EU AI Act Penalties: Fines of up to EUR 35 Million or 7 % of Turnover (Articles 99 to 101)

EU AI Act penalties reach EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher, for Article 5 breaches, with lower tiers of EUR 15 000 000 or 3 % and EUR 7 500 000 or 1 % (Article 99(3) to (5)). SMEs get lower caps in every tier, small mid-caps in two. At EU level, the European Data Protection Supervisor fines Union institutions under Article 100, and the Commission fines providers of general-purpose AI models under Article 101.

Regulation (EU) 2024/1689 entered into force on 1 August 2024; Regulation (EU) 2026/1744, the Digital Omnibus on AI, amended its penalty rules from 27 July 2026. Articles 99 to 101 form Chapter XII, the penalty chapter of the EU AI Act, and the inserted Article 75c adds Commission fines for certain AI systems. The fine-ceiling calculator on this page computes the statutory maximum from tier, offender, size and turnover; it gives an orientation, not a legal assessment.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.

What Are the Penalties for Breaching the EU AI Act?

Breaching the EU AI Act exposes an operator to national penalties, including administrative fines, warnings and non-monetary measures, within the EU ceilings of Article 99 (Article 99(1) as replaced by Regulation (EU) 2026/1744). Member States lay down these rules, which must be effective, proportionate and dissuasive and take into account the Commission guidelines under Article 96. Since 27 July 2026, the rules must also consider the interests of SMEs, including start-ups, and small mid-caps (SMCs) and their economic viability.

The fine ceilings form three tiers by type of breach: prohibited practices, the operator and notified-body duties listed in Article 99(4), and incorrect, incomplete or misleading information. Three EU-level regimes run alongside: Article 100 for Union bodies, Article 101 for model providers and Article 75c for AI systems under Article 75(1). Supervision follows the AI Act governance and enforcement structure of Chapters VII and IX.

The Three Fine Tiers of Article 99

Article 99 sets three fine tiers: Article 5 infringements, breaches of the duties listed in Article 99(4), and incorrect, incomplete or misleading information:

Article 99 of Regulation (EU) 2024/1689; paragraph 6a inserted by Regulation (EU) 2026/1744.

Each tier caps the fine at the higher of the fixed amount and the turnover percentage, so the percentage takes over from a turnover of EUR 500 million in tiers 1 and 2 and EUR 750 million in tier 3 (computed from Article 99(3) to (5)). The Commission enforcement page uses the short forms EUR 35 million or 7 %, EUR 15 million or 3 % and EUR 7.5 million or 1 %. Every figure is a maximum per fine, not a set penalty: the amount below it follows the ten factors of Article 99(7).

Which Breach Falls in Which Tier: Penalties by Provision

Each fined provision maps to one ceiling: Article 5 to tier 1, the Article 99(4) points to tier 2, information duties to tier 3 and model providers to Article 101:

Article 99(3) to (5), Article 100 and Article 101 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.

Misclassifying a system as not high-risk to circumvent the high-risk requirements is fined under Article 99 (Article 80(7)), as is a provider that misses the period prescribed for bringing a system into compliance (Article 80(4)). Point (da), inserted by Regulation (EU) 2026/1744 with effect from 27 July 2026, adds the Article 25(2) and (4) duties to Article 99(4); before that date, Article 99(4) did not list Article 25.

How the Maximum Fine Is Calculated

The maximum fine is the higher of a fixed amount and a turnover percentage for most undertakings, and the lower of the two for SMEs, including start-ups. Small mid-caps take the higher figure in tier 1 and the lower in tiers 2 and 3. The calculator applies this logic and returns the statutory ceiling, never a predicted fine, and five worked cases show how size and tier change the result:

Statutory ceilings, not predicted fines; computed from Article 99(3) to (6a) and Article 101(1).

The Undertaking Condition and the Preceding Financial Year

The turnover percentages apply only "if the offender is an undertaking", measured on total worldwide annual turnover for the preceding financial year; other offenders face the fixed amount only. For an offender that is not an undertaking, EUR 35 million, EUR 15 million or EUR 7.5 million is therefore the full ceiling. Article 101(1) uses the same base for model providers: "annual total worldwide turnover in the preceding financial year".

The Lower Caps for SMEs, Start-Ups and Small Mid-Caps

SMEs, including start-ups, face the lower of amount and percentage in all three tiers (Article 99(6)), while small mid-caps (SMCs) get the lower figure only in tiers 2 and 3 (Article 99(6a)). For an SME with a turnover of up to EUR 50 million, the percentage is always the lower figure, so its ceiling never exceeds EUR 3.5 million in tier 1, EUR 1.5 million in tier 2 and EUR 500 000 in tier 3 (computed from Article 99(3) to (6)).

Article 99(6a) keeps tier 1 at "whichever is higher" for SMCs, so an SMC that breaches Article 5 faces a ceiling of at least EUR 35 million, like a larger undertaking. The Digital Omnibus on AI inserted the SMC cap together with the SMC definition in Article 3(14b). SMEs are defined by Recommendation 2003/361/EC: fewer than 250 persons and a turnover of up to EUR 50 million and/or a balance sheet total of up to EUR 43 million. SMCs are enterprises that are not SMEs, with fewer than 750 persons and a turnover of up to EUR 150 million or a balance sheet total of up to EUR 129 million (Recommendation (EU) 2025/1099). Support measures, such as free sandbox access for SMEs under Article 58(2), belong to the AI Act for SMEs, start-ups and small mid-caps rather than to the fine rules.

How Authorities Set the Amount: The Ten Factors of Article 99(7)

Ten factors in Article 99(7) decide where a fine lands below the ceiling, starting with the nature, gravity and duration of the infringement:

1. Nature, gravity and duration of the infringement, the purpose of the AI system, the number of affected persons and the level of damage (point (a)).
2. Fines by other market surveillance authorities already imposed on the same operator for the same infringement (point (b)).
3. Fines under other law for the same activity (point (c)).
4. Size, annual turnover and market share of the operator (point (d)).
5. Other aggravating or mitigating factors, such as the financial benefit gained (point (e)).
6. Cooperation with the national competent authorities (point (f)).
7. Degree of responsibility of the operator (point (g)).
8. Manner in which the infringement became known, in particular self-notification (point (h)).
9. Intent or negligence (point (i)).
10. Mitigation of the harm suffered by affected persons (point (j)).

Recital 168 of Regulation (EU) 2024/1689 asks for effective, proportionate and dissuasive penalties that respect the ne bis in idem principle and take due account of the size of the provider. Factors (b) and (c) make the authority consider fines already imposed for the same infringement or the same activity.

Four Fining Authorities and Their Ceilings

Four fining powers exist under the AI Act: national authorities under Article 99, the European Data Protection Supervisor under Article 100, and the Commission under Article 101 and under Article 75c:

National market surveillance authorities act under Article 74, which applies Regulation (EU) 2019/1020 to AI systems. Member States shall designate at least one notifying authority and at least one market surveillance authority, and a market surveillance authority as single point of contact, with a deadline of 2 August 2025 (Article 70).

Article 100: Fines on Union Institutions, Bodies, Offices and Agencies

The European Data Protection Supervisor fines Union institutions, bodies, offices and agencies up to EUR 1 500 000 for Article 5 breaches and EUR 750 000 for other breaches (Article 100(2), (3)). Its seven factors, points (a) to (g), include the annual budget of the body, and the body has the right to be heard. Fines go to the general budget of the Union and must not affect the effective operation of the fined body (Article 100(6)), and the Supervisor notifies the Commission every year (Article 100(7)).

Article 101: Commission Fines on Model Providers

The Commission fines providers of general-purpose AI models up to 3 % of annual total worldwide turnover in the preceding financial year or EUR 15 000 000, whichever is higher, since 2 August 2026 (Article 101(1); Article 113, third paragraph, point (b)). Chapter V obligations have applied since 2 August 2025, and models placed on the market before that date must comply by 2 August 2027 (Article 111(3)). A fine requires that the provider acted intentionally or negligently on one of four grounds:

• Infringement of the relevant provisions of the act (point (a)).
• Non-compliance with a request for documents or information under Article 91, or incorrect, incomplete or misleading information (point (b)).
• Non-compliance with a measure requested under Article 93 (point (c)).
• Failure to give access to the model for an evaluation under Article 92 (point (d)).

Article 101 has no SME or SMC reduction, so the higher figure applies to every model provider. Implementing Regulation (EU) 2026/1755 sets the procedural arrangements for these fines and for model evaluations, the core of the Commission's enforcement of GPAI model rules.

Article 75c: Commission Fines for AI Systems under Exclusive Union Competence

For AI systems under the Commission's exclusive competence in Article 75(1), the Commission applies Article 99(3) to (7) mutatis mutandis and can add periodic penalty payments (Article 75c(4), (5)). Article 75(1), as replaced on 27 July 2026, covers AI systems based on a general-purpose AI model of the same provider or undertaking, with the exceptions listed in point (a), and AI systems integrated into very large online platforms or very large online search engines designated under Regulation (EU) 2022/2065. The European AI Office, a Commission function under Article 3(47), exercises these powers from 2 August 2026. An implementing act on Articles 75c and 75d is proposed, as a draft of 12 October 2026 (Ares(2026)9589403) open for feedback until 9 November 2026.

When Each Penalty Applies: From 2 February 2025 to 2 August 2028

Chapter XII has applied since 2 August 2025 except Article 101, which applies from 2 August 2026 (Article 113, third paragraph, point (b)), and a fine can only sanction a duty that already applies. The Commission enforcement page, last updated on 20 October 2026, states: "The enforcement powers of the AI Office and the national competent authorities of the Member States apply from 2 August 2026". Six dates switch the penalty rules on, from 2 February 2025 to 2 August 2028:

Before 27 July 2026, Chapter III Sections 1 to 3 were to apply from 2 August 2026 for Annex III systems and from 2 August 2027 for Annex I systems; Regulation (EU) 2026/1744 moved both dates. Article 99(4) can reach the high-risk operator duties of Articles 16 and 22 to 26 only once those sections apply. The EU AI Act timeline records every other application date of the act.

Procedure, Limitation Periods and Court Review

Commission fines become time-barred five years after the infringement, or after a continuing infringement ends, under Article 10 of Implementing Regulation (EU) 2026/1755 and Article 75c(8). That regulation of 20 July 2026 (OJ L, 2026/1755, 21.7.2026), in force since 10 August 2026 and based on Articles 92(6) and 101(6), caps the imposition period at twice the limitation period plus any suspension and gives the provider no less than 21 days for written observations (Articles 7(2) and 10). Enforcement of a fine is time-barred five years after the decision becomes final (Article 11), and the Commission may order interim measures on grounds of urgency before opening proceedings, including preventing a general-purpose AI model from being made available (Article 5).

Article 75c(8) sets the same two five-year periods, to impose and to enforce, for fines on Article 75(1) AI systems. The Court of Justice of the European Union reviews both kinds of Commission decision with unlimited jurisdiction and may cancel, reduce or increase the fine or the periodic penalty payment (Articles 101(5) and 75c(6)).

National Penalty Rules under Article 99(1), (8) and (9)

Member States lay down the penalty rules, notify them to the Commission by 2 August 2025 and report fines and litigation every year (Article 99(1), (2), (11)). Article 99 sets the maximum fines national rules must provide for, so the Article 99(3) to (5) amounts are the ceilings of national fines, not fines the act imposes by itself.

Each Member State decides to what extent fines can be imposed on public authorities and bodies (Article 99(8)). Fines can be imposed by competent national courts or other bodies, depending on the legal system of the Member State (Article 99(9)). The AI Act national competent authorities apply the penalty rules of their own Member State, so national amounts and procedures are set Member State by Member State.

Fine Decisions Published as of 24 October 2026

No AI Act fine decision has been published by the Commission as of 24 October 2026, on an enforcement page last updated on 20 October 2026. A Commission news item of 12 October 2026 states that the AI Office has sent requests for information on security practices. Article 75d(4) requires the AI Office to publish its decisions under Articles 75b and 75c, including the names of the parties and the penalties imposed.

How to Reduce Penalty Exposure: Cooperation, Sandboxes and Preparation

Four steps lower penalty exposure under the EU AI Act: mapping each duty to its tier, documenting classification decisions, answering authority requests accurately and testing in a regulatory sandbox. Each step targets a tier of Article 99 or a factor of Article 99(7):

1. Map every AI system and each duty to its Article 99 tier.
2. Document classification decisions, because misclassification to circumvent the high-risk requirements is fined under Article 80(7).
3. Answer information requests accurately, since misleading replies carry the Article 99(5) tier.
4. Test innovative systems in an AI regulatory sandbox under Article 57.

Cooperation with the authorities and self-notification count in the amount of the fine itself, as factors (f) and (h) of Article 99(7). Factor (h) asks in particular whether, and to what extent, the operator notified the infringement. An EU AI Act compliance programme sets out the duties of providers and deployers step by step, which is where such records start.

Article 57(12) excludes administrative fines for AI Act infringements when a prospective provider observes the sandbox plan and terms and follows the guidance in good faith, while liability for damage to third parties remains. Each Member State must have at least one national AI regulatory sandbox operational by 2 August 2027 (Article 57(1) as replaced by Regulation (EU) 2026/1744).

Turning the tier map into tasks starts with a checklist: the EU AI Act checklist sorts the obligations by role and risk class, each with its deadline. Fines under the NIS2 Directive form a separate regime.

EU AI Act Penalties: Related Questions

Article 2(1), Article 85, Article 87 and Article 99(1) and (7) of Regulation (EU) 2024/1689 and recital 15 of Regulation (EU) 2026/1744 answer the related questions on non-EU providers, GDPR fines, criminal penalties, reporting channels and provisions outside the tiers.

Can a Non-EU Provider Be Fined?

Yes: Article 2(1)(a) and (c) reach providers outside the EU, and their authorised representatives are fined under Article 99(4), point (b).

The EU AI Act for non-EU companies explains when providers outside the EU must comply. Who the EU AI Act applies to follows from the material, personal and territorial scope of Article 2.

Can an AI Act Fine Be Added to a GDPR Fine?

An AI Act fine can exist alongside a GDPR fine, and Article 99(7), point (c), makes the authority take into account fines under other law for the same activity.

The comparison AI Act vs GDPR shows where the two regulations overlap. Point (b) separately covers fines already imposed by other market surveillance authorities for the same infringement.

Are There Criminal Penalties for AI Act Breaches?

Article 99 sets administrative fines, and recital 15 of Regulation (EU) 2026/1744 notes that Member States may provide criminal penalties for the new Article 5 prohibitions.

Article 5(1), points (ba) and (bb), and paragraphs 1a and 1b apply from 2 December 2026, while points (a), (b) and (c) to (h) apply since 2 February 2025.

Who Can Report a Suspected Infringement?

Any natural or legal person may complain to a market surveillance authority about a suspected infringement (Article 85).

The rights of affected persons include whistleblower protection under Directive (EU) 2019/1937 (Article 87). The AI Act Whistleblower Tool, launched on 24 November 2025, accepts anonymous reports; the AI Act Complaints Tool covers only Article 75(1) systems and is not anonymous.

What Applies to Breaches Outside the Article 99 Tiers?

Article 4 and Article 27 breaches carry no EU ceiling and depend on national rules under Article 99(1).

Penalties for a missing fundamental rights impact assessment therefore follow the penalty rules of each Member State, which every Member State notifies to the Commission under Article 99(2).

Frequently Asked Questions about EU AI Act Penalties

What is the maximum fine under the EU AI Act?

EUR 35 000 000 or 7 % of total worldwide annual turnover for the preceding financial year, whichever is higher, for Article 5 infringements (Article 99(3)). The percentage applies only if the offender is an undertaking.

Do SMEs pay lower AI Act fines?

Yes. SMEs, including start-ups, get the lower of amount and percentage in all three tiers; SMCs only in tiers 2 and 3 (Article 99(6) and (6a)). Article 101 fines on model providers have no size reduction.

When can AI Act fines be imposed?

Chapter XII applies since 2 August 2025; Article 101 and the enforcement powers of the AI Office and national authorities apply from 2 August 2026. High-risk duties can be fined once Chapter III Sections 1 to 3 apply: from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems.

Has the Commission published an AI Act fine decision?

No. The Commission has published no AI Act fine decision as of 24 October 2026. National fines reach the Commission through the annual reports of the Member States under Article 99(11).

Is there an EU fine for breaching Article 4?

No EU ceiling exists: Article 99(4) does not list Article 4, so national rules under Article 99(1) decide whether and how AI literacy breaches are fined.