Checklist · as of October 2026

AI Act Article 50 and GDPR: a checklist for small companies

Five steps to go through before you put a chatbot, an AI agent or AI-generated content in front of people. Written for small product teams in Sweden. It covers the transparency rules in Article 50 of the EU AI Act, which have applied since 2 August 2026, and the GDPR questions that come with them.

This is technical preparation, not legal advice. Check the current legal texts, including amendments, and the authorities' guidance, and have a lawyer review your conclusions.

Step 1

Map every AI system you build or use

Start with a plain list. Most small companies use more AI than they think.

  • Customer-facing chatbots and AI agents (support, sales, booking)
  • Features that generate text, images, audio or video for users
  • Internal tools that score, rank or profile people (applicants, customers, employees)
  • Third-party AI services inside your product, and the vendor behind each one
  • For each system: what personal data goes in, what comes out, and where logs are stored
  • Check each system against the prohibited practices in Article 5 and the high-risk uses in Annex III, such as recruitment or credit scoring of individuals. This checklist does not cover those rules; if one might apply, get legal advice.
Step 2

Decide whether you are provider or deployer

Your duties under the AI Act depend on your role. You can hold different roles for different systems, and both roles for the same one.

  • Did you develop the system, or have it developed, and place it on the market or put it into service under your own name or trademark? You are likely the provider.
  • Did you build your own chatbot or agent on someone else's model, for example through an API? That usually makes you the provider of that system (Article 3(3) and 3(68)).
  • Do you use a ready-made AI system from someone else under your own authority in your business? You are likely the deployer.
  • For high-risk systems (Article 25): you can become the provider if you put your name or trademark on the system, substantially modify it, or change a system's intended purpose so that it becomes high-risk.
  • Both roles: take measures to support the AI literacy of staff and others who operate or use the AI systems on your behalf (Article 4, as amended by Regulation (EU) 2026/1744). No specific level is required of each person.
  • Write down your conclusion and the reasoning for each system.
Step 3

Run the Article 50 transparency checks

Article 50 has applied since 2 August 2026, also to systems already in use, with one transition period noted below. Fines can reach €15 million or 3% of global annual turnover, whichever is higher; for SMEs, including start-ups, whichever is lower (Article 99). In Sweden, penalties will be set by a supplementary law the Government is preparing. Until 31 December 2026, PTS, IMY, Finansinspektionen, the Medical Products Agency and Swedac are the competent authorities under the AI Act, with PTS as the single point of contact.

  • Chatbots and agents that interact with people: design them so people are told they are interacting with an AI system, unless that is obvious from the context (provider duty).
  • Generated audio, images, video or text: mark outputs in a machine-readable format so they can be detected as AI-generated (provider duty). This does not apply to systems that only assist with standard editing or do not substantially alter the input. Systems placed on the market before 2 August 2026 have until 2 December 2026 to meet this marking duty (Regulation (EU) 2026/1744).
  • Emotion recognition or biometric categorisation: inform the people exposed to it (deployer duty). Check Article 5 first: emotion recognition at work or in education is banned, except for medical or safety reasons, and so is categorisation that infers traits such as race, religion or sexual orientation. Other uses are often high-risk (Annex III), so get legal advice before you go further.
  • Deepfakes: disclose that the content has been artificially generated or manipulated (deployer duty). For evidently artistic, creative, satirical or fictional work, an appropriate disclosure that does not hamper the work is enough. From 2 December 2026, Article 5 also bans AI systems designed for, or lacking reasonable safeguards against, generating realistic intimate or sexually explicit images, video or audio of an identifiable person without their explicit consent, and AI-generated child sexual abuse material (Article 5(1)(ba) and (bb), added by Regulation (EU) 2026/1744).
  • AI-generated text published to inform the public on matters of public interest: disclose it, unless the text has gone through human review or editorial control and a person or organisation holds editorial responsibility for publishing it (deployer duty).
  • For each disclosure above: make it clear and distinguishable, give it at the latest at the first interaction or exposure, and meet the applicable accessibility requirements (Article 50(5)).
Step 4

Answer the GDPR questions

An AI feature usually means new processing of personal data. These are typical first questions from an auditor or from IMY, the Swedish data protection authority.

  • What is the legal basis for each processing, including the conversation logs?
  • Do you have a data processing agreement (personuppgiftsbiträdesavtal) with every processor, including the AI vendor?
  • Does the AI vendor use your data to train its own models? Then it acts as a controller for that use, not just as your processor, and sharing the data for it needs its own legal basis. Check the terms and settings.
  • Does personal data leave the EU/EEA, and on what transfer basis?
  • Do prompts and logs contain only the personal data you actually need, and how long are they kept?
  • Does your privacy notice say that AI is used, for what, and which vendors receive the data?
  • Can you handle access and erasure requests that cover AI logs and stored conversations?
Step 5

Check whether you need a DPIA

A data protection impact assessment (GDPR Article 35) is required when processing is likely to result in a high risk to people's rights and freedoms. Under IMY's guidance, you must as a rule carry one out before launch if at least two of these criteria apply, and sometimes one is enough.

  • New technology or new organisational solutions, such as generative AI or autonomous agents
  • Evaluating or scoring people, including profiling
  • Automated decisions with legal or similarly significant effects
  • Systematic monitoring of people
  • Sensitive or highly personal data, such as health, biometric, financial or location data
  • Processing on a large scale
  • Combining datasets in ways people would not reasonably expect
  • People in a vulnerable position, such as children, employees or others who depend on you
  • Processing that can stop people from using a service, entering a contract or exercising a right

Sources

Want help mapping this in your codebase?

The readiness audit maps which Article 50 duties apply to your product and looks for GDPR gaps in your code and data flows. You get a written technical report to take to your lawyer or data protection officer. Start with a free 30-minute intro call.

Book intro call