€15M or 3%? Read Article 99(6) first
Every piece written about Article 50 leads with the fine. Almost none of them gets as far as paragraph 6 of the penalties article, which changes the number substantially for exactly the businesses being frightened by it.
The headline is real
Article 99(4) sets the tier, and its point (g) names Article 50 explicitly:
Non-compliance with any of the following provisions related to operators or notified bodies, other than those laid down in Articles 5, shall be subject to administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher:
[…] (g) transparency obligations for providers and deployers pursuant to Article 50.
So the number is not invented. It is just not the whole provision.
Then read paragraph 6
In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower.
For an SME, "whichever is higher" becomes "whichever is lower". For a twelve-person agency with €800,000 of turnover, 3% is €24,000 — and that is the ceiling, not the expectation.
The Digital Omnibus, Regulation (EU) 2026/1744, adds a new paragraph 6a extending the same treatment to small mid-cap enterprises.
Three more things that sit between you and the headline
- Member states set the actual rules. Article 99(1) requires them to lay down penalties that are "effective, proportionate and dissuasive", and — as amended by the Omnibus — to take into account "the interests of SMEs, including start-ups, and SMCs, and their economic viability when imposing penalties". The AI Act sets a ceiling. National law fills in what happens.
- Proportionality is mandatory. Article 99(7) requires regard to "the nature, gravity and duration of the infringement and of its consequences", the number of affected people, and the level of damage.
- Nothing has happened yet. Article 50 applies from 2 August 2026. As we write this, that is days away. There is no enforcement history, no first fine, no case law. Anyone showing you an AI Act penalty is either describing a different article or a GDPR matter.
Why we are telling you this
We sell — give away — an Article 50 implementation. Talking down the fine is against our narrow interest. We are doing it anyway, for three reasons.
It is true, and the whole proposition here is that you can check our work against primary sources. A vendor who quotes Article 99(4) and stops before 99(6) has told you something about their reliability.
It is not our pitch. The reason to fix your chat disclosure is not a hypothetical eight-figure fine. It is that your clients are emailing to ask whether they are covered, the obligation is real, the fix is ten minutes, and "we handled it in March" is a much better answer than a conversation about risk appetite.
And frankly, fear-selling compliance to small businesses is a shabby business. The market has enough of it.
What actually matters for a small agency
- The obligation applies from 2 August 2026 and was not delayed.
- The fix for most installs is a settings change or one line of markup.
- The part that takes real work is making the bot answer honestly when asked what it is.
- You have a client book. Doing this once and rolling it out is a good afternoon's work and a genuinely useful thing to tell clients you have done.