We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Penalties GuideEU AI Act

EU AI Act penalties and fines

AI Act fines can reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices.

Other tiers cover specified operator duties, misleading authority responses and GPAI model providers. The amount depends on the infringement and entity.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 21, 2026
6 sections8 primary sources
Overview

Start with the breached duty and the responsible legal actor. sets three main fine tiers; Articles 100 and 101 cover EU bodies and GPAI model providers separately. These are maximum fines. Authorities assess the circumstances, and special lower-cap rules apply to qualifying smaller organisations.

Section 1

The three main fine tiers

sets maximum administrative fines. Chapter XII began to apply on 2 August 2025, except Article 101, which began on 2 August 2026. Each underlying duty still follows its own application date.

Use total worldwide annual turnover from the preceding financial year. Keep the financial source, year, legal-entity and undertaking analysis, and evidence of any smaller-organisation status used in the calculation.

SMEs are small and medium-sized enterprises; the SME rule also covers startups. Small mid-cap enterprises (SMCs) have a narrower lower-cap rule, limited to the second and third tiers below.

  • Article 5 prohibited practices: up to EUR 35,000,000 or up to 7% of total worldwide annual turnover, whichever is higher for undertakings.
  • Specified operator and notified-body obligations, including provider, authorised representative, importer, distributor, deployer, notified-body, and Article 50 transparency duties: up to EUR 15,000,000 or up to 3% of worldwide annual turnover, whichever is higher for undertakings.
  • Supplying incorrect, incomplete, or misleading information to notified bodies or national competent authorities in response to a request: up to EUR 7,500,000 or up to 1% of worldwide annual turnover, whichever is higher for undertakings.
  • For SMEs and startups, the relevant fine is capped at the lower of the fixed euro amount or the turnover percentage.
  • For SMCs, use the lower of EUR 15,000,000 or 3% for (4), and EUR 7,500,000 or 1% for Article 99(5). Keep the SMC qualification evidence; the SME and SMC rules cover different tiers.
Section 2

Prohibited practices carry the highest maximum

Non-compliance with Article 5 can trigger the EUR 35 million or 7% tier. Screen the feature and its actual deployment before launch or continued use if a prohibited practice may apply.

Ordinary high-risk non-compliance falls under other provisions unless the conduct also breaches Article 5. Check the exact prohibition, its harm threshold and any exception rather than treating every risky use as prohibited.

The new Article 5 prohibitions for specified non-consensual intimate material and child sexual abuse material apply from 2 December 2026. Once applicable, they carry the (3) maximum because that tier covers Article 5 non-compliance.

  • Screen for manipulative or deceptive techniques that materially distort behaviour and cause or are reasonably likely to cause significant harm.
  • Screen for exploitation of age, disability, or social or economic vulnerability that materially distorts behaviour and causes or is reasonably likely to cause significant harm.
  • Screen for social scoring, certain criminal-offence risk prediction based solely on profiling or personality traits, untargeted facial-image scraping, workplace or education emotion inference, and sensitive biometric categorisation.
  • Treat real-time remote biometric identification by law enforcement in publicly accessible spaces as a specialised Article 5 issue with strict conditions, safeguards, and national-law dependencies.
  • From 2 December 2026, screen provider-side intended or reasonably foreseeable and reproducible generation of the specified prohibited material, the adequacy of technical safeguards, and deployer use for the prohibited purpose.
Section 3

Other duties and misleading responses

(4) lists the duties subject to the EUR 15 million or 3% tier. They include specified operator and notified-body obligations and Article 50 transparency duties. For operators under the AI Office's exclusive supervision, Article 75c extends that tier to any applicable AI Act provision.

The EUR 7.5 million or 1% tier applies to incorrect, incomplete or misleading information supplied to notified bodies or national competent authorities in response to a request. Article 75c applies it to such information supplied to the AI Office. Keep the request, response, approvals and corrections.

  • Provider duties under Article 16 belong in the 15 million euro or 3% tier when applies.
  • Authorised representative, importer, distributor, deployer, and specified notified-body duties also sit in the 15 million euro or 3% tier.
  • Amended (4)(da) also includes the Article 25(2) and (4) duties on cooperation with a new provider and written agreements with third-party suppliers.
  • Article 50 transparency duties for providers and deployers are expressly included in the 15 million euro or 3% tier.
  • Authority-response workflows should preserve the request, legal basis, supplied information, reviewer approvals, and correction history because incorrect, incomplete, or misleading responses have their own tier.
Section 4

How authorities decide the penalty

Member States set penalty and enforcement rules. These can include warnings and non-monetary measures. They must notify the Commission of those rules and later changes.

Check national rules for the decision-maker and for fines on national public authorities. leaves the extent of those public-authority fines to each Member State; courts or other bodies may decide fines under national systems.

Authorities must consider the case: the breach's nature, gravity, duration and consequences; affected people and harm; prior fines for the same conduct; organisation size, turnover and market share; benefit gained; cooperation; responsibility; notification; intent or negligence; and mitigation.

  • Check the applicable Member State rules before stating who imposes a fine or whether public authorities can be fined.
  • Distinguish national public authorities from Union institutions, bodies, offices, and agencies; Article 100 gives the European Data Protection Supervisor the Union-body route.
  • Record whether the issue affects one Member State, several Member States, or EU-level GPAI supervision.
  • Keep mitigation evidence close to the infringement record: containment steps, affected-person remediation, authority cooperation, corrective actions, and governance changes.
  • Avoid unsupported claims that a specific national authority will fine a company unless the relevant Member State rule or authority action is actually sourced.
Section 5

GPAI providers have a separate fine provision

Article 101 allows the Commission to fine GPAI model providers up to EUR 15 million or 3% of annual total worldwide turnover in the preceding financial year, whichever is higher.

It covers intentional or negligent infringements, failure to comply with document or information requests, incorrect or misleading responses, failure to take requested measures, and failure to give model access for evaluations. The Commission must communicate preliminary findings and allow the provider to be heard before deciding a fine.

Article 101 applies from 2 August 2026. It requires proportionate and appropriate fines and consideration of relevant commitments. It does not repeat 's SME lower-cap formula.

  • Separate AI system operator duties from GPAI model provider duties in the enforcement register.
  • For GPAI documentation, track Article 53 technical documentation, downstream-provider information, copyright policy, and public training-content summary obligations.
  • For GPAI models with systemic risk, track Article 55 risk assessment, mitigation, serious-incident, cybersecurity, and reporting obligations separately from ordinary GPAI documentation duties.
  • Preserve Commission and AI Office requests, response deadlines, supplied documents, access decisions, and model-evaluation correspondence because Article 101 directly covers failures around these requests.
Section 6

Check exposure and preserve mitigation evidence

Recheck exposure after an incident, authority request, release, supplier change, model update or changed deployment. Record the duty, actor, applicable date, authority and maximum tier. Mark unresolved facts for review.

EU institutions, bodies, offices and agencies fall under Article 100. The European Data Protection Supervisor can impose up to EUR 1.5 million for Article 5 breaches and EUR 750,000 for other requirements or obligations. National public authorities follow their Member State's rules.

Keep records of containment, remediation and cooperation. Enforcement can also require correction, restriction, withdrawal, recall or disabling. Contractual claims, liability, employment measures, data-protection enforcement and sector remedies follow their own legal bases.

What is the highest fine for prohibited practices?

allows up to EUR 35 million or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher for undertakings. Qualifying SMEs and startups use the lower-cap rule.

Is the misleading-information tier 1% or 1.5%?

(5) uses EUR 7.5 million or, for undertakings, 1% of total worldwide annual turnover. It covers incorrect, incomplete or misleading information given to a notified body or national competent authority in response to a request. The applicable entity and lower-cap rules still need checking.

Do Member States set penalty rules?

Yes. requires national rules on penalties and enforcement measures, which can include warnings and non-monetary measures. Member States must notify the Commission of those rules and changes.

Which fine rule applies to GPAI model providers?

Article 101 applies from 2 August 2026. The Commission can impose up to EUR 15 million or 3% of the preceding financial year's worldwide turnover, whichever is higher, for covered intentional or negligent failures. Article 101 does not repeat the SME lower-cap formula.

What are the fine caps for EU bodies?

Under Article 100, the European Data Protection Supervisor can impose up to EUR 1.5 million for Article 5 breaches and EUR 750,000 for other AI Act requirements or obligations. National public authorities follow each Member State's rules.

  • Identify the actor: provider, deployer, product manufacturer, authorised representative, importer, distributor, notified body, public authority, Union body, or GPAI model provider.
  • Classify the trigger: Article 5 prohibited practice, (4) listed obligation, Article 99(5) authority-response information issue, Article 75c AI Office-supervised operator issue, Article 100 Union-body issue, or Article 101 GPAI model provider issue.
  • Calculate only the sourced maximum tier and label it as a maximum, not an expected fine.
  • Apply the SME/startup lower-cap rule where the entity qualifies. For an SMC, apply the lower-cap rule only to (4) and (5). Keep the qualification evidence and the provision used for the calculation.
  • Collect proportionality evidence: harm, number of affected persons, duration, intent or negligence, cooperation, mitigation, prior authority actions, turnover, market share, and benefit gained or loss avoided.
  • Check Member State penalty rules before naming a national authority, public-sector fine exposure, court route, warning route, or non-monetary measure.
Next step

Identify the duty and applicable maximum

Sorena can help identify the actor, breached duty, fine tier, authority and mitigation evidence.

Research workflow
Ask Research Copilot

Ask about Article 99, GPAI fines or authority-response duties using the cited sources.

Explore next step
Talk to Sorena
Discuss your implementation

Review a fine-tier calculation, response process or corrective-action plan.

Explore next step
Primary sources

References and citations

Regulation (EU) 2024/1689 (EU AI Act)
eur-lex.europa.eu6 citations
Referenced sections
  • Primary legal text for Article 99 penalties, Article 5 prohibited practices, Article 50 transparency duties, Article 53 and 55 GPAI obligations, Article 100 Union-body fines, and Article 101 GPAI model provider fines.
  • Article 99 sets the three administrative fine tiers, the SME and startup lower-cap rule, and the proportionality factors for penalty decisions.
  • Article 5 lists the prohibited AI practices that trigger Article 99's highest administrative fine tier.
Show 3 more
  • Article 99(4) lists the operator and notified-body provisions in the 15 million euro or 3% tier; Article 99(5) sets the incorrect-information tier.
  • Article 99 requires Member States to set penalty rules and lists the circumstances authorities should consider when deciding whether and how much to fine.
  • Articles 53, 55, 88 to 93, and 101 ground GPAI model provider obligations, Commission supervision powers, and GPAI fine exposure.
"The penalties provided for shall be effective, proportionate and dissuasive."
More quoted passages
"The following AI practices shall be prohibited"
"incorrect, incomplete or misleading information"
"all relevant circumstances of the specific situation"
"Fines for providers of general-purpose AI models"
AI Act Service Desk - Article 5 prohibited AI practices
ai-act-service-desk.ec.europa.eu2 citations
Referenced sections
  • Official article page used to support prohibited-practice screening before applying Article 99's highest penalty tier.
  • Official AI Act Service Desk article page for checking the Article 5 prohibited-practice text.
"Article 5: Prohibited AI practices"
AI Act Service Desk - Article 50 transparency obligations
ai-act-service-desk.ec.europa.eu2 citations
Referenced sections
  • Official article page for transparency obligations that Article 99 includes in the 15 million euro or 3% penalty tier.
  • Official AI Act Service Desk source URL for Article 50, which Article 99 includes in the 15 million euro or 3% penalty tier.
"Transparency obligations for providers and deployers of certain AI systems"
European Commission - GPAI provider guidelines
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission guidance page for GPAI model provider scope and obligations relevant to separate Article 101 fine exposure.
  • Commission guidance page for the scope of GPAI model provider obligations under the AI Act.
"general-purpose AI models"
GPAI Code of Practice - Transparency chapter
ec.europa.eu2 citations
Referenced sections
  • Official Code of Practice transparency chapter used for GPAI documentation and downstream-provider information evidence expectations.
  • Code of Practice transparency chapter describing model documentation and downstream-provider information commitments for GPAI providers using the Code.
"model documentation"
More quoted passages
"drawing up and keeping up-to-date model documentation"
Regulation (EU) 2024/1689 - Articles 79, 99, 100, and 101
eur-lex.europa.eu
Referenced sections
  • Primary source for market-surveillance corrective measures, Article 99 penalties, Article 100 Union-body fines, Article 101 GPAI model provider fines, and SME lower-cap treatment.
"whichever is higher"
Regulation (EU) 2026/1744 - amended Article 5
eur-lex.europa.eu
Referenced sections
  • Supports the added content-related prohibitions and their 2 December 2026 application date; Article 99(3) supplies the maximum fine tier for Article 5 non-compliance.
Regulation (EU) 2026/1744 - Digital Omnibus on AI
eur-lex.europa.eu
Referenced sections
  • Binding amendment used for the added Article 5 content prohibitions, their 2 December 2026 application date, and the Article 75c penalty route for operators under the AI Office's exclusive competence.

Related guides

Common questions, clear answers | EU AI Act

Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.

EU AI Act deadlines and compliance calendar

Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.

EU AI Act fundamental rights impact assessments

Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.

EU AI Act GPAI model evidence checklist

Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.

EU AI Act monitoring and serious incidents

Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.

EU AI Act serious incident reporting steps

Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.

Show all related guides (34)

EU AI Act timeline and phased deadlines

See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.

EU AI Act vs ISO/IEC 42001

Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.

EU AI Act vs NIST AI RMF

Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.

EU AI Act: Check whether the Act applies

Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.

EU AI Act: Choose a high-risk assessment route

Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.

EU AI Act: Classify a tool before approval

Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.

EU AI Act: Compliance checklist

Check each AI tool, decide which duties apply, and give every action an owner and evidence link.

EU AI Act: Conformity assessment

Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.

EU AI Act: Does it apply to you?

Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.

EU AI Act: Duties for general-purpose AI models

Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.

EU AI Act: High-risk requirements

High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.

EU AI Act: High-risk system checklist

Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.

EU AI Act: Is your use case high-risk?

Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.

EU AI Act: Plan your compliance work

Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.

EU AI Act: Standards and quality management

Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.

EU AI Act: Technical file and evidence templates

Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.

EU AI Act: When must you disclose AI?

Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.

EU AI Act: Which AI uses are banned?

Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.

Are you the provider or the deployer? | EU AI Act

Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.

Do you need a notified body? | EU AI Act

Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.

Does this tool count as AI? | EU AI Act

Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.

How do you monitor AI after release? | EU AI Act

Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.

Is this industry use high-risk? | EU AI Act

See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.

What belongs in the technical file? | EU AI Act

See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.

What must general-purpose model providers do? | EU AI Act

Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.

When must you disclose AI use? | EU AI Act

Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.

When must you report a serious incident? | EU AI Act

Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.

Who needs a rights impact assessment? | EU AI Act

Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.