The EU AI Act’s transparency obligations, Article 50, took effect on 2 August 2026. The rules themselves are specific: tell people they are talking to an AI, label AI-generated content, disclose deepfakes. What backs those rules is a penalty structure most small business owners have never actually read.

What Article 99 says, word for word

Article 99(4) of Regulation (EU) 2024/1689 sets the tier that covers transparency obligations: non-compliance "shall be subject to administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher." That "whichever is higher" clause is what makes the fine scale with the size of the business, not just sit at a flat cap.

It is not the top tier, and that matters

The Act reserves its highest penalty, up to EUR 35 million or 7% of global turnover, for prohibited AI practices entirely, things like social scoring or manipulative AI, a different and more serious category than a missing disclosure label. Transparency failures sit one tier below that: still a meaningful number for any business, but not the Act’s maximum.

Who actually enforces it

From 2 August 2026, national market surveillance authorities and other competent authorities designated under the Act can supervise and enforce Article 50 directly. The obligation reaches any provider or deployer serving EU users, regardless of where the business itself is incorporated, so being a small company outside the EU is not on its own a reason to assume the rule does not apply.

What this means practically

  • The fine exists for not disclosing, not for using AI. Using AI on your site is not the violation, failing to tell visitors is.
  • A one-line disclosure next to a chatbot or AI-generated content block is a cheap fix next to the alternative.
  • This is general information, not legal advice. If you are unsure whether your specific setup is covered, get a legal opinion rather than guessing.

AuditMerlin’s free scan checks AI chat disclosure right away; two more checks, AI named in your privacy policy and machine-readable AI content marking, run once you answer three short questions in your account. It will not tell you whether you are liable for a fine, but it will tell you whether the basic disclosure is actually present.