Article 88 — Penalties applicable to providers of general-purpose AI models (EU AI Act)

Article 88 of Regulation (EU) 2024/1689 — Penalties applicable to providers of general-purpose AI models. Official text, practical interpretation, key obligations and compliance implications.

Official Text Summary

Article 88 of Regulation (EU) 2024/1689 establishes the penalty regime specifically applicable to providers of general-purpose AI (GPAI) models, complementing the broader penalty framework of Article 99. It sets two principal financial thresholds.

First, providers of general-purpose AI models who infringe the obligations contained in Chapter V of the Regulation — covering transparency obligations, technical documentation, copyright compliance, and the additional requirements for models presenting systemic risk — are subject to administrative fines of up to 15 million EUR, or, where the offender is an undertaking, up to 3% of total worldwide annual turnover for the preceding financial year, whichever is the higher amount.

Second, providers who supply incorrect, incomplete, or misleading information to the AI Office or national competent authorities in response to a request made under Articles 91 or 92, or who fail to remedy an infringement within the timeframe set by a corrective measure, are subject to fines up to 15 million EUR or up to 3% of worldwide annual turnover.

Article 88 also confirms that the European AI Office acts as the lead enforcement body for GPAI model providers, with the power to initiate proceedings, conduct evaluations, and impose fines in accordance with the procedural safeguards established in Articles 90 through 99. Fines imposed on Union institutions and bodies follow distinct rules. The article reinforces that all penalties must be effective, proportionate, and dissuasive, and that individual circumstances — including cooperation and remediation — are considered when determining the final amount.

What This Means in Practice

Article 88 directly affects any legal entity, including non-EU entities placing GPAI models on the Union market, that develops or releases a general-purpose AI model as defined in Article 3(63) of the Regulation. This includes providers of foundation models, large language models, multimodal models, and other models trained on broad data at scale that can serve a wide range of downstream tasks.

In practical terms, a provider must first determine whether its model meets the GPAI definition and, if so, fulfil the Chapter V obligations: maintaining technical documentation, publishing a summary of training data in accordance with copyright law, implementing a policy to comply with Union copyright rules, and registering the model in the relevant EU database. Providers of models deemed to present systemic risk — currently defined by reference to a training compute threshold of 10^25 FLOPs, or by AI Office designation — face additional obligations including adversarial testing, incident reporting, and cybersecurity measures.

Failure to fulfil any of these obligations exposes a provider to fines under Article 88. For large technology companies whose annual global turnover runs into tens of billions of euros, a 3% turnover-based fine substantially exceeds the 15 million EUR absolute cap, making the turnover multiplier the operative ceiling in practice. A provider headquartered outside the EU must designate an authorised representative in the Union under Article 54, and that representative's presence does not shield the provider from direct liability.

Providers should treat Article 88 as a strong financial incentive to complete GPAI compliance before the August 2025 application date. Documented compliance programmes, audit trails, and proactive engagement with the AI Office during any investigation are the most effective mitigating factors.

Key Obligations

• Chapter V compliance as the trigger condition: The penalty power under Article 88 is activated by infringement of any obligation in Chapter V (Articles 53 to 56), meaning GPAI providers must map every applicable obligation to an internal control before the August 2025 application date.
• Accurate and complete information to the AI Office: Providers must respond truthfully and fully to any information request issued by the AI Office under Articles 91 and 92; supplying incorrect, incomplete, or misleading responses is itself a distinct infringement subject to the same penalty ceiling.
• Systemic risk obligations for high-impact models: Providers of GPAI models with systemic risk must additionally comply with Articles 55 and 56 — adversarial testing, incident notification, and cybersecurity safeguards — and are subject to Article 88 penalties for failure to do so.
• Designation of an authorised representative: Non-EU providers must appoint an authorised representative in the Union, and failure to do so is an infringement of Chapter V triggering Article 88 exposure.
• Timely remediation of corrective measures: Where the AI Office issues a corrective measure requiring a provider to remedy an infringement within a specified period, failure to comply within that deadline constitutes a separate infringement subject to additional fines.
• Proportionality and cooperation as mitigating factors: While not a formal obligation, the Regulation requires authorities to consider the degree of cooperation and voluntary remediation when calculating fines, giving providers a strong compliance incentive to engage proactively with the AI Office.

Relationship to Other Articles

Article 88 cannot be read in isolation. It draws its substantive scope from Chapter V (Articles 53 to 56), which defines the obligations whose breach triggers the penalty. It operates alongside Article 99, which establishes the general penalty regime for all other infringements of the Regulation, and should be read as lex specialis with respect to GPAI model providers.

The procedural framework within which Article 88 fines are imposed is set out in Articles 90 to 99, including the AI Office's power to initiate proceedings (Article 90), request information (Articles 91 and 92), conduct on-site inspections, and impose interim measures. Article 101 governs fines imposed on Union institutions, bodies, and agencies and is explicitly distinguished from Article 88.

Article 88 also connects to Article 54 (authorised representatives for non-EU providers), Article 72 (the EU database for GPAI models), and Recitals 153 to 157, which explain the legislative intent behind graduated penalties and the primacy of the AI Office in GPAI enforcement. For systemic risk models, Articles 55 and 56 define the additional obligations whose breach is penalised under Article 88.

Compliance Timeline

The EU AI Act entered into force on 1 August 2024. However, Chapter V obligations applicable to GPAI model providers — and therefore the Article 88 penalty regime covering those obligations — became applicable on 2 August 2025, twelve months after entry into force, in accordance with Article 113(3).

Providers should note the following phased timeline:

• 1 August 2024 — Regulation entered into force; no obligations yet applicable.
• 2 February 2025 — Prohibited AI practices (Article 5) became applicable.
• 2 August 2025 — Chapter V GPAI obligations became applicable. Article 88 penalties are enforceable from this date for infringements of those obligations.
• 2 August 2025 — AI Office governance rules and general provisions applicable.
• 2 December 2026 — High-risk AI system obligations under Annex I (product safety legislation) become applicable.
• 2 August 2027 — High-risk AI system obligations for systems listed in Annex III become fully applicable.

Providers of general-purpose AI models who had not completed their Chapter V compliance programme by 2 August 2025 are already exposed to Article 88 enforcement action. The AI Office has indicated it will prioritise providers of models presenting systemic risk in its initial supervisory activities, but all GPAI model providers within scope remain subject to the penalty regime from that date.