《AI Act》第99條訂明第50條違規的罰款上限及執法安排

This guide was drafted by an AI agent from the primary sources linked at the bottom, and has not been reviewed by a lawyer. It is general information, not legal advice. The original is at https://mdodeja.github.io/eu-ai-act-article-50-guide/guides/article-50-fines-article-99.html.

Short answer. Breaking Article 50 can cost up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)(g)). For SMEs and start-ups, and since the 2026 Digital Omnibus also small mid-caps, the cap is whichever of the two is lower. These are ceilings. Member States write the actual penalty rules, and national market surveillance authorities do most of the enforcing.

The fine tiers in Article 99

Article 99 of the AI Act sets three maximum fines. Article 50 sits in the middle one.

Point (g) of Article 99(4) refers to the "transparency obligations for providers and deployers pursuant to Article 50". Both roles are covered. A provider that ships a chatbot with no AI disclosure and a deployer that publishes an unlabelled deep fake are in the same tier.

The same 99(4) tier also covers deployer duties under Article 26 and provider duties under Article 16, which apply to high-risk systems. An agency running ordinary chatbots and content tools will mostly meet Article 50 and not those.

Smaller companies: the lower of the two

For SMEs, including start-ups, Article 99(6) flips the rule: each fine is capped at the percentage or the fixed amount, whichever is lower.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026, added Article 99(6a). It gives small mid-cap enterprises (SMCs) the same "whichever is lower" cap for fines under Articles 99(4) and 99(5), which includes Article 50. The amended Article 3 defines SMEs by reference to Commission Recommendation 2003/361/EC and SMCs by reference to Recommendation (EU) 2025/1099. Check those two documents for the headcount and turnover thresholds; this page does not restate them.

The arithmetic for the Article 50 tier:

These are maximums. Nothing in Article 99 says a first breach gets the maximum, and Article 99(1) says penalties must be "effective, proportionate and dissuasive" and must take account of the interests and economic viability of SMEs and SMCs.

What an authority weighs

Article 99(7) lists what the authority considers when it decides whether to fine and how much. In short:

• the nature, gravity and duration of the breach, how many people it affected and the harm they suffered
• whether other market surveillance authorities, or authorities under other laws, already fined the same operator for the same conduct
• the operator's size, annual turnover and market share
• financial gains made or losses avoided
• how far the operator cooperated with the authorities
• the operator's degree of responsibility, given its technical and organisational measures
• how the breach came to light, and whether the operator reported it
• whether it was intentional or negligent
• what the operator did to reduce the harm

Several of these are things you can show with paperwork. A dated record of which client sites have an AI disclosure, when you added it, and what you changed after an issue was found speaks directly to responsibility, cooperation and mitigation. The client audit checklist produces that kind of record.

Article 99(1) also says the national rules can include warnings and non-monetary measures, not only fines.

Who enforces Article 50

Each Member State writes its own penalty rules within these limits and notifies them to the Commission (Article 99(1) and (2)). Enforcement of Article 50 for most systems falls to the national market surveillance authorities that each country designates under Article 70. Which body that is differs by country, so look for your government's designation rather than assuming it is the data protection authority.

The Omnibus also made the Commission's AI Office the authority for two groups of systems under the amended Article 75(1): AI systems built on a general-purpose AI model where the model and the system come from the same provider or group, and AI systems integrated into a very large online platform or search engine designated under the Digital Services Act. An agency deploying a chatbot built on someone else's model on a client's ordinary website will normally deal with the national authority, not the AI Office. Where exactly the line falls in edge cases is not settled yet.

When this applies

Article 50 applies from 2 August 2026. The Omnibus did not move that date. It added one transition: providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) machine-readable marking duty (new Article 111(4)). The chatbot disclosure in Article 50(1) and the deep fake labelling in Article 50(4) have no such extra time. The marking guide covers 50(2) in detail.

The penalty chapter itself has applied since 2 August 2025, but a fine for an Article 50 breach needs the Article 50 duty to be in force, so the practical start is 2 August 2026, and 2 December 2026 for the marking transition.

Sources

• Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: Articles 50, 70, 99 and 113.
• Regulation (EU) 2026/1744 (Digital Omnibus on AI) on EUR-Lex: amendments to Articles 3, 75, 99 and 111.
• Article 99 text at artificialintelligenceact.eu, consolidated with the Omnibus changes.
• Commission Recommendation 2003/361/EC on the SME definition.