EU AI Act: Art. 50 has applied since 2 August 2026.

What is the EU AI Act and why does it affect SMBs?

The EU AI Act, officially Regulation (EU) 2024/1689 on artificial intelligence, entered into force on 01 August 2024 and applies in stages. It classifies AI systems by risk: certain practices are prohibited, high-risk systems, for example in recruitment or lending, require conformity assessments, and AI in customer contact is subject to transparency obligations. The regulation distinguishes two roles. The provider develops an AI system and places it on the market. The deployer uses it in its own business. Anyone using an AI phone assistant or a chat agent is a deployer. Under Art. 50(1), the notice that an AI is speaking or writing is owed by the provider. Under Art. 4, the deployer ensures the AI literacy of its staff, and it has obligations of its own in special cases, such as deepfakes or AI-generated texts it publishes on matters of public interest (Art. 50(4)). The regulation also applies to providers from third countries that offer their AI systems in the EU. Anyone using a tool from a US provider should therefore check whether the AI notice is actually implemented there.

The 4 most important obligations for DACH SMBs in 2026

First, Art. 4 (AI literacy), since 02 February 2025. Anyone using AI in their business promotes the AI literacy of the staff who work with it. The regulation prescribes no particular form and no certificate, but a short internal description helps: how the AI is used, what it must not do, when it hands over to a person. Second, Art. 50 (transparency), since 02 August 2026. Anyone speaking or writing to an AI system must be clearly told so at the latest at first contact. On the phone, that means the greeting discloses that an AI is speaking. In chat, a visible notice; in emails, a notice in the text. Under Art. 50(1), this obligation falls on the provider. Third, Art. 28 GDPR (data processing). Anyone who has a service provider process personal data needs a data processing agreement. Fourth, Art. 22 GDPR (automated decisions). Decisions with legal effect must not be based solely on automated processing. For an AI agent in customer service, that means it hands over to a person for complaints, returns or cancellations.

• Art. 4 AI literacy: enable staff who work with AI (since 02.02.2025)
• Art. 50 transparency: AI notice at the latest at first contact (since 02.08.2026)
• Art. 28 GDPR: data processing agreement with the AI provider
• Art. 22 GDPR: handover to a person for decisions with legal effect

EU AI Act fines, the amounts at a glance

Art. 99 of the AI Act sets three tiers. Infringements of the prohibited practices under Art. 5 can be fined up to 35 million euros or 7 per cent of worldwide annual turnover; for large companies, the higher amount applies. Infringements of most other obligations, including Art. 50, cost up to 15 million euros or 3 per cent. Incorrect or misleading information supplied to authorities, up to 7.5 million euros or 1 per cent. For small and medium-sized enterprises, Art. 99(6) provides that the lower of the two amounts applies in each case. The Digital Omnibus extended this to small mid-cap enterprises with Art. 99(6a), though not for prohibited practices. In addition, Member States are to take the economic situation of SMEs into account and may also issue warnings instead of fines.

EU AI Act vs. GDPR, where the obligations overlap and where not

The GDPR governs how personal data is processed. The AI Act governs the conditions under which AI systems are used, even when no personal data is involved. For an AI agent in customer service, both apply at the same time. From the GDPR come data processing agreements, privacy information under Art. 13 and the question of where data is processed. From the AI Act come the AI notice under Art. 50 and AI literacy under Art. 4. A provider that implements the GDPR properly has not thereby taken care of the AI notice, and vice versa. At rinqo the two work together: hosting with Hetzner in Germany, a data processing agreement, the AI notice in every channel, templates for describing how AI is used. With providers based or hosting in the US, there is the added question of data transfers to third countries, which has required particular scrutiny since the Schrems II judgment of the Court of Justice of the EU.

How rinqo implements the EU AI Act, concrete and verifiable

First, the AI notice under Art. 50. In chat, a permanently visible notice says that an AI agent is responding, and it also appears before the greeting. Emails carry a notice that the message was produced with an automated assistant; neither can be switched off. On the phone, the standard greeting includes the reference to the AI. You can adapt the wording, but the reference should stay. Second, Art. 4: templates for a short description of how AI is used, which you adapt to your configuration. Third, Art. 28 GDPR: the data processing agreement is provided when you sign the contract. Fourth, Art. 13 GDPR: the standard phone greeting includes the privacy information. Fifth, hosting and processing: Hetzner in Falkenstein and Nuremberg, language models with contractually guaranteed processing in the EU, no training on customer data. The full list of sub-processors is available in your customer account.

The EU AI Act, explained simply

The AI Act, Regulation (EU) 2024/1689, is Europe's AI law. Whether you search for “AI Act”, “EU AI Act”, “AI Regulation” or “European AI law”, you mean the same piece of legislation. It classifies AI systems by risk: prohibited practices are banned, high-risk systems require extensive evidence, and AI in customer contact is subject to transparency obligations. For most SMEs, two articles are relevant. Since 02.02.2025, Art. 4 has required companies to promote the AI literacy of the staff who work with AI. A short description is helpful but not mandatory: who uses AI for what, where the limits are, when a person takes over. Since 02.08.2026, Art. 50 has required that people are told when they are talking to an AI. This obligation lies with the provider of the AI system. Anyone who only uses AI is called a “deployer” in the regulation and is mainly responsible for AI literacy within their own team. An AI phone assistant, a chat widget or an email agent all fall under this. At rinqo, the phone, chat and email agents identify themselves as AI by default. In chat and email the notice cannot be switched off; on the phone it is part of the greeting, whose wording you adapt.

The duty to disclose AI: what Art. 50 actually requires

Art. 50(1) of the AI Act requires providers to design AI systems that interact directly with people so that those people are informed they are dealing with an AI, unless this is obvious. Under Art. 50(5), the information must be clear and distinguishable, be given at the latest at first contact and meet accessibility requirements. This has been binding since 02.08.2026. There is no SME exemption. On the phone, that means an announcement at the start of the call; in chat, a visible notice; in emails, a notice in the text. Under Art. 50(3) and (4), deployers have obligations of their own, for example for emotion recognition systems, deepfakes or AI-generated texts on matters of public interest. Infringements of Art. 50 can be fined up to 15 million euros or 3 per cent of worldwide annual turnover, with the lower amount for SMEs. At rinqo, the notice is active by default in every customer channel. In chat and email it cannot be switched off; on the phone it is part of the greeting, whose wording you adapt. In addition, the data processing agreement under Art. 28 GDPR is provided when you sign the contract.

High-risk AI: does this affect my business?

Customer service agents are, as a rule, not high-risk AI. Annex III of the AI Act lists the high-risk areas, and ordinary customer contact is not one of them. High-risk would be, for example, AI that selects job applicants or evaluates employees, AI that decides on creditworthiness, or AI that controls critical infrastructure. Such systems require conformity assessments, risk management and documented human oversight, following the Digital Omnibus from 02 December 2027. An AI agent that takes calls, answers questions, books appointments and forwards complex cases to people does not fall into these categories. It is subject to the transparency obligations of Art. 50. The rinqo agents answer, sort and hand over. They make no decisions about employment, credit or other Annex III areas. Two honest caveats. The classification depends on the specific use, not on the product name: anyone using the same agent for recruitment moves into high-risk territory. And this page is a guide, not legal advice. Have borderline cases reviewed by a lawyer.

EU AI Act summary: timeline and obligations for 2026

For SMEs, two dates matter: Art. 4 has applied since 02.02.2025, Art. 50 since 02.08.2026. Since February 2025, you have been promoting the AI literacy of the staff who work with AI. There is no fixed documentation duty, but a short description of usage limits and handover rules helps all the same. Since August 2026, AI in customer contact must be recognisable as AI; the obligation lies with the provider, but you should still check it for every tool you use. Infringements of Art. 50 cost up to 15 million euros or 3 per cent of worldwide annual turnover, the lower amount for SMEs. What you should do now: first, list every AI tool running in customer contact in your business. Second, make sure your team knows what the AI can and cannot do. Third, check for each tool whether the AI notice is active. Fourth, check whether a data processing agreement under Art. 28 GDPR is in place. With rinqo, the AI notice and the data processing agreement are in place from day one. Hosting is with Hetzner in Falkenstein and Nuremberg (ISO 27001:2022), and the language models process data within the EU under contractual guarantee, without training on your customer data. Cancellable monthly.

• 02.02.2025: Art. 4 AI literacy applies to every company using AI
• 02.08.2026: Art. 50 AI notice in customer contact
• Fines under Art. 50: up to 15 million euros or 3 per cent of worldwide annual turnover, the lower amount for SMEs
• Do now: list your AI tools, enable your team, check the AI notice and the data processing agreement