EU AI Act fines: how much can your company be penalized?
The EU AI Act does not just set rules — it backs them with some of the largest fines in EU tech regulation, above even the GDPR's ceiling. If you want a single number for why the Act is worth taking seriously, it is this: up to €35 million or 7% of worldwide annual turnover. Here is how the penalties actually work.
This is an information service to help you orient, not legal advice. For the obligations tied to your own AI use, see which apply to your company.
The three penalty tiers
Penalties sit in Article 99, and the amount depends on what you breached. Each tier is "up to €X or Y% of total worldwide annual turnover for the preceding financial year, whichever is higher."
| Breach | Maximum fine |
|---|---|
| Prohibited AI practices (Article 5) — the banned uses | €35M or 7% |
| Most other obligations — high-risk duties, transparency, provider/deployer obligations | €15M or 3% |
| Wrong information to authorities — incorrect, incomplete, or misleading info to notified bodies or regulators | €7.5M or 1% |
Separately, providers of general-purpose AI (GPAI) models can be fined by the European Commission under Article 101 — up to €15M or 3% of worldwide annual turnover.
The "whichever is higher" wording matters: for a large company, 7% of global turnover dwarfs €35M, so the percentage is the real ceiling.
The lighter cap for SMEs and start-ups
The Act tries not to let a percentage-of-global-turnover fine wipe out a small company. Under Article 99(6), for SMEs and start-ups each fine is capped at whichever is lower — the percentage or the fixed sum — the mirror image of the rule for large firms. It is a genuine proportionality safeguard, though "lower of €35M or 7%" is still a serious number.
Who actually issues the fines
Enforcement is not centralized:
- National market-surveillance authorities in each Member State enforce the Act against providers and deployers, and set the penalties (within the Act's ceilings) under their national law.
- The European Commission, through the AI Office, enforces the rules on general-purpose AI models directly.
Fines are meant to be "effective, proportionate and dissuasive," and authorities weigh factors like the gravity of the breach, whether it was intentional, and cooperation.
When it took effect
The penalty regime is not a future problem — it has applied since 2 August 2025, alongside the governance framework. The prohibitions it enforces (Article 5) have applied since 2 February 2025. So the two highest-risk categories — banned practices and the duty to give authorities accurate information — are already live and already fineable.
Note that the recent Digital Omnibus deferred the high-risk obligations (to 2 December 2027 and 2 August 2028) — but it did not defer the prohibitions or the penalty regime. See what the Digital Omnibus changed.
What to do about it
- Rank your exposure by tier. Anything near the Article 5 prohibitions is the 7% zone — treat it first.
- Don't ignore the "information" tier. A €7.5M / 1% fine for misleading a regulator is easy to trigger with sloppy documentation.
- Map your obligations before the high-risk clock runs down. The extra runway to 2027 is time to build compliance, not a reason to defer it.
The fastest way to see which tier you're actually in: answer three questions about your AI use and we'll show the verified obligations that apply. To be told the moment a penalty rule or deadline changes, join the waitlist.
The official text is Regulation (EU) 2024/1689. This article is an information service to help you orient — it is not legal advice.
Frequently asked questions
What is the maximum fine under the EU AI Act?
The highest tier is up to €35 million or 7% of a company's total worldwide annual turnover for the previous financial year — whichever is higher. It applies to breaches of the Article 5 prohibitions on unacceptable-risk AI.
What are the EU AI Act penalty tiers?
Three main tiers under Article 99: up to €35M / 7% for prohibited-AI breaches; up to €15M / 3% for most other obligations (including high-risk and transparency duties); and up to €7.5M / 1% for giving incorrect, incomplete, or misleading information to authorities or notified bodies. Providers of general-purpose AI models can be fined up to €15M / 3% by the Commission under Article 101.
Are the fines smaller for small companies?
Yes. For SMEs and start-ups, Article 99(6) caps the fine at whichever is LOWER — the percentage of turnover or the fixed amount — rather than whichever is higher. It is a proportionality safeguard so a percentage-of-global-turnover fine can't crush a small firm.
When did the EU AI Act penalties start to apply?
The penalty regime has applied since 2 August 2025, together with the governance framework. The prohibitions it enforces have applied since 2 February 2025.
See which obligations apply to your company → or join the waitlist
This is an information service, not legal advice.