EU AI Act Fines for Article 50: Penalties, SME Caps and Who Enforces Them

Article 50 of the EU AI Act (Regulation (EU) 2024/1689) sets its transparency duties: telling people they are interacting with an AI system, machine-readable marking of AI-generated content by the provider, and disclosing deep fakes and some AI-generated text. If you are new to these duties, start with Article 50 explained.

The penalty sits in Article 99. Article 99(4) sets fines of “up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher”. Point (g) of that paragraph names “transparency obligations for providers and deployers pursuant to Article 50”.

There is one tier for the whole of Article 50. An undisclosed chatbot under Article 50(1), missing marking under Article 50(2) and an undisclosed deep fake under Article 50(4) share the same ceiling.

Article 99 has three fine tiers for operators. EU institutions, bodies, offices and agencies fall under Article 100.

For large companies, the cap is whichever of the two figures is higher. For smaller businesses, the rule flips.

Article 99(6) says that for SMEs, including start-ups, each fine is capped at the percentage or the amount, “whichever thereof is lower”. The Digital Omnibus on AI (Regulation (EU) 2026/1744) inserted Article 99(6a), which gives small mid-cap enterprises (SMCs, as defined in Commission Recommendation (EU) 2025/1099) the same lower cap for fines under Article 99(4) and (5). Article 50 fines fall under Article 99(4), so the lower cap covers both SMEs and SMCs. The amended text is on the Commission's AI Act Service Desk.

Here is an arithmetic illustration of how the two caps work, for a hypothetical company with €20 million turnover. It is not a prediction of any fine.

The same turnover gives two very different ceilings. The duties don't change, though: Article 50 applies in the same way to a small business and a large one. Article 99(1) also says Member States must take into account the interests of SMEs, including start-ups, and SMCs, and their economic viability when imposing penalties.

Every figure above is a ceiling (“up to”), not a fixed amount. Under Article 99(1), each Member State lays down its own rules on penalties, which must be “effective, proportionate and dissuasive” and, as amended by the Omnibus, “may also include administrative fines, warnings and non-monetary measures”. A fine is not the only possible outcome.

Article 99(7) lists the factors weighed when a fine is decided, including:

Under Article 99(9), depending on the national legal system, fines may be imposed by national courts or other bodies. Codes of practice can matter too: the Commission's Article 50 guidelines (para. 149) say commitments under a code of practice assessed as adequate may be taken into account as a mitigating factor under Article 99(7)(e). See the EU AI Act Code of Practice.

Under Article 70(1), each Member State establishes or designates at least one market surveillance authority. Article 74(1) applies the EU market surveillance rules (Regulation (EU) 2019/1020) to AI systems. The Commission's guidelines (para. 151) describe three enforcers for Article 50:

Authorities can act on their own initiative or after a complaint. Under Article 85, any natural or legal person with grounds to consider there has been an infringement may complain to the relevant market surveillance authority, so a complaint does not have to come from a regulator. The guidelines also note that other authorities, such as data protection and consumer protection authorities, keep their own powers.

Each Member State designates its own authorities, so who you would deal with depends on the country. Article 50 can reach companies outside the EU too: see Does Article 50 apply outside the EU?

Some things are knowable from the text. Under Article 113, the penalties chapter has applied since 2 August 2025. Article 50 has applied since 2 August 2026, and the Omnibus did not delay it; the guidelines (para. 153) confirm it applies to all in-scope systems, whenever they were placed on the market. There is one narrow transition: providers of generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) marking duty (Article 111(4), inserted by the Omnibus). Chatbot and deep fake disclosure have no such transition.

Other things depend on each country. Member States set their own penalty rules and designate their own authorities, so practice will differ, and under Article 99(11) they report to the Commission every year on the fines they have issued. This page doesn't comment on whether any Article 50 fine has been issued.

For the short answer on what ignoring the rules risks, see What happens if you ignore Article 50? Other common questions are in Article 50 questions.

On most websites, the most visible Article 50 duty is a chat widget, voice agent or AI avatar that should say it is an AI. Check that the AI on your site tells people it is an AI clearly, at the latest when the conversation starts (Article 50(1) and (5)).

Run a free scan of one public page: Article50.io loads it in a real browser, shows the most severe finding and lists what it couldn't check. For every finding with a ready-to-paste fix, the scan report is a one-off €499; see pricing. A scan is not legal advice, a clean result is not a compliance clearance, and the scan covers Article 50 only, one page at a time. For decisions about your own exposure, speak to a lawyer.