). The Act reaches systems placed on the EU market, put into service in the EU, or whose outputs are used in the EU. Outputs used here are enough, wherever the system runs.
Settle your role per system (Art. 3). Deployer for the vendor tools you use under their branding; provider for anything you build, and, the commonly missed case, for any third-party model you offer under your own name or trademark.
List your triggers. People interacting directly with AI (50(1)), synthetic content generation (50(2)), emotion recognition or biometric categorisation (50(3)), deepfakes or AI-written public-interest text (50(4)). Several can be true at once.
Test exemptions as the cumulative tests they are. Obviousness for a reasonably well-informed person (50(1)); standard editing including machine translation, per the Commission's final Guidelines (50(2)); the three-condition business carve-out (50(2)); human review plus editorial responsibility (50(4) text); evidently artistic works get a reduced, not removed, duty (50(4) deepfakes). Unsure means the duty applies.
Put up the interaction notice. Clear, at the latest at first interaction, accessible (50(5)). Not buried in terms nobody reads.
Verify your provider's machine-readable marking. Ask for the documentation; remember their embedded marking never satisfies your own visible disclosure duties.
Check the transitional date honestly. Systems on the market before 2 August 2026 have until 2 December 2026 for the 50(2) marking duty only; everything else applies now.
Label what needs labelling. Deepfake disclosures the audience can actually perceive; a label on AI-written public-interest text unless the editorial-responsibility test genuinely holds.
Keep the evidence record. Notice copies, placement screenshots, timing, accessibility, provider marking documentation, editorial-control records. This is what you show a supervisory authority or an enterprise customer.
Write it into your AI policy and train on it. The duties, the approved-tools register that operationalises them, and the Art. 4 literacy hook that has applied since February 2025.

The fine print worth knowing

Penalties for Article 50 violations reach EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher; for SMEs the cap reverses to the lower of the two (Art. 99(6)). In Denmark, which authority supervises Article 50 is not yet settled; the duties and levels follow the Regulation itself either way.

Do steps 1-4 in five minutes

Our Article 50 checker runs the scope gate, the role branch and the cumulative exemption tests, and returns an evidence record with citations per finding. It runs entirely in your browser, and nothing you answer leaves your device.

Sources

Usein kysytyt kysymykset

Where should an SME start with Article 50?

With scope and role: is your AI use in the EU at all (Art. 2), and are you a provider or a deployer for each system? Everything downstream, duties, exemptions and deadlines, depends on those two answers. A structured checker settles both in minutes.

Do SMEs get lighter Article 50 obligations?

The duties are the same, but the fine cap reverses: for SMEs the maximum is the LOWER of EUR 15,000,000 or 3% of worldwide turnover (Art. 99(6)), where larger companies face the higher of the two.

What evidence should we keep?

A copy of each disclosure text, where it is shown, that it appears at first interaction, its accessibility, your provider's marking documentation, and your editorial-control record if you rely on that exemption. An evidence record beats a verbal assurance in every audit.

What if we are not sure whether an exemption applies?

Treat the duty as applying until the exemption is established. The exemptions are cumulative tests with specific criteria; an unanalysed exemption is not an exemption.

Article 50 compliance checklist for SMEs: ten steps with the law behind each

Rasmus Kjaer Damgaard, Co-founder · 3. elokuuta 2026

Tämä artikkeli on tuotettu tekoälyn avustuksella ja ihmisen tarkastama. Rasmus Kjaer Damgaard vastaa sisällön toimituksellisesta laadusta.

The checklist

Confirm scope (Art. 2). The Act reaches systems placed on the EU market, put into service in the EU, or whose outputs are used in the EU. Outputs used here are enough, wherever the system runs.

Settle your role per system (Art. 3). Deployer for the vendor tools you use under their branding; provider for anything you build, and, the commonly missed case, for any third-party model you offer under your own name or trademark.

List your triggers. People interacting directly with AI (50(1)), synthetic content generation (50(2)), emotion recognition or biometric categorisation (50(3)), deepfakes or AI-written public-interest text (50(4)). Several can be true at once.

Test exemptions as the cumulative tests they are. Obviousness for a reasonably well-informed person (50(1)); standard editing including machine translation, per the Commission's final Guidelines (50(2)); the three-condition business carve-out (50(2)); human review plus editorial responsibility (50(4) text); evidently artistic works get a reduced, not removed, duty (50(4) deepfakes). Unsure means the duty applies.

Put up the interaction notice. Clear, at the latest at first interaction, accessible (50(5)). Not buried in terms nobody reads.

Verify your provider's machine-readable marking. Ask for the documentation; remember their embedded marking never satisfies your own visible disclosure duties.

Check the transitional date honestly. Systems on the market before 2 August 2026 have until 2 December 2026 for the 50(2) marking duty only; everything else applies now.

Label what needs labelling. Deepfake disclosures the audience can actually perceive; a label on AI-written public-interest text unless the editorial-responsibility test genuinely holds.

Keep the evidence record. Notice copies, placement screenshots, timing, accessibility, provider marking documentation, editorial-control records. This is what you show a supervisory authority or an enterprise customer.

Write it into your AI policy and train on it. The duties, the approved-tools register that operationalises them, and the Art. 4 literacy hook that has applied since February 2025.