Penalties and enforcement under the EU AI Act (Article 99)
In short
The EU AI Act sets a tiered penalty structure that scales with the severity of the breach, modelled on the same “percentage of global turnover” approach used in GDPR, and, at its highest tier, exceeds GDPR’s maximum fines.
Three tiers of maximum fines
- Breach of Article 5 prohibited practices: up to €35 million or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher. This is the Act’s top tier, reserved for the practices it treats as unacceptable outright.
- Non-compliance with other obligations, including the Articles 9-15 high-risk requirements, provider and deployer duties, and most of the rest of the substantive Act: up to €15 million or 3% of total worldwide annual turnover, whichever is higher.
- Supplying incorrect, incomplete, or misleading information to notified bodies or national authorities in response to a request: up to €7.5 million or 1% of total worldwide annual turnover, whichever is higher.
A different rule for SMEs
For SMEs, including startups, each of these thresholds applies as whichever amount is lower, not higher, between the fixed euro figure and the turnover percentage, a deliberate softening of the general rule aimed at proportionate enforcement against smaller organisations, though it does not exempt SMEs from the obligations themselves.
Who enforces
Fines are imposed by national market surveillance authorities designated by each Member State, based on the specific facts of each case, the Act sets the ceiling, not a fixed penalty, and directs authorities to weigh factors like the nature and duration of the infringement, whether it was intentional, and cooperation with authorities during investigation.
Turnover, not just EU revenue
Like GDPR, the percentage-of-turnover calculation is based on the organisation’s total worldwide annual turnover, not just revenue generated within the EU, a global company with a small EU footprint can still face a fine calculated against its entire global revenue.
The size of these fines is precisely why a systematic compliance process (correctly identifying prohibited practices, classifying risk tiers accurately, and documenting the obligations that follow) is worth the investment relative to the cost of getting the classification wrong.
Frequently asked questions
- What are the maximum fines under the EU AI Act?
- Three tiers: up to €35 million or 7% of worldwide annual turnover for prohibited-practice breaches (Article 5); up to €15 million or 3% for non-compliance with most other obligations, including the Articles 9–15 high-risk requirements; and up to €7.5 million or 1% for supplying incorrect, incomplete, or misleading information to authorities. The higher of the euro figure and the percentage applies.
- Are EU AI Act fines lower for small companies?
- For SMEs, including startups, each threshold applies as whichever amount is lower (the fixed euro figure or the turnover percentage) a deliberate softening, though it does not exempt SMEs from the obligations themselves.
- Is the fine based on EU revenue or global turnover?
- Like GDPR, the percentage is calculated on the organisation's total worldwide annual turnover, not just EU revenue, so a global company with a small EU footprint can face a fine calculated against its entire global revenue.
Related guides
Not sure where your company stands?
Our free assessment gives you an indicative result in minutes (free and anonymous) no account needed.
Start the free check