AI Governance · Fixed-scope assessment
Your lawyer shouldn't be billing you to find your own AI systems.
Article 50 of the EU AI Act applies on 2 August 2026 — the Digital Omnibus didn't delay it. Five days and €4,500, and you walk into your legal review with the inventory built, every system classified provider or deployer, and the remaining questions already framed. You'll spend less on counsel and get a better answer.
01 · The trigger
This usually starts with a questionnaire
A customer sends an AI due-diligence questionnaire. Or an insurer does. Or it arrives inside a procurement pack with an AI Act clause attached.
It asks which AI systems you use. Whether AI-generated content is disclosed to the people who see it. Who is accountable for that.
Nobody internally can answer it — not because the answers are bad, but because nobody has ever assembled them.
So the deal stops moving while five people email each other about who owns the chatbot.
That's the problem this solves, and the deadline below is why it's about to get more common rather than less.
02 · The misread
What was delayed, and what wasn't
Regulation (EU) 2026/1744 — the Digital Omnibus on AI — entered into force on 27 July 2026. It moved two deadlines. It did not touch Article 50.
Delayed by the Omnibus
High-risk obligations, pushed back
- ANNEX III · STANDALONE HIGH-RISK2 August 2026 → 2 December 2027
- ANNEX I · EMBEDDED HIGH-RISK2 August 2027 → 2 August 2028
Left exactly where it was
Transparency duties, unchanged
- ARTICLE 50 · TRANSPARENCYApplies 2 August 2026
- ART 50(2) GRACE ONLYMachine-readable marking, to 2 December 2026 — nothing else
The reporting said "AI Act delayed." Your board heard "we have until 2027." Neither is what the regulation says.
03 · In scope
Being a UK company is not an exemption
The AI Act reaches providers and deployers established outside the EU where the output of the AI system is used in the Union. If your AI-generated output reaches people in the EU, or you operate there, you are likely in scope. The test isn't where you're incorporated. It's where the output lands.
04 · The four duties
Four obligations. Two roles. One question most firms get wrong.
Most firms assume they're a deployer — that they simply use somebody else's product, and the duties sit with the vendor. Sometimes true. Often not.
50(1) · PROVIDER
Direct interaction
Systems interacting directly with people must make clear a person is dealing with AI.
50(2) · PROVIDER
Synthetic content marking
Synthetic audio, image, video or text must be machine-readably marked as artificially generated.
50(3) · DEPLOYER
Emotion & biometric systems
Emotion recognition and biometric categorisation — inform the people exposed.
50(4) · DEPLOYER
Deep fakes & public-interest text
Deep fakes, and AI-generated or manipulated text published to inform the public on matters of public interest — disclose.
Under Art 3(3) you are a provider if you develop, or have had developed, an AI system placed on the market under your own name or trademark. Plain use of an off-the-shelf tool doesn't make you a provider. A commissioned build does. A white-labelled product does.
The same chatbot is somebody else's problem or entirely yours, depending on how it was bought. That isn't in any policy document. It's in your procurement records and your contracts — and going through those at legal rates is the most expensive possible way to find out.
05 · The 50(4) defence
You probably have the defence. You probably can't prove it.
Article 50(4) exempts AI-generated text published to inform the public where there has been human review or editorial control, and a natural or legal person holds editorial responsibility. Two things about that test are commonly misread.
It's disjunctive, not cumulative
You need human review or editorial control — not both. That is more forgiving than most firms assume.
But the floor is real
The Commission has been explicit that superficial, solely formal or procedural checks — spell-checking, grammar — do not amount to review or editorial control.
The typical mid-market position: the editorial process genuinely exists, and there is no record of it. No named person holding responsibility. No log showing what was reviewed and by whom. A defence you can't evidence isn't one you can rely on — not with a market surveillance authority, and not on a customer's questionnaire either.
06 · What it costs to be wrong
Penalties
Breaches of Article 50 fall under Art 99(4). Enforcement sits mainly with national market surveillance authorities; the AI Office's competence — widened by the Omnibus — covers systems built on general-purpose AI models where the model and the system share a provider.
Standard
€15M or 3%
Of worldwide annual turnover, whichever is higher
SMEs
Whichever is lower
Art 99(6) flips the test for SMEs, including start-ups
Enforcement
National authorities
Market surveillance authorities, primarily
07 · The process
Five days, fixed scope
Scheduled across a two-week window to fit around your people's diaries. Five days of billed work.
Day 1
Scope and sweep
Kickoff with your sponsor, then discovery of every AI system that generates content or interacts with people — including features embedded in tools you already bought, and the ones procurement doesn't know about.
Day 2
Interviews and classification
Four to six 45-minute conversations. Every system tested against Art 3(3) and 3(4) — provider or deployer, with the procurement evidence that decides it. Contracts read for where the duty was allocated, and where it was merely assumed.
Day 3
Duty mapping
Each system mapped against 50(1) to 50(4) and the manner-and-timing requirements of 50(5). Your existing disclosures reviewed as a user actually encounters them, not as your policy describes them.
Day 4
Defence test and question framing
The 50(4) exemption tested against the Commission's floor. Evidence gaps identified. The remaining legal questions drafted with the facts attached, so your counsel can answer them instead of researching them.
Day 5
Plan and readout
Remediation sequenced and assigned. Board one-pager written. 45-minute readout to your exec team.
08 · What you're left holding
Deliverables
AI Content & Interaction Register
Every in-scope system, with owner, procurement route and role classification. Most clients keep this as the foundation of their AI inventory.
Article 50 Duty Map
System by system, sub-article by sub-article, RAG-rated, reasoning shown.
Editorial Control Defence Assessment
Whether 50(4) holds in practice, and exactly what's missing if it doesn't.
Counsel Question Set
The remaining legal questions, framed with the facts attached. This is the one that pays for the engagement: it turns an open-ended legal review into a short list of answerable questions.
Disclosure & Marking Specification
The wording for user-facing disclosures and the technical approach to machine-readable marking, ready to hand to a developer.
30/60/90 Remediation Plan
Sequenced, owner-assigned, deadline-split. Plus a one-page board summary.
09 · Scope honesty
What this isn't
Not legal advice. I'm not a lawyer and SER Team isn't a law firm. No legal opinion is given and none is implied. What you get is the structured input that makes legal advice faster and cheaper to buy — and if you don't need a lawyer after reading it, that's a legitimate outcome too.
Not a full AI Act conformity assessment. Annex III high-risk classification is a larger, separate engagement — and now runs to December 2027.
Not a GDPR exercise, though overlaps are flagged where Art 50(3) touches biometric processing.
Not implementation. Remediation is scoped separately, once the plan exists and you've decided what to do with it.
Liability is limited to the fees paid. That's stated in the contract and it's stated here, because the whole point of the exercise is that the binding answer comes from your counsel, not from me.
10 · Price and terms
€4,500, fixed
Article 50 Exposure Assessment
€4,500
Fixed fee. Five working days, delivered across a two-week window. No day rates, no expenses, no scope-creep clause.
What you need to provide
- A named executive sponsor with the authority to convene people
- Access to procurement records and your SaaS and vendor list
- Four to six 45-minute interviews: marketing, product or engineering, IT, legal or compliance, customer service
- Vendor documentation and contracts for AI-enabled tools
If those aren't available, five days doesn't work. I'll tell you that before we start, not after.
Liability
This assessment is not legal advice and does not constitute a legal opinion. SER Team is not a law firm and does not hold itself out as one. Findings are provided to inform your own decisions and to support review by qualified legal counsel. Total liability is limited to the fees paid for the engagement.
11 · Who's doing the work
I do the work myself.
Troy — fractional CTO and AI governance advisor, working with firms between €50M and €500M+ on AI governance, ISO 42001 and EU AI Act readiness. IAPP AIGP certified.
No junior team, no offshore analyst pool, and no forty-slide deck restating the regulation back to you. You get a register, a classification, a gap list and a plan.
Read the FEtch case studyFAQ
Questions we get asked
Does the Digital Omnibus delay Article 50?
No. The Omnibus moved the Annex III high-risk deadline to 2 December 2027 and the Annex I embedded deadline to 2 August 2028. Article 50 applies from 2 August 2026, unchanged.
Isn't there a December 2026 grace period?
There is, but it's narrow. It applies only to machine-readable marking of synthetic content under Art 50(2), and only for systems already placed on the market before 2 August 2026. It doesn't touch any deployer obligation.
We're a UK company. Does this apply?
Likely yes. The Act reaches providers and deployers established outside the EU where the AI system's output is used in the Union. Incorporation isn't the test — where the output lands is.
We only use tools we bought. Aren't the duties the vendor's?
Often, but not always. Under Art 3(3), a commissioned build or a product carrying your name and trademark can make you the provider — which shifts 50(1) and 50(2) onto you. This is the most common finding of the assessment.
Is this legal advice?
No. I'm not a lawyer and this isn't a legal opinion. It's the preparation your lawyer would otherwise have to do at their hourly rate — inventory, classification, evidence review — packaged so that the legal question they answer is short and specific.
Why would I pay for this if I still need a lawyer?
Because the alternative is paying a lawyer €400–700 an hour to discover which AI systems you own. Legal time is worth spending on judgement, not on discovery. This makes the discovery cost a fixed €4,500 instead of an open-ended hourly one.
Does the Code of Practice protect us?
The Code of Practice on Transparency of AI-Generated Content, published 10 June 2026, gives a streamlined way to demonstrate compliance with 50(2) and 50(4). It is voluntary and confers no presumption of conformity. It is not a safe harbour and shouldn't be treated as one.
What are the penalties?
Article 99(4): €15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs including start-ups, Art 99(6) applies whichever is lower.
Can you do it faster than five days?
The interviews and document review have a floor. If your deadline is tighter, say so on the call and I'll tell you honestly what's achievable.
Let's talk
Twenty minutes to find out whether you have a problem
Tell me what you're running and where the output goes. I'll tell you whether you have an Article 50 exposure worth five days of work. If you don't, I'll say so — that call costs you nothing and it's a faster answer than anyone will bill you for.