If your company uses AI systems as a deployer, you'll have noticed that 2 August 2026 is almost always discussed in terms of obligations: Article 50 transparency enters into application. It usually comes paired with a second idea that needs qualifying: that the AI Act's supervision system switches on that day. Part of it does. Governance — including the designation of the authorities, in Chapter VII — and the penalties regime — in part, Chapter XII — have applied since 2 August 2025; Chapter IX market surveillance — for which Article 74(1) applies Regulation (EU) 2019/1020 to AI systems — applies from 2 August 2026, the general date of application in Article 113. So two things change that day: what there is to supervise — from then on, on top of Article 4 and Article 5, the Article 50 transparency obligations apply, which for deployers sit in paragraphs 3 and 4 — and the powers with which it is supervised.
What market surveillance is (and isn't)
Market surveillance is the classic European architecture for product oversight, now applied to AI: each Member State designates at least one market surveillance authority (Article 70(1)), and Article 74(1) applies Regulation (EU) 2019/1020 to AI systems, which is where those authorities' specific powers are set out. How and when they act isn't laid down in the AI Act. For an SME deployer, the realistic scenario isn't "they'll come and see me on day 3", but "if something draws attention to my use of AI — a customer complaint, a labour dispute, an incident — there will be a formal channel through which I'll be asked to explain".
In Spain, we've already mapped out the authorities: AESIA, the Spanish AI supervisory agency, as the central piece, with the AEPD, the Spanish data protection authority, and sector-specific authorities keeping their own remits, in the allocation outlined by a bill still going through the parliamentary process. That map doesn't change on 2 August; what changes is that it stops being an org chart and starts being practice.
The conversation is always the same
Whatever the authority and the reason, an action concerning AI use revolves around a very stable script. The questions, in essence:
- What AI systems do you use? — the inventory, with its reasoned risk classification.
- Who operates them, and with what training? — the use policy and the record of literacy measures — Article 4 doesn't require a register, but it's your way of evidencing the measures taken.
- What have you assessed? — the impact assessments where the GDPR requires them, and the written rationale for why not, where it doesn't.
- How do you comply with what applies to you today? — the notices and information owed under Article 50(3) and (4), including the disclosure of deep fakes, and, as your own due diligence, the verification carried out on the provider.
- Can you show it? — the question that subsumes all the previous ones.
Note what is not in an SME deployer's script: product technical files, conformity assessments, provider documentation — unless Article 25(1) makes you the provider of a high-risk system. Each link in the chain answers for its own part, as we saw with the Article 50 split — and knowing how to say "that's on my provider; this is mine, and here it is" is, in itself, a demonstration of competence that works in your favour.
The penalties, read with a level head
Yes: the AI Act's penalty regime deals in large figures, with tiers based on severity — the maximum is reserved for the prohibited practices under Article 5 (Article 99(3)), and below that sit non-compliance with the provisions listed in Article 99(4) — among them the transparency obligations under Article 50 — and the supply of incorrect, incomplete or misleading information to the authorities in reply to a request (Article 99(5)). Each tier has its own paragraph and its own logic, and the Regulation itself does the scaling: they are ceilings that Article 99(7) requires weighing case by case, and which, for SMEs, Article 99(6) caps at the lower of the two magnitudes. The regime that gives them concrete form in Spain is a matter of national law (Article 99(1)), and this article says nothing about it.
But the useful reading for an SME isn't memorising the amounts — it's what Article 99(7) requires to be taken into account when deciding on a fine and its amount in each individual case: among other circumstances, the nature, gravity and duration of the infringement, the degree of cooperation with the authorities to remedy it, the degree of responsibility of the operator in view of the technical and organisational measures it implemented, and the intentional or negligent character of the infringement. The company that can show its inventory, its assessments, its records and its rationale — even with imperfections — has something to answer those questions with. The one that can't show anything turns any minor signal into a bigger problem, because the underlying infringement is compounded by the inability to demonstrate diligence.
Preparation fits in a single folder
The operational conclusion is deliberately unepic. Preparing for market surveillance isn't a new project: it's having organised and accessible what good governance already produces — a living inventory, reasoned classifications, policy and training with a record, assessments where they're due, dated transparency checks. The evidence, not the checklist: the folder that turns an uncomfortable meeting into a formality.
On 2 August the machinery starts up. It's not coming for you; but from that point on, it exists. The only variable you control is what it finds if it ever asks.
This article is for informational purposes only and does not constitute legal advice. Spain's institutional framework is going through the parliamentary process and may change.