EU AI Act penalties and fines

Article 99 sets three tiers. Placing on the market, putting into service or using an AI system caught by the prohibitions in Article 5 carries up to 35 million euro or 7 percent of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(3)). Most other duties sit at up to 15 million euro or 3 percent (Article 99(4)): provider duties under Article 16, authorised representatives under Article 22, importers under Article 23, distributors under Article 24, deployers under Article 26 and the transparency duties in Article 50.

Supplying incorrect, incomplete or misleading information to a notified body or a national authority carries up to 7.5 million euro or 1 percent (Article 99(5)). These are ceilings, not price lists. Article 99(1) requires national penalties to be effective, proportionate and dissuasive and to take into account the interests of SMEs, including start-ups, and their economic viability. The percentage runs on worldwide turnover, not on EU or national revenue.

For AI systems, nationally. Article 99(1) obliges each Member State to lay down the rules on penalties and other enforcement measures and to notify them to the Commission (Article 99(2)). Depending on the legal system, fines may be imposed by national courts or by other bodies (Article 99(9)), and each Member State decides separately to what extent its own public authorities can be fined at all (Article 99(8)). The investigating bodies are the market surveillance authorities designated under Article 70.

For general-purpose AI models the route runs through Brussels. Under Article 101 the Commission may fine the provider up to 15 million euro or 3 percent of annual total worldwide turnover, whichever is higher. It must first communicate its preliminary findings and hear the provider (Article 101(2)), and the Court of Justice has unlimited jurisdiction to cancel, reduce or increase the fine (Article 101(5)). Article 113 carved Article 101 out of the 2 August 2025 start date, so these fines apply from 2 August 2026.

Article 99(7) lists what an authority weighs: the nature, gravity and duration of the infringement and its consequences, including how many people were affected; whether another authority has already fined the same operator for the same conduct; the operator's size, annual turnover and market share; any financial benefit gained or loss avoided; the degree of cooperation with the authorities; the technical and organisational measures already implemented; how the authority learned of the breach, in particular whether the operator notified it; intent or negligence; and any action taken to mitigate the harm.

Two of those are yours to build in advance. Documented technical and organisational measures count under Article 99(7)(g) and voluntary notification under Article 99(7)(h), so a dated AI inventory, a written risk assessment and a record of your Article 4 AI literacy measures are worth more than an unread policy. Article 99(10) adds that these powers are exercised subject to procedural safeguards, including effective judicial remedies and due process.

Yes, by an inversion of the rule. Under Article 99(6), where the offender is an SME, including a start-up, each fine under Article 99 is capped at the lower of the fixed amount and the percentage rather than the higher. A company with 4 million euro of turnover is therefore exposed to 3 percent of that figure in the Article 99(4) tier, not to 15 million euro. Regulation (EU) 2026/1744 added Article 99(6a), extending the same cap to small mid-caps, but only for the Article 99(4) and (5) tiers.

Article 85 lets any natural or legal person with grounds to consider that the Regulation has been infringed complain to the relevant market surveillance authority. Complaints are taken into account in market surveillance and handled under Regulation (EU) 2019/1020. Where the authority has sufficient reason to consider that a system presents a risk to health, safety or fundamental rights, it evaluates that system against all the requirements of the Regulation, and the operators concerned must cooperate (Article 79(2)).

The first outcome is not a fine. On finding non-compliance the authority requires the operator, without undue delay, to take corrective action, to withdraw the system or to recall it within a prescribed period (Article 79(2)). Only if the operator fails to act adequately does it take provisional measures to prohibit or restrict the system and notify the Commission and the other Member States (Article 79(5)). A fine, where one follows, sits alongside that process rather than replacing it.

Article 99(1) speaks of penalties and other enforcement measures, which may also include warnings and non-monetary measures. What a business meets first is usually a reasoned request for documentation, a demand for corrective action, a withdrawal or recall under Article 79, or a restriction on making the system available. Those can bite harder than a fine, because the product stops being sold while the amount is still argued over. Austria had not adopted its national penalty rules as of September 2026, which does not suspend the directly applicable duties; our Austria guide has the detail.