EU AI Act Fines and Penalties: How Much Can Your Company Actually Be Fined
The headline "€35 million" number gets quoted a lot without the detail that actually matters: which violation triggers which tier, and how the SME threshold rule changes the math for a small company.
- Fines are tiered by violation type, not a single flat number.
- Prohibited AI practice violations (Article 5): up to €35 million or 7% of worldwide annual turnover, whichever is higher.
- Most other obligations (including Article 50 transparency, high-risk requirements): up to €15 million or 3% of worldwide annual turnover.
- Supplying incorrect, incomplete, or misleading information to authorities: up to €7.5 million or 1% of worldwide annual turnover.
- Article 99(6): for SMEs and start-ups, each of these caps uses whichever of the two amounts is LOWER, not higher.
- Enforced by national market surveillance authorities designated by each EU member state, not a single central EU regulator.
The fine structure has three tiers, not one number
Article 99 of Regulation (EU) 2024/1689 sets three separate penalty ceilings depending on what was violated, not one blanket fine. Quoting a single number without saying which tier it belongs to is the single most common inaccuracy in AI Act coverage.
- Tier 1, prohibited practices (Article 5, e.g. social scoring, real-time remote biometric identification in public spaces for law enforcement outside narrow exceptions, manipulative AI): up to €35 million or 7% of worldwide annual turnover, whichever is higher.
- Tier 2, most other substantive obligations (high-risk system requirements, and general obligations including Article 50 transparency): up to €15 million or 3% of worldwide annual turnover, whichever is higher.
- Tier 3, supplying incorrect, incomplete, or misleading information to notified bodies or national authorities: up to €7.5 million or 1% of worldwide annual turnover, whichever is higher.
The SME rule that flips "whichever is higher" to "whichever is lower"
For large companies, each tier uses whichever of the two figures (the flat euro amount or the turnover percentage) is higher, which is what makes the fines scale with company size. Article 99(6) creates a specific carve-out for SMEs and start-ups: for them, each cap uses whichever of the two figures is LOWER. In practice, this means a small company’s maximum exposure is capped by its own turnover percentage rather than the flat multi-million euro ceiling designed for large enterprises, so long as that percentage produces a lower number.
This does not mean SMEs are exempt: it means the ceiling is proportionate to their size instead of being a flat number sized for a multinational. A small business with meaningful revenue can still face a genuinely painful fine under the percentage calculation.
Who actually enforces this
There is no single "EU AI Act police." Enforcement runs through national market surveillance authorities, one or more per member state, which each country was required to designate. This means practical enforcement intensity varies by country and is still ramping up as authorities build capacity, but the legal exposure itself is uniform across the EU under the Regulation.
What this means in practice for a small company
Two things follow from the structure above. First, an Article 50 violation (the obligation most SMEs are actually exposed to right now) sits in Tier 2, not Tier 1: it is not the "€35 million" number that gets quoted most often, that figure is for prohibited practices, a much narrower and more severe category. Second, because Article 99(6) uses the lower of the two figures for SMEs, the real driver of exposure for a small company is usually its own turnover percentage, not a fixed millions-of-euros number.
Either way, the fine is not the main reason to act. A national authority investigation, a client due-diligence questionnaire, or a procurement requirement asking "show us your AI Act compliance evidence" arrives long before any fine does, and having nothing to show at that point is its own cost, in lost deals or delayed contracts, independent of whether a fine is ever issued.
Questions
Can a company be fined multiple times for multiple AI systems?
The Regulation sets ceilings per infringement; a company running several non-compliant systems, or repeated infringements, can face separate assessments per violation, up to the applicable ceiling for each. This is a question for qualified legal counsel in any live enforcement situation, not something to estimate from a general guide.
Has anyone actually been fined under the EU AI Act yet?
Enforcement powers for most obligations became active only from 2 August 2026, and national authorities were still building capacity through the year. Check current enforcement records with your national market surveillance authority or qualified counsel rather than assuming either a track record or a grace period.
Want this tracked automatically, not read about?
The EU AI Act Governance Cockpit is a Notion + n8n workspace that logs your AI systems, runs this exact risk classification, tracks the required actions, and keeps the evidence. One-time payment from €49.