Article 50 of the EU AI Act has generally applied since 2 August 2026, with a limited transition for certain technical marking requirements until 2 December 2026. Your business’s obligations depend on your role and application. Customers may also ask which AI systems you use and where their data is processed.
Your first encounter will not be with the regulator. It will be with the buyer sending you the annual questionnaire with a new line in it: which AI systems do you use when processing our data, and where is that data processed?
Businesses with a good answer win tenders. Those that do not know lose them, before price has even been discussed. This article is about that answer.
What exactly has applied since August 2026
The AI Act takes effect in stages. The picture has shifted over the past few months, so here is the current position:
Scroll sideways to view all table columns.
| Obligation | Since / from | Does this affect SMEs? |
|---|---|---|
| Original prohibited AI practices (Article 5) | 2 February 2025 | Depends on the application, for example social scoring |
| AI literacy (Article 4) | Since 2 February 2025; substance amended from 27 July 2026 | Yes — measures to support AI literacy |
| Rules for general-purpose AI models (GPAI) | 2 August 2025 | Only if you provide models yourself |
| Transparency (Article 50) | 2 August 2026; limited Article 50(2) transition until 2 December 2026 | Yes — chatbots, AI content, deepfakes |
| High-risk systems, Annex III | 2 December 2027 | Only for uses such as recruitment or credit assessment |
| AI embedded in products, Annex I | 2 August 2028 | Only for regulated products |
*Position following the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026. New prohibitions concerning non-consensual sexual content and child sexual abuse material apply from 2 December 2026. Check the applicable role, rules and transitional provisions; this is general information.*
Start with your role, systems and data flows. Where the information obligation applies, make it clear that someone is communicating with AI. Providers and deployers must also take measures that support the development of AI literacy, appropriate to staff and the context of use. Article 4 does not require a guarantee of a particular level of individual knowledge.
The nuance missing from many summaries
The general application date for Article 50 is 2 August 2026. For providers of certain systems generating synthetic audio, images, video and text that were placed on the market before that date, a transition until 2 December 2026 applies to the technical marking requirements under Article 50(2). This is not a general postponement of all transparency obligations. See the official implementation timeline.
A conventional chatbot application does not automatically fall under the full set of high-risk obligations. First check the specific application and your role. Other obligations, including privacy rules and applicable transparency rules, remain separately relevant.
The question customers will ask
The GDPR already raised this question: who processes our data, and where? The AI Act makes it more urgent because it adds a second layer: and which model sees it?
With a cloud automation platform, the honest answer is usually that your data passes through the supplier’s infrastructure, under its data processing agreement and the associated transfer arrangements. That is permitted. But it is a link in your chain that you do not control and that you must be able to explain.
Scroll sideways to view all table columns.
| Component | Cloud platform | Self-managed n8n environment |
|---|---|---|
| Automation | Platform supplier’s infrastructure | Your selected infrastructure |
| Connected services | Assess AI, CRM, email and storage separately | Assess AI, CRM, email and storage separately |
| Location and legal role | Document for each processing activity | Document for each processing activity |
Examples of data flows. Self-hosting does not automatically determine where the entire chain runs or who is a processor.
Self-hosting gives you control over the infrastructure on which n8n runs. Data can still go to connected AI models, CRM, email, storage and other suppliers. For each connection, document which data is processed, where, and under which arrangements.
Do you know where your customer data travels?
In the free scan, we map your data flows as well as your processes: which systems, which processors, which models. You receive the overview to keep.
Book your free automation scanFree · no obligation · always includes a short advisory report
What self-hosting does and does not solve
We want to be precise about this, because it is too easy to imply that hosting something yourself gives you a free pass.
Scroll sideways to view all table columns.
| Issue | Does self-hosting solve it? | Explanation |
|---|---|---|
| Where is my data physically located? | Assess for each setup | The n8n installation runs on the selected infrastructure; other data flows are assessed separately. |
| How many processors are in my chain? | Assess for each setup | Depending on the setup, hosting, management, storage and connected services may involve separate parties. |
| Transfers outside the EEA | Not automatically | Assess all services, access routes and any transfers, not only the AI model. |
| Who can access my logs? | Assess for each setup | The storage location, access and retention period for logs are documented for each setup. |
| Transparency obligation (Article 50) | No | Applicable obligations continue to apply; your responsibility depends on your role and application |
| Your team’s AI literacy | No | That is training, not infrastructure |
| Human oversight of AI decisions | No | You design that into the workflow, not the server |
| Security and updates | No — this becomes your responsibility | Poorly managed self-hosting is worse than cloud |
Self-hosting shifts responsibility. That is a benefit if you take it on, and a risk if you forget it.
The number of parties involved depends on hosting, management, storage and external connections. Map the roles, data flows and arrangements for each selected setup; there is no fixed number of links for self-hosting.
Without updates, monitoring, backups and restore tests, the risk increases. Arrange management yourself, through a third party or through a maintenance package with a defined scope. See our pricing and package limits and maintenance terms.
What you can put in place this month
These five steps are a practical starting point. The time required and further measures depend on your systems, risks and role.
- Create an AI register. One spreadsheet: which AI tool, what it is used for, which supplier and which data goes into it. Five columns are enough to get started.
- Make it clear at the first interaction that the visitor is communicating with AI, where that information obligation applies. Provide a clear and accessible notice. Also check which other parts of Article 50 apply to your role and application.
- Document what employees may use AI for, which data they may enter and when human review is needed. Discuss the rules with staff and organise usage, access and follow-up accordingly.
- Support AI literacy. Choose training and guidance appropriate to the systems used, the risks and employees’ experience. Document the measures; a short session is not automatically sufficient for every situation. See the European Commission’s explanation.
- Map your data flows. Which data leaves your environment, through which system, and to which country? This is the answer you will need in a questionnaire.
Why this makes sense even without legislation
Regardless of any obligation, each of these five steps makes your business easier to manage. You know which tools are used, who can access what, and what goes wrong if a supplier fails. That is simply sound business practice — here, the law is the prompt rather than the reason.
How we set it up
We build on self-hosted n8n, with three consistent principles:
- Logging appropriate to the process and risk. Record necessary events, timestamps and outcomes, with agreed access and retention periods. Do not automatically store complete sensitive input or output.
- Decisions with an impact involve a person. An AI step proposes; a person confirms. See when to use an AI agent and when to use a conventional workflow (in Dutch).
- Data stays where it belongs. We agree in advance which data remains in your own environment and which is processed through AI, CRM, email or other connected services.
The trade-off between self-hosted and cloud, including costs, is explained in the comparison of n8n, Zapier and Make. You can read how we handle data ourselves in our privacy statement (in Dutch), and the broader rationale in why n8n.
For process boundaries and human decision points, use the step-by-step process automation guide (in Dutch). The technical controls for duplicate actions, retries, logging and recovery are covered in the guide to a reliable n8n workflow.
The questionnaire you will receive
This is not theoretical. These are the questions that buyers, accountants and larger clients have been including in supplier forms since this year. Compare them with your own situation and see where you do not yet have an answer.
Scroll sideways to view all table columns.
| The question | Answer for a cloud platform | Answer for self-hosting |
|---|---|---|
| Where is our data processed? | In the supplier’s infrastructure — the region depends on the plan | On the documented infrastructure and with the documented connected suppliers. |
| Who are the subprocessors? | Platform + any AI supplier + their subcontractors | The documented hosting, management, storage and connected suppliers. |
| Are there transfers outside the EEA? | Possibly — assessment is required for each service | To be assessed for all services and access routes. |
| How long is execution data retained? | According to the supplier’s policy | According to our own retention policy |
| Who can access the log files? | The supplier has technical access | The expressly authorised administrators and suppliers for the setup. |
| Can you provide a record of processing activities? | Yes, including external links in the chain | Yes, including all applicable roles and links in the chain. |
| Is a person involved in AI decisions? | Depends on your design | Depends on your design |
The final row is deliberately identical. Human oversight is a design choice, not an infrastructure choice.
A clear chain only helps if every service and data flow involved has actually been documented.
The option almost nobody considers: running the model yourself too
Even self-hosted automation can involve several external services. With an external language model, the contents of the model call are processed by that supplier; assess this alongside hosting, CRM, email, storage and management access.
For many applications, that is fine, provided you arrange it properly and are transparent about it. But there is a third option that rarely comes up: running a language model on your own infrastructure. The open models developed over the past two years have become good enough for the work SMEs need: classification, summarisation, structuring and drafting.
Scroll sideways to view all table columns.
| External model | Your own model | |
|---|---|---|
| Reasoning quality | Higher | Adequate to good |
| Classification and summarisation quality | High | Comparable |
| Costs | Per message, scales with volume | Infrastructure, management and any licences; capacity can scale up. |
| Data leaves your environment | At the model supplier; assess other connections separately | Depends on other connections and the setup |
| Management workload | Supplier management, usage control and integration management remain necessary | Managing your own infrastructure and model remains necessary |
| Suitable for | Complex, varied tasks | High-volume, repeatable work |
In practice, a hybrid setup works best: bulk work locally, difficult cases externally, with an explicit choice at each step.
Local processing can avoid an external data flow. Other suppliers and connections still need to be assessed separately. We agree the choice between local and external models in advance for each step.
Your AI register in five columns
An internal AI overview helps you inventory systems, purposes, suppliers and data flows. The table below is a practical starting point, not evidence that all statutory register or documentation obligations have been met. Which obligations apply depends on your role, system and processing activity.
Scroll sideways to view all table columns.
| Tool or workflow | Purpose | Supplier | Data that goes in | Risk level |
|---|---|---|---|---|
| Email triage agent | Classify incoming email and prepare a draft | Own n8n + external model | Email content, customer name | Limited |
| Invoice extraction | Extract fields from purchase invoices | Own n8n + own model | Invoice data, supplier name | Minimal |
| Website chatbot | Answer frequently asked questions | Own n8n + external model | Visitor’s question | Limited — disclosure obligation |
| Writing assistant | Write drafts | Commercial tool | No customer data, as agreed | Minimal |
Example register. Fill in your own rows — an hour’s work and you are ready for the first questionnaire.
Where we draw the line ourselves
We are not lawyers, and this article is not legal advice. We agree logging, permitted actions, error handling and necessary human approval in advance, based on the process and its risks. We do not automatically retain complete sensitive payloads. Read the guide to error handling in n8n.
If you are unsure about your particular situation — for example, because AI helps decide on recruitment, lending or access to a service — consult a lawyer. It takes an hour and may reveal a category of obligations you do not yet know about.
What this delivers commercially
Finally, the aspect consistently missing from compliance articles: this is more than risk management. It is a selling point.
- You win tenders that others drop out of. As soon as a client asks data questions, some competitors fall away because they do not have an answer.
- You can work with organisations that would otherwise be off limits. Healthcare, education, legal services and the public sector have strict requirements. Meeting them means less competition in that segment.
- You prepare for the next steps. The relevant high-risk rules apply from 2 December 2027 and 2 August 2028. A register and appropriate logging help with preparation. Which additional measures are needed depends on your role, application and the applicable rules; transitional provisions must also be assessed for existing systems.
That last point is the real argument. This is not about the current deadline. It is about making your operations explainable when someone asks about them — and that moment will come.
Frequently asked questions
Does the AI Act apply to my SME too?
The applicable obligations depend on your role and application. They may include transparency about AI where required, measures to support AI literacy and an assessment of data protection. Self-hosting does not replace that assessment, and an internal register does not by itself demonstrate full compliance.
What must I have in place since 2 August 2026?
Article 50 generally applies from 2 August 2026. For providers of certain generative systems placed on the market before that date, a transition until 2 December 2026 applies to Article 50(2); this is not a general postponement. Article 4 requires measures that support the development of AI literacy. The relevant high-risk rules apply from 2 December 2027 and 2 August 2028, with separate transitional provisions for existing systems.
What is data sovereignty?
Data sovereignty means that you determine where your data is stored, who can access it and which law applies. For an automation platform, the central question is simple: does your customer data leave your own environment and, if so, who receives it and where does it go?
Does self-hosting resolve my GDPR and AI Act obligations?
No. Self-hosting only determines the selected n8n infrastructure. Map hosting, management, logging, backups and all connected suppliers and data flows. The applicable privacy and AI obligations depend on the actual processing and role; questions about transfers remain relevant.
May I still use AI models from outside the EU?
This must be assessed for each processing activity. Check the data, suppliers involved, processing locations, access and required arrangements for any transfers outside the EEA. Your own n8n server or a local model does not replace that assessment. See the EDPB’s explanation of international transfers.
Can you answer your buyer’s questions?
We map your AI use and processor chain so that you have a concrete answer for every questionnaire. You receive the overview to keep, even if you do not automate anything further.
Book your free automation scanFree and without obligation. You always receive a short advisory report.
This article provides general information and is not legal advice. The AI Act phase-in dates are based on the published regulation and the Digital Omnibus (Regulation (EU) 2026/1744). If you are unsure about your situation, consult a lawyer.