Article 100 of Regulation (EU) 2024/1689 — Administrative fines on Union institutions and bodies. Official text, practical interpretation, key obligations and compliance implications.
Article 100 answers a question most compliance programmes never ask: who fines the EU itself? When Union institutions, bodies, offices or agencies breach the AI Act, the European Data Protection Supervisor holds the fining pen — on a deliberately smaller scale.
Official Text Summary
The European Data Protection Supervisor may impose administrative fines on Union institutions, bodies, offices and agencies falling within the scope of the Regulation, taking into account the nature, gravity and duration of the infringement, the number of persons affected, the degree of cooperation, any prior similar findings and the manner in which the infringement became known. The ceilings are deliberately lower than for private operators: up to EUR 1 500 000 for non-compliance with the Article 5 prohibitions, and up to EUR 750 000 for other obligations. The institution concerned has the right to be heard before any decision, proceedings respect confidentiality, the Court of Justice has unlimited jurisdiction to review, and the funds collected accrue to the general budget of the Union.
Key Obligations
- The EDPS may impose administrative fines on Union institutions, bodies, offices and agencies within the Act's scope
- Ceilings: up to €1 500 000 for breaches of the Article 5 prohibitions; up to €750 000 for non-compliance with other obligations
- Fines follow the classic criteria — nature, gravity, duration, cooperation, prior findings — with a right to be heard, Court of Justice jurisdiction, and proceeds flowing to the Union budget
Compliance Timeline
Applicable since 2 August 2025, together with the rest of the general-purpose AI framework; the 2026 Digital Omnibus did not alter this date.
Official AI Act Compliance Deadline Calendar
Updated · Sources: Regulation (EU) 2024/1689 and the 2026 Digital Omnibus on AI.
| Obligation | Applies to | Original date | New date | Status | Countdown | Legal basis |
|---|---|---|---|---|---|---|
| Prohibited Practices (Art. 5) | All providers and deployers | active | — | AI Act Art. 5 | ||
| GPAI Rules (Chapter 5) | GPAI model providers | active | — | AI Act Art. 51-56 | ||
| Commission Enforcement Powers over GPAI | GPAI model providers | active | — | AI Act Art. 88-94, 101 | ||
| Transparency Obligations (Art. 50) | Providers and deployers of chatbots, generative, emotion recognition systems | active | — | AI Act Art. 50 | ||
| New Art. 5 Prohibition (CSAM / non-consensual intimate imagery) | Providers and deployers of generative AI systems | active | — | AI Omnibus 2026 Art. 5 | ||
| AI-Generated Content Marking (pre-existing systems) | Providers of generative AI systems on the market before 2 Aug 2026 | active | — | AI Act Art. 50(2) — transitional | ||
| Regulatory Sandboxes | National competent authorities | deferred | — | AI Omnibus 2026 Art. 57 | ||
| High-risk AI — Annex III (standalone) | Providers of standalone Annex III systems | deferred | — | AI Omnibus 2026 Art. 6(2) | ||
| High-risk AI — Annex I (embedded) | AI embedded in Annex I regulated products | deferred | — | AI Omnibus 2026 Art. 6(1) |
⬇ Download JSON · CC BY 4.0
AI Act meets DORA and NIS2
Is your organisation subject to both the AI Act and DORA? The two regulations intersect on the operational resilience of financial AI systems. Our sister site regulation-dora.eu covers DORA in depth — including what the AI Act adds on top of an existing DORA programme.
The AI Act for financial institutions ↗ Explore regulation-dora.eu ↗Frequently Asked Questions
A fine on an institution is a transfer inside public money — its function is accountability and visibility, not deterrence by pain. €1.5 million against an EU body is a significant censure; the reputational and inter-institutional cost is the real sanction.
The EDPS acts as their market surveillance authority under the Act. A Union body deploying, say, a recruitment screening system carries obligations parallel to a private deployer's — with Article 100 as the sanction of last resort.
Stay ahead of AI Act changes
Get compliance alerts when deadlines or obligations change.
No spam. One-click unsubscribe.
Take compliance further with the AI Act Academy
Templates, training modules, and live Q&A — everything needed to implement AI Act compliance.