EU AI Act (Regulation (EU) 2024/1689) Penalties and fines

Article 99 creates three main operator fine levels. The highest tier is reserved for prohibited practices under Article 5. The middle tier applies to listed operator and notified body duties, including provider, authorised representative, importer, distributor, deployer, notified body, and Article 50 transparency obligations. The lower tier applies to incorrect, incomplete, or misleading information supplied to notified bodies or national competent authorities.

The Act also says Member States must make penalties effective, proportionate, and dissuasive, while taking account of the interests and economic viability of SMEs, including start ups.

The GPAI regime has a separate Commission fine power. Under Article 101, the Commission may impose fines on providers of general purpose AI models up to EUR 15,000,000 or 3 percent of annual worldwide turnover when the provider intentionally or negligently breaches the relevant obligations.

This matters because GPAI providers answer directly to the Commission and the AI Office for Chapter V matters, not only to national enforcement channels.

Article 99 says authorities should consider all relevant circumstances of the case. The Act specifically points to the nature, gravity, duration, and consequences of the infringement, the number of affected persons, prior fines, the size and market position of the operator, cooperation, and the technical and organizational measures that were implemented.

That means evidence quality is not cosmetic. A weak paper trail can make an otherwise contained issue look reckless or unmanaged.

The best penalty reduction strategy is not a last minute legal memo. It is an operating record that shows the organization actually assessed the system, assigned the right role, implemented relevant controls, monitored outcomes, and acted quickly when issues appeared.

This is especially important for transparency duties and high risk system operations, where it is easy for authorities to compare what the organization claimed with what the product actually did.