EU AI Act Penalties and Fines: The Three Tiers Explained

EU AI Act fines run in three tiers: €35M or 7% of turnover for prohibited practices, €15M or 3% for most breaches, €7.5M or 1% for misleading information.

The three penalty tiers at a glance

The EU AI Act sets maximum fines in Article 99. The tier depends on which obligation was breached, not on how much harm resulted.

The percentage is calculated on the preceding financial year's total worldwide annual turnover of the undertaking, not on EU turnover and not on the revenue of the specific product.

The SME rule works in reverse

This is the detail most summaries get wrong. For ordinary undertakings the fine is the higher of the fixed amount and the percentage. For SMEs and start-ups, Article 99 applies whichever figure is lower.

The practical effect is large:

• A group with €10 billion turnover breaching Article 5 faces up to 7% — €700 million, far above the €35 million figure.
• A start-up with €2 million turnover breaching the same article faces 7% of €2 million — €140,000, far below €35 million.

So the headline "€35 million" number is close to meaningless for small companies, and much too low for large ones. Always compute both figures before quoting an exposure.

Who enforces what

Three separate enforcement tracks run in parallel, and they are frequently conflated.

Article 99 — national market surveillance authorities. Each Member State designates the authorities that supervise operators on its territory and lays down the penalty regime, within the ceilings above. Member States were required to notify their rules to the Commission. Because the ceilings are maxima rather than fixed amounts, actual exposure varies by country.

Article 100 — the European Data Protection Supervisor. EU institutions, bodies, offices and agencies are in scope of the AI Act, but not of national enforcement. The EDPS may impose administrative fines of up to €1,500,000 for breaches of the Article 5 prohibitions and up to €750,000 for other breaches. The scale is deliberately far lower than for private operators.

Article 101 — the Commission, via the AI Office. Providers of general-purpose AI models answer to the Commission rather than to national authorities. The Commission may impose fines of up to €15 million or 3% of worldwide annual turnover. This power activates on 2 August 2026.

When penalties started applying

The penalty framework did not arrive with the rest of the Regulation. It phased in:

• 2 February 2025 — the Article 5 prohibitions took effect, but the penalty machinery was not yet applicable.
• 2 August 2025 — Article 99 became applicable, alongside the governance architecture and the GPAI obligations. From this date national authorities could sanction breaches.
• 2 August 2026 — the Commission's enforcement powers over general-purpose AI model providers under Article 101 activate.

The 2026 Digital Omnibus deferred the substantive high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It did not defer the prohibitions or the penalty regime — a distinction worth checking against the full compliance timeline.

What regulators weigh before fining

Article 99 requires authorities to take into account, among other factors:

• the nature, gravity and duration of the infringement, and the number of people affected
• whether the same operator has already been fined for the same infringement by another authority
• the size, annual turnover and market share of the operator
• whether the infringement was intentional or negligent
• any action taken to mitigate harm
• the degree of cooperation with authorities
• how the authority became aware of the infringement, and in particular whether the operator notified it

That last point matters operationally: self-reporting is an explicit mitigating factor.

Reducing exposure in practice

Penalty exposure is mostly a function of classification accuracy. Most organisations are not at risk of the 7% tier — the Article 5 prohibitions are narrow and largely cover practices no compliant business intends. The realistic exposure sits in the 3% tier, and it follows from three questions:

1. Do we operate a high-risk system without knowing it? Annex III use cases in recruitment, credit scoring, education and essential services catch many systems that were never described internally as "AI". Start from the high-risk classification rather than from the vendor's label.
2. Are we a provider or a deployer? The obligation sets differ sharply, and modifying a system or putting it on the market under your own name can convert a deployer into a provider. See providers vs deployers.
3. Can we evidence compliance? The €7.5 million tier punishes bad answers to regulators, independent of the underlying breach. Technical documentation, logs and a conformity trail are what turn a defensible position into a demonstrable one.

Run the compliance checklist to establish where you stand, and use the sanction estimator to model exposure against your own turnover.