The headline number — up to €15 million or 3% of worldwide turnover — is real, but it's the standard ceiling under Article 99(4)(g), where the two figures are compared and the higher one applies. That's not the number for most SMEs.
For SMEs and start-ups specifically, Article 99(6) sets a different ceiling: up to €15 million or 3% of turnover, whichever is lower. Fines are also discretionary, not automatic, and weighed against the factors in Article 99(7) — nature and gravity of the infringement, intent versus negligence, cooperation with authorities, among others. Treat €15M as a ceiling you're extremely unlikely to actually hit, not a number to plan around.
Enforcement infrastructure is also genuinely uneven as of mid-2026. National Market Surveillance Authorities are the enforcers, and only around 9 Member States are fully designated, roughly 12 partially set up, and several have designated nothing yet. Germany is further along than most: its KI-MIG law was cabinet-approved February 11, 2026, naming the Bundesnetzagentur as the central authority, with final steps still running.
The realistic early posture is complaint-driven, focused on easily verifiable failures: was a disclosure shown at first interaction, and can the company prove it. Corrective orders — fix this, not a fine — are the expected first step, well ahead of headline penalties.
None of this means "don't bother." Weak regulatory enforcement doesn't erase private-law exposure — unfair commercial practices claims, customer complaints, and platform policy violations exist independently of any regulator. And the underlying duties are genuinely cheap to meet: a badge, a sentence, a label. There's no real upside to skipping them, even in a slow-enforcement environment.
The most useful reframe for a small company weighing this: the realistic downside of getting Article 50 wrong right now is mostly a corrective order and the reputational cost of a visible, easily-screenshotted gap — not a company-ending fine. The realistic cost of getting it right is a sentence, a badge, and an afternoon. That asymmetry is the whole argument for just doing it rather than gambling on enforcement timelines.
Not sure how this applies to your specific setup? The free 2-minute check tells you which of the four Article 50 duty areas likely apply to your company — no email required.
Take the free check Generate disclosure text