Under the regulation, disclosing your use of AI is already mandatory. Find out whether the rule applies to your company.

The transparency obligations under Article 50: informing people that they are interacting with AI, marking generated content in a machine-readable format, disclosing deep fakes, and disclosing the use of AI in text published to inform the public on matters of public interest. That last obligation does not apply where the material has undergone human editorial review and a named person or organisation holds editorial responsibility for the publication. Systems placed on the market earlier have until 2 December 2026 for the machine-readable marking itself.

Article 50 has four paragraphs and each addresses a different role. The duty to disclose AI interaction and the duty to apply machine-readable marking to generated content sit with the provider of the system. As a company using an off-the-shelf tool you are responsible above all for disclosing deep fakes, informing people about emotion recognition and, as a matter of due diligence, for checking whether your tools mark content and whether your editing process strips that marking. There is one case that is easy to miss: if you offer someone else’s tool to your own customers under your brand, as your product or service, you may yourself act as the provider. The provider’s duties then pass to you as well, namely disclosing AI interaction and applying machine-readable marking.

Yes. Company size does not exempt you from the obligations. It does affect the level of fines, because for SMEs the lower of the two amounts applies. Using ChatGPT means deploying an AI system within the meaning of the regulation. At a minimum, keep a register of tools, rules on what data may be entered into them, and documented measures supporting your team’s AI literacy. If that is all there is, a screening may be enough.

It depends on whose emotions the system is intended to infer and from what data. The prohibition in Article 5 covers emotion recognition in the workplace and in educational institutions, meaning employees, candidates and students. Analysis concerning customers does not as a rule fall under that prohibition, but it is subject to the duty to inform those people (Article 50(3)) and to the GDPR. It also matters whether the system infers emotions from biometric data or analyses the content of the transcript itself. We assess each case separately.

Cancelled no, postponed yes: Annex III to 2 December 2027, Annex I to 2 August 2028. Preparing documentation for such a system can take more than a year, so it is worth drawing up a readiness map now.

Up to EUR 35 million or 7% of worldwide turnover for prohibited practices under Article 5 only; up to EUR 15 million or 3% for most other infringements, including the transparency obligations under Article 50; up to EUR 7.5 million or 1% for supplying incorrect, incomplete or misleading information to a notified body or a national competent authority in reply to a request. For SMEs the lower of the two amounts applies. The 7% threshold is often quoted as "the AI Act fine", but it covers the narrowest category of infringements.

There is no guarantee, and nobody honest will give you one. A report and a register help demonstrate that action was taken, and an authority may take that into account when setting a penalty, alongside cooperation and the circumstances of the case. An inspecting authority sets out to assess what the company actually did and what it can show to prove it.

An AI Act readiness review report, which is a working document for you. The statement is a short document setting out the scope of the audit, the date, the methodology used, the details of the person who ran it and the legal position as of that date. And a short summary you can attach to a procurement questionnaire or a tender, without disclosing confidential details of your systems. The statement confirms that an audit was carried out in a defined scope, and that is all it can confirm.

No consultancy can issue a certificate of AI Act conformity, ourselves included. Conformity assessment is a formal procedure under the regulation, carried out for high-risk systems by the provider or by a notified body, ending in a declaration of conformity and CE marking. The rules also do not provide for a certificate covering a company as a whole, because the procedure in the regulation applies to a single system only. What you do receive is the report, the statement that the audit was performed, and the summary for customers and tender processes. If you need a certificate issued by a third party, the right route is the ISO/IEC 42001 standard and an accredited certification body; we can prepare you for it.

No. The audit is organisational and technical in nature. Where a provision needs legal interpretation, we say so explicitly, record it in the report and recommend an opinion from a qualified lawyer.

Because compliance starts with the question of where the AI is actually running. You find the answer in integrations, in tool settings and in SaaS invoices. We know these tools from the inside: automations in n8n or Make, AI features slipped into systems bought two years ago for an entirely different purpose. So the inventory has to begin with the invoices and with real conversations in each department. The official list of tools comes somewhere further down the line. That is how we find things that appear neither in the contracts nor in the record of processing activities. Second, we close some of the gaps ourselves. A chatbot notice is one sentence in the interface, content marking is a change in the video production pipeline, and the disclosures still have to be translated into every language you sell in. Localisation has been our daily work for years, so that last part comes with the job.

We quote after a short call, because the price depends on the number of AI use cases, departments and legal entities in the group. We do not publish ranges up front, so as not to sell you a scope you do not need, nor to underprice the work before we know its scale. The call is free and non-binding; if we conclude afterwards that you do not need an audit, we will say so. On your side, a screening takes around three hours in total, and a full audit six to ten hours over a three- to four-week period, plus the time of people from individual departments for interviews.

Yes. The whole process is remote and can be delivered in English or Polish: online meetings, documents in your environment, electronic signatures. We work with companies operating on the EU market; where national supervision matters, we take account of the relevant Member State and its authority.