What an undisclosed chatbot can actually cost

The number everyone quotes

Article 99(4) of the AI Act lists the obligations whose breach carries the €15m / 3% ceiling, and the Article 50 transparency duties are on that list. For context, the Act's three bands: up to €35m / 7% for prohibited practices, up to €15m / 3% for most operator obligations, transparency included, and up to €7.5m / 1% for supplying authorities incorrect information. Two qualifiers matter for small businesses:

• The Act instructs authorities to keep penalties effective, proportionate and dissuasive. The penalty must be proportionate to the size of the operator included. For SMEs, the Act caps the fine at the lower of the two amounts rather than the higher.
• Fines are a ceiling, not a starting point. Authorities weigh the nature and duration of the breach, cooperation, and whether it was corrected.

Who actually knocks

Enforcement is national: each member state designates market surveillance authorities for the AI Act, coordinated at EU level. Several member states were still finalising their designations through 2026, which is one reason visible enforcement starts slowly. Complaints land with the authority where you operate. Anyone can file one: a competitor, a consumer association, a customer.

What year-one enforcement realistically looks like

Every comparable EU regime (GDPR, DSA, consumer law) followed the same arc: early enforcement is complaint-driven and correction-first. The typical first contact is a letter asking you to fix the gap and show what you did, with fines reserved for refusal, repeat offences, or bad faith. The practical exposure for a shop in 2026 is therefore not a surprise €15m invoice. It is:

1. a deadline scramble when the letter arrives, priced at legal-consultancy hourly rates instead of a quiet afternoon now;
2. a paper-trail problem. "We fixed it" lands very differently when you can show dated evidence you checked before anyone asked;
3. a trust problem. The complaint that triggers the letter is often public.

"Our chat vendor handles compliance"

The single most common misreading. Article 50(1) puts the disclosure duty on the deployer. That is the business the visitor is actually talking to. Zendesk, Intercom, Gorgias, Tidio and the rest ship AI modes that can be disclosed properly; whether yours is switched on, and whether your customers are told, is your setting and your duty. A vendor contract does not transfer it.

The cheap way to be done with this

1. Scan. Free, four seconds. See what an authority (or complainant) sees on your pages today.
2. Confirm. Open your vendor console and check whether an AI mode answers customers. Per-vendor paths here.
3. Disclose. Wording at first interaction, in every language you sell in. Free samples on the homepage.
4. Document. The €49 Compliance Pack generates the disclosure set, the machine-readable Article 50(2) marking, and the dated evidence log that turns a future letter into a five-minute reply.

Related

Do you have to tell customers your chatbot is AI? · The 2 December 2026 marking deadline · Our own transparency notice