Map AI Act penalty exposure to the exact infringement tier: banned practices, high-risk operator duties, transparency duties, incorrect information, and GPAI model obligations.
Use Article 99 as the starting point, then separate Member State penalty rules, SME and startup proportionality, Union-body fines, and Commission fines for general-purpose AI model providers.
Structured answer sets in this page tree.
Cited legal and guidance references.
The EU AI Act does not set one flat fine. Article 99 creates three main administrative fine tiers for operators and notified bodies, requires Member States to set penalty and enforcement rules, and tells authorities to consider proportionality, SME and startup viability, cooperation, intent, harm, and mitigation. GPAI model providers also have a separate Commission fine route under Article 101.
Start every penalties review by identifying the relevant AI Act obligation and actor. Article 99 applies to operators and notified bodies, while Article 101 separately addresses providers of general-purpose AI models.
For undertakings, the highest Article 99 tier uses the greater of the fixed euro amount or a percentage of worldwide annual turnover. For SMEs, including startups, Article 99 uses the lower of the fixed amount or turnover percentage for the relevant tier.
The largest Article 99 tier is tied to non-compliance with Article 5 prohibited AI practices. This is not the same as ordinary high-risk AI non-compliance; it covers AI practices the Act prohibits because of unacceptable risk.
Penalty triage should therefore begin with an Article 5 screen before moving to high-risk, transparency, or GPAI duties. If the system, feature, deployment context, or customer use case could fall into Article 5, escalate before launch or continued use.
The EUR 15,000,000 or 3% tier is tied to listed obligations, not every possible AI Act topic. It covers key high-risk value-chain actors and Article 50 transparency duties for certain AI systems.
The EUR 7,500,000 or 1% tier is specifically about supplying incorrect, incomplete, or misleading information to notified bodies or national competent authorities in reply to a request. Do not describe this as a general paperwork fine; the trigger is the requested information response.
Article 99 requires Member States to lay down rules on penalties and other enforcement measures. Those measures may include warnings and non-monetary measures, and Member States must notify the Commission of their rules and later amendments.
Fine decisions are not meant to be mechanical. Article 99 instructs authorities to consider circumstances such as nature, gravity, duration, consequences, affected persons, damage, prior fines for the same activity or omission, operator size, turnover, market share, financial benefit, cooperation, responsibility, notification, intent or negligence, and mitigation.
General-purpose AI model providers should not rely only on the Article 99 operator table. Article 101 gives the Commission power to impose fines on GPAI model providers of up to 3% of annual total worldwide turnover in the preceding financial year or EUR 15,000,000, whichever is higher.
Article 101 covers intentional or negligent infringements, failures to comply with Commission requests for documents or information, incorrect, incomplete, or misleading information, failures to comply with requested measures, and failures to provide model access for evaluations.
Use this checklist when a launch, incident, authority request, supplier change, model update, or customer deployment raises AI Act penalty questions.
The goal is to classify the exposure without overstating enforcement. Record what is known, what is not sourced yet, and which authority route is relevant.
For Union institutions, bodies, offices, and agencies, Article 100 creates a separate administrative-fine route handled by the European Data Protection Supervisor, so public-sector penalty triage should not stop at Article 99.
Under Article 99, non-compliance with Article 5 prohibited AI practices can be fined up to EUR 35,000,000 or, for undertakings, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs and startups, the Article 99 lower-cap rule applies.
Article 99(5) of Regulation (EU) 2024/1689 states EUR 7,500,000 or, for undertakings, up to 1% of total worldwide annual turnover for supplying incorrect, incomplete, or misleading information to notified bodies or national competent authorities in reply to a request.
Yes. Article 99 requires Member States to lay down rules on penalties and other enforcement measures, which may include warnings and non-monetary measures, and to notify the Commission of those rules and later amendments.
Not entirely. GPAI model providers have a separate Article 101 route under which the Commission may impose fines of up to 3% of annual total worldwide turnover or EUR 15,000,000, whichever is higher, for intentional or negligent failures covered by that article.
Sorena can help map AI Act penalty exposure to the relevant article, actor, fine tier, Member State rule, GPAI obligation, and mitigation evidence.
Ask source-linked questions about Article 99, Article 101, prohibited practices, GPAI duties, and penalty evidence using the cited sources on this page.
Review your AI Act fine-tier classification, authority-response workflow, and remediation evidence with Sorena.
"Article 5: Prohibited AI practices"
"Transparency obligations for providers and deployers of certain AI systems"
"general-purpose AI models"
"drawing up and keeping up-to-date model documentation"
"whichever is higher"