Article 50 of the EU AI Act: What European SMEs Actually Need to Do by 2 August 2026

Most coverage of the EU AI Act in spring 2026 focused on the high-risk delay. One deadline stayed exactly where it was: 2 August 2026. That is the day the transparency obligations under Article 50 take effect. They reach far more SMEs than the Annex III rules that now slip to late 2027. If you run a chatbot, publish AI-generated marketing content, or use sentiment analysis in customer support, you have specific obligations under Article 50. The Digital Omnibus of 7 May 2026 did not change that.

This post explains what Article 50 actually requires, which obligations sit with providers and which with deployers, how enforcement works in Austria (where Witness is based), and the four steps a typical European SME should complete over the next nine weeks.

What Article 50 requires

The regulation draws a clean line between two roles. Providers put an AI system on the market or into service. Deployers use such a system in their own operations. Each role has its own obligations.

Provider obligations

1. Disclosure on direct AI interaction (Art. 50(1)). Anyone who provides a chatbot, a virtual assistant, or any other AI system that interacts with people must design it so that the person realises they are talking to AI. A short, clear notice at the start of the conversation is usually enough. The carve-out: cases where it is obvious from the context, for example an assistant that introduces itself as an "AI assistant."

2. Machine-readable marking of generated content (Art. 50(2)). Providers of generative AI that produces audio, images, video, or text must mark the outputs so they are detectable as AI-generated by machine. In practice that means watermarking, metadata, or cryptographic signatures. This obligation lands on the model provider, not on the SME using the model. Anthropic, OpenAI, Google, and Stability AI are on the hook here.

Deployer obligations

3. Emotion recognition and biometric categorisation (Art. 50(3)). If your business deploys a system that recognises emotions or categorises people biometrically, you must inform the people exposed to it. Concretely: a sentiment-analysis tool in your call centre that detects caller frustration triggers an obligation to inform the caller.

4. Deepfake disclosure (Art. 50(4) first sub-paragraph). Anyone publishing AI-generated or AI-manipulated image, audio, or video content that constitutes a deepfake must disclose that fact. There is a carve-out for evidently artistic, creative, satirical, or fictional work, where a proportionate label that does not impair enjoyment of the work is sufficient.

5. AI-generated text on matters of public interest (Art. 50(4) second sub-paragraph). When AI is used to generate or substantially manipulate text that is then published to inform the public on a matter of public interest, the deployer must disclose that the text is AI-generated. Carve-out: text that has gone through human editorial responsibility and review. An AI draft that an editor reviews and signs off on is not in scope.

Most European SMEs are deployers, not providers. If you use ChatGPT, Claude, Midjourney, or a Shopify chatbot without training your own model or shipping an AI product, you are looking at obligations 3 through 5. That is a much narrower set than the headlines suggest.

Three SME scenarios

Online shop in Vienna, Shopify with an AI chatbot. The chatbot is provided by the platform, so obligation 1 (AI interaction disclosure) formally sits with the platform. In practice the shop operator still needs to confirm that the disclosure is actually live on the site. Many providers ship it by default, some require explicit configuration. Responsibility for what is running on your own domain stays with you.

Marketing agency in Graz, generative AI for social posts. The answer depends on what is being published. Plain product posts with no public-interest angle are not in scope of obligation 5. An AI-generated image of a real person that looks like a real photo is a deepfake under the regulation and falls under obligation 4. An AI-generated image of a fictional model in a clearly commercial context falls under the artistic-work carve-out and only needs a proportionate label that does not ruin the image.

HR tool in Salzburg, sentiment analysis on candidate interviews. Sentiment and emotion recognition is squarely covered. Obligation 3 triggers and candidates must be informed about the use, ideally already in the interview invitation. Watch the scope: once the system moves beyond informing and starts contributing to the hiring decision, it can be classified as an Annex III high-risk system, and the heavier obligations land on top from 2 December 2027.

Who enforces this in Austria

Market surveillance is a national matter, not centralised in Brussels. In Austria the competent authority is the KI-Servicestelle at RTR-GmbH (Rundfunk und Telekom Regulierungs-GmbH). It operates today in an advisory capacity and is transforming into a full supervisory and sanctioning authority by 2 August 2026. Complaints, notices, and fines come from the KI-Servicestelle in Vienna, not the European Commission.

The penalty range for breaches of Article 50 under Article 99 of the regulation is up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher. That is the middle tier of the penalty structure, below prohibited practices (EUR 35 million or 7%) but well above what most SMEs absorb without pain.

Realistically, the KI-Servicestelle is unlikely to open enforcement against every Austrian online shop on day one. Experience with GDPR enforcement and general market surveillance suggests the first months will bring guidance, notices, and graduated warnings. But once a complaint, a consumer-protection referral, or an own-initiative spot check surfaces a business with no disclosures in place, a formal proceeding is on the table.

What the Omnibus changed for Article 50

Very little, but the little is worth knowing.

The 7 May 2026 Digital Omnibus did not move the Article 50 deadline. 2 August 2026 stands. What did move is the transitional rule for generative AI systems already on the market before that date. The original six-month grace period was shortened to three months. Those legacy systems now have to be fully compliant by 2 December 2026, not February 2027.

For the typical European SME deployer this transitional rule is rarely relevant, because it targets providers. If you have built your own generative tool and sell it into the EU, you now have three fewer months to land.

The formal Council and Parliament votes on the Omnibus are expected in June or July 2026. Until then the original legal regime is technically still in force. In practice nobody is relying on a deadline that is overwhelmingly likely to slip.

A four-step plan for the next nine weeks

Done in this order, four steps cover most of what a typical European SME should complete by early August.

Step 1: Build an AI inventory

List every place AI touches your business in a customer-facing or employee-facing way. Chatbot on the website. Sentiment analysis in the CRM. Generative AI for email templates, social posts, product descriptions. Speech synthesis in your hotline IVR. Computer vision on a production line if it captures people. Without an inventory, you cannot map the obligations.

Step 2: Map obligations per use

For every line in the inventory, decide: does Article 50 apply, and if so which sub-paragraph? Are you the provider or the deployer? Where an obligation lands, note the concrete measure required: a chatbot intro line, a banner under an AI-generated image, an information line in the candidate invitation, and so on.

Step 3: Implement

Most of the measures are technically trivial. A chatbot intro disclosure is a ten-minute frontend change. An AI-image label can be a design-system component. A candidate notice is one line in your standard invitation template. Completeness matters more than technical depth.

Step 4: Maintain a compliance register

For every decision, record: which application, which obligation, which measure, which date, which person signed off. When the KI-Servicestelle asks, the register is the first thing they want to see. Without it the "we already did this, trust us" defence is worthless.

A simple spreadsheet handles this. If you want something more structured you can move to compliance software, but for most SMEs that is overkill as long as the spreadsheet stays current.

What comes next

The 2 August 2026 transparency deadline is the small wave. The bigger one arrives in 2027 and 2028, when the high-risk obligations land: HR tools with decision logic, credit scoring, candidate evaluation, education software with grading. SMEs that start there only when the deadline gets close run into the same traffic jam every regulation creates: lawyers, consultants, and rushed documentation.

Witness is built as a self-service compliance platform for European SMEs, with a focus on the high-risk compliance work that lands in December 2027. The platform already includes the AI system classifier, Annex IV documentation templates, the Article 27 FRIA generator, and the Article 43 conformity assessment workflow. The right sequence for most SMEs over the next two months is: handle Article 50 calmly using the four steps above, and use the spare time to prepare the heavier obligations early.

For specific questions on how Article 50 applies to your business, try Witness or send a question via the contact page.

---

Disclaimer: This post is an overview, not legal advice. For a binding view of your specific obligations, talk to a qualified AI-law or data-protection counsel, or contact the KI-Servicestelle at RTR.