Map AI Act penalty exposure to the exact infringement tier: banned practices, high-risk operator duties, transparency duties, incorrect information, and GPAI model obligations.
Use Article 99 as the starting point, then separate Member State penalty rules, SME and startup proportionality, Union-body fines, and Commission fines for general-purpose AI model providers.
Structured answer sets in this page tree.
Cited legal and guidance references.
The EU AI Act has three main maximum fine tiers: EUR 35 million or 7%, EUR 15 million or 3%, and EUR 7.5 million or 1%, with turnover alternatives for undertakings and a lower-cap rule for SMEs and startups. These are maximums, not automatic fines. Member State rules determine national enforcement, Article 100 covers Union bodies, and Article 101 creates a separate Commission route for general-purpose AI model providers.
Start every penalties review by identifying the relevant AI Act obligation and actor. applies to operators and notified bodies, while Article 101 separately addresses providers of general-purpose AI models.
For undertakings, each tier uses the greater of the fixed euro amount or the applicable percentage of total worldwide annual turnover for the preceding financial year. For SMEs, including startups, Article 99 uses the lower of the fixed amount or turnover percentage for the relevant tier.
Chapter XII, including and Article 100, has applied since 2 August 2025, but Article 101 is expressly excluded from that early date and applies from 2 August 2026. A penalty provision being in force does not make an underlying obligation applicable earlier than its own staged date.
The turnover percentages use total worldwide annual turnover for the preceding financial year. Do not substitute EU turnover, revenue for the affected product, or the current partial year. Keep the legal-entity and undertaking analysis used for the calculation, the financial source, the relevant year, and any SME or startup evidence with the exposure record.
The largest tier is tied to non-compliance with Article 5 prohibited AI practices. Ordinary high-risk AI non-compliance falls outside this tier unless the conduct also meets an Article 5 prohibition.
Penalty triage should therefore begin with an Article 5 screen before moving to high-risk, transparency, or GPAI duties. If the system, feature, deployment context, or customer use case could fall into Article 5, escalate before launch or continued use.
Regulation (EU) 2026/1744 adds Article 5 prohibitions for specified non-consensual intimate material and child sexual abuse material. Those additions apply from 2 December 2026. Once applicable, non-compliance falls within the same (3) maximum tier because Article 99(3) covers non-compliance with Article 5.
Under itself, the EUR 15,000,000 or 3% tier covers only the obligations listed in Article 99(4), including duties for key high-risk value-chain actors and Article 50 transparency duties for certain AI systems. For operators under the AI Office's exclusive competence, Article 75c applies that tier to infringement of any applicable AI Act provision, including provisions not listed in Article 99(4).
Under itself, the EUR 7,500,000 or 1% tier is specifically about supplying incorrect, incomplete, or misleading information to notified bodies or national competent authorities in reply to a request. Article 75c applies the same tier to incorrect, incomplete, or misleading information supplied to the AI Office. Do not describe this as a general paperwork fine; the trigger is the requested information response.
requires Member States to lay down rules on penalties and other enforcement measures. Those measures may include warnings and non-monetary measures, and Member States must notify the Commission of their rules and later amendments.
does not set one EU-wide rule for fines on national public authorities and bodies. Each Member State must decide the extent to which those entities may receive administrative fines, and national legal systems may assign fine decisions to competent courts or other bodies.
requires authorities to assess the circumstances of each case, including nature, gravity, duration, consequences, affected persons, damage, prior fines for the same activity or omission, operator size, turnover, market share, financial benefit, cooperation, responsibility, notification, intent or negligence, and mitigation.
General-purpose AI model providers need a separate Article 101 assessment. The Commission may impose fines of up to 3% of annual total worldwide turnover in the preceding financial year or EUR 15,000,000, whichever is higher.
Article 101 covers intentional or negligent infringements, failures to comply with Commission requests for documents or information, incorrect, incomplete, or misleading information, failures to comply with requested measures, and failures to provide model access for evaluations. The Commission must communicate its preliminary findings and give the provider an opportunity to be heard before adopting a fine decision.
Article 101 applies from 2 August 2026. The SME lower-cap formula does not appear in Article 101, so do not import it into a GPAI calculation; Article 101 instead requires proportionality and appropriateness and directs the Commission to consider relevant commitments.
This checklist is relevant when a launch, incident, authority request, supplier change, model update, or customer deployment raises AI Act penalty questions.
The goal is to classify the exposure without overstating enforcement. Record what is known, what is not sourced yet, and which authority route is relevant.
For Union institutions, bodies, offices, and agencies, Article 100 creates a separate route handled by the European Data Protection Supervisor: up to EUR 1,500,000 for Article 5 prohibited practices and up to EUR 750,000 for other requirements or obligations. These caps do not answer whether a national public authority may be fined; that question remains subject to the relevant Member State's rules.
Administrative fines do not replace other consequences. allows warnings and non-monetary measures under Member State rules, and the Act's market-surveillance provisions can require correction, restriction, withdrawal, recall, or disabling. Contractual claims, liability, employment consequences, data-protection enforcement, and sector-specific remedies arise under their own legal bases and are outside the Article 99 tier calculation.
Under , non-compliance with Article 5 prohibited AI practices can be fined up to EUR 35,000,000 or, for undertakings, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs and startups, the Article 99 lower-cap rule applies.
(5) of Regulation (EU) 2024/1689 states EUR 7,500,000 or, for undertakings, up to 1% of total worldwide annual turnover for supplying incorrect, incomplete, or misleading information to notified bodies or national competent authorities in reply to a request.
Yes. requires Member States to lay down rules on penalties and other enforcement measures, which may include warnings and non-monetary measures, and to notify the Commission of those rules and later amendments.
No. From 2 August 2026, GPAI model providers have a separate Article 101 route under which the Commission may impose fines of up to 3% of annual total worldwide turnover for the preceding financial year or EUR 15,000,000, whichever is higher, for intentional or negligent failures covered by that article. Article 101 does not repeat 's SME lower-cap formula.
Article 100 allows the European Data Protection Supervisor to fine Union institutions, bodies, offices, and agencies up to EUR 1,500,000 for non-compliance with Article 5 prohibited practices and up to EUR 750,000 for other AI Act requirements or obligations. National public authorities are different: each Member State sets the extent to which administrative fines may apply to public authorities and bodies established in that Member State.
Sorena can help map AI Act penalty exposure to the relevant article, actor, fine tier, Member State rule, GPAI obligation, and mitigation evidence.
Ask questions tied to cited sources about Article 99, Article 101, prohibited practices, GPAI duties, and penalty evidence using the cited sources on this page.
Review your AI Act fine-tier classification, authority-response workflow, and remediation evidence with Sorena.
"Article 5: Prohibited AI practices"
"Transparency obligations for providers and deployers of certain AI systems"
"general-purpose AI models"
"drawing up and keeping up-to-date model documentation"
"whichever is higher"
"Fines for providers of general-purpose AI models"