Article 50 fines: €15M or 3%
The party that failed the duty can be fined up to €15 million or 3% of worldwide turnover. Deployer or provider, not a random login.
Article 50 fines cap at €15 million or 3 percent of total worldwide turnover for the preceding financial year. The person who can be fined is the provider or the deployer who failed the duty that actually applied to them — not "whoever uploaded" in the abstract, and not a platform badge that was never the legal instrument. This page is the ceiling, the addressee, and the enforcer. It is not a casebook. None of the sources cited here publish an enforcement docket.
The Commission's FAQ (last updated 24 July 2026) is the primary source for the cap, for SME proportionality, and for who oversees the article. Paul, Weiss (4 August 2026), Bird & Bird's insight on the 20 July 2026 guidelines, Morgan Lewis (12 August 2026), and the Cloud Security Alliance research note (29 July 2026) repeat the same ceiling. They do not add decided cases.
The ceiling, not a tariff
The FAQ's wording is the one to keep: fines can reach up to 15 million euros or 3 percent of total worldwide turnover for the preceding financial year, while proportionality can be taken into account in the case of small and medium sized enterprises (SMEs) and small mid-cap companies (SMCs).
Three things that sentence is not.
It is not a price list. There is no published menu that says a missing overlay costs X and a missing watermark costs Y. The figure is a maximum. Actual penalties, if and when they land, sit with national market surveillance authorities applying the AI Act's penalty article, not with a blog table.
It is not both numbers stacked. Counsel notes treat the cap as the greater of the two figures — CSA (29 July 2026) writes "whichever is higher"; Paul, Weiss (4 August 2026) writes "the greater of EUR 15 million and 3% of worldwide turnover." A company with €100 million worldwide turnover is looking at a 3 percent line of €3 million, which sits below €15 million, so the euro cap is the higher number. A company with €1 billion worldwide turnover is looking at a 3 percent line of €30 million, which sits above €15 million. The FAQ itself says "up to 15 million euros or 3%." It does not invite you to add them.
It is not a per-post invoice. The Act does not, in the sources here, price a single unlabelled Reel. Turnover is the preceding financial year's worldwide figure for the undertaking. That is a company-scale number. It is why buyers now ask to see the overlay in the review link even when the near-term risk for a small producer is a platform strike rather than a Commission cheque.
Proportionality for SMEs and SMCs is in the FAQ. It is a direction to the enforcer, not a published discount code. Do not write "we are small, so the cap is zero" into a client memo. Do write "the statute tells the authority to take size into account."
CSA's 29 July 2026 note adds a burden-of-proof line that the FAQ does not spell out in the same words: the organization should be able to show timely disclosure, rather than waiting for the regulator to reconstruct the file history. That is operational hygiene. It is not a decided case.
Who can actually be fined
The FAQ splits the world the same way the article does.
Providers are natural or legal persons, public authorities, agencies, or other bodies that develop AI systems, or have them developed, and place them on the EU market or put them into service under their own name or trademark — including providers established outside the EU if the output of their system is used in the EU. Their transparency duties are the ones in Articles 50(1), 50(2), and 50(5): tell people they are interacting with AI unless it is obvious; mark synthetic audio, image, video, or text so it is detectable; do it in a clear and distinguishable way at first interaction or exposure.
Deployers are natural or legal persons, public authorities, agencies, or other bodies using AI systems under their authority, excluding use for personal, non-professional activities. Their transparency duties are the ones in Articles 50(3) and 50(4): inform people exposed to emotion-recognition or biometric-categorisation systems; label deepfakes and certain AI-generated public-interest text.
The fine follows the duty that was failed. A deployer who published an unlabelled photoreal talking head is not being fined for a missing SynthID. A provider who shipped an unmarked generator is not being fined because a customer skipped an on-screen line. Mixing those files is how a production company orders watermarking infrastructure it was never asked for, or how a model lab assumes a customer's overlay discharges a marking duty.
The FAQ's professional-use test is the one that decides whether a natural person is a deployer at all. Generating deepfakes and posting them as a personal activity is outside the Act. Gaining an economic benefit on a regular basis — or otherwise being involved in a business, trade, occupational, or freelance activity — is professional. A creator who is paid, a brand, an agency: that column. Employees of a company are not separate deployers; the legal person is. Contractors and freelancers operating the system on behalf of that legal person, under its responsibility and control, do not become a second addressee.
Bird & Bird's reading of the final guidelines is the contract fact: the deployer is the person who assumes responsibility for the decision to deploy the system and the manner of its actual use, including its outputs. Technical control is not required. A company that merely commissions an agency to produce an advertisement, without taking decisions or exercising control over whether and how the agency uses AI, is not the deployer; the agency is. Put that in the insertion order before anyone argues about who pays a fine that has not been issued.
Provider or deployer is the sorting post. Article 50 is the name of the rule. This page only needs you to stop pointing the cap at the wrong party.
Personal, non-professional use is the clean exit. It is also the exit people reach for too quickly. Regular economic benefit is a facts question. A handful of brand deals a year is not a hobby because the files were made at the kitchen table.
Who enforces, and what they can see
The FAQ: compliance will mainly be enforced by national competent market surveillance authorities. The AI Office has a limited role. It is competent for AI systems built on general-purpose AI models where the same entity provides the system and the model, or where the AI system is integrated into a very large online search engine or very large online platform designated under the Digital Services Act. The European Data Protection Supervisor enforces the rules vis-à-vis AI systems used by the EU institutions, bodies, and agencies.
That split matters for a creator only as a map of who might write. Most publisher-side labelling questions will not begin at the AI Office. They will begin at a national authority. The Code of Practice on transparency of AI-generated content, assessed as adequate by the Commission and the AI Board, is the voluntary path to demonstrating compliance with Articles 50(2), 50(4), and 50(5). Signatories may rely on it regardless of their place of establishment. Non-signatories have to demonstrate compliance through alternative adequate means and, the FAQ says, may be subject to more requests for information.
Paul, Weiss (4 August 2026) records that around 190 organisations had signed the Code as of 31 July 2026. Signing is optional. It is also, in that note, the clearest EU-wide route to showing your working. A small producer does not need to sign a Code to burn a line into a file. A provider building a detector probably does need a story that looks like the Code or a documented gap analysis against it.
What an authority can ask for is not listed as a checklist in the FAQ. The practical artefacts are still obvious: the file as published, the disclosure a person would have perceived at first exposure, the date of generation and of publication, and, for public-interest text, the review log that shows substance was examined. The disclosure template is the copy you would show. A missing overlay plus a claim that "the model was watermarked" is the file that fails the deployer test on its face.
No source cited on this page publishes a list of Article 50 fines issued after 2 August 2026. Do not invent one. The ceiling is the statute. A case table would be a different document, written from a docket that these sources do not contain.
What a missed label costs before a fine
For most independent producers the near-term cost is not a 3 percent line. It is a platform removal, a Creativity Program suspension, a Reels bonus that never pays, a client who will not ship the cut, or a buyer who now treats the overlay as a delivery spec.
Those costs sit in platform policy, not in Article 50. They are still the reason the ceiling shows up in a review meeting. A brand that can see €15 million or 3 percent in a Commission FAQ will ask for the line on the picture even if no authority has written to anyone on the job. That is rational. It is not evidence of a fine.
CSA (29 July 2026) notes that Article 50 was left out of the Digital Omnibus delay that moved Annex III high-risk systems. Morgan Lewis (12 August 2026) notes that deployer duties have applied since 2 August with no transition. Waiting for a first public fine before labelling is a bet that the ceiling is decorative. The statute does not read that way.
Do not treat a platform strike as an Article 50 enforcement action. Do not treat the absence of a published fine as a finding that the duty is unenforced. Both moves invent a case law the sources do not give you.
If you generate a photoreal cut in Veo 3.1 or any other row and you are the deployer who will publish it, the cheap artefact is the overlay. If you need a studio seat to put the words on the file, sign up. The cap is the reason the overlay stopped being optional copy. It is not a quote for the invoice.
Worldwide turnover is worldwide. A US parent with EU viewers does not get a local-revenue haircut in the FAQ's wording. Territorial scope is a different page — duty follows the audience. The cap, if it ever attaches, is not "3 percent of EU sales" in these sources.
FAQ
Is the fine €15 million plus 3 percent?
No. The FAQ says up to €15 million or 3 percent of total worldwide turnover for the preceding financial year. Counsel notes treat that as the greater of the two. Proportionality can be taken into account for SMEs and small mid-caps. There is no published per-post tariff.
Can an independent creator be fined?
If they are a deployer in the professional-use sense — regular economic benefit, a business, a trade, freelance work — they are an addressee of the deployer duties, and the penalty article is not limited to listed companies. Personal, non-professional use is outside the Act. Employees acting under a company's control are not separate deployers; the legal person is. Size goes to proportionality, not to a free pass.
Have any Article 50 fines been published?
Not in the sources this page cites. The FAQ (24 July 2026), CSA (29 July 2026), Paul, Weiss (4 August 2026), Bird & Bird on the 20 July 2026 guidelines, and Morgan Lewis (12 August 2026) state the ceiling and the enforcer. They do not attach a docket. Do not read that silence as a decided case either way.