EU AI Act Fines and Penalties - The Three Tiers

Drew & AI Comply HQ™ Team · June 4, 2026

EU AI Act fines come in three tiers under Article 99: up to 35 million euros or 7 percent of worldwide annual turnover (whichever is higher) for prohibited practices, up to 15 million euros or 3 percent for breaking most other obligations, and up to 7.5 million euros or 1 percent for feeding authorities incorrect, incomplete, or misleading information. Here is what lands you in each bucket.

The penalty table

Tier	Ceiling	What triggers it
1	35M euros or 7% of turnover	Article 5 prohibited practices: social scoring, manipulative techniques, untargeted facial-image scraping
2	15M euros or 3%	Non-compliance with the operational obligations: the high-risk duties (Articles 9 to 15, 16, 26), Article 50 transparency, and related requirements
3	7.5M euros or 1%	Incorrect, incomplete, or misleading information to notified bodies or authorities

For SMEs and startups the same tiers apply, but capped at whichever of the two amounts is lower. Since July 27, 2026, small mid-cap companies (SMCs) get that lower cap too, for tiers 2 and 3 (Article 99(6a)). Member states set the procedures and can add penalties of their own. The Commission fines providers of general-purpose AI models separately, under Article 101.

The detail people miss

Tier 3 is the quiet one. You can do the engineering work and still get fined for the paperwork around it, because answering a regulator's request sloppily is its own violation. That is a strong argument for keeping classification reasoning, documentation, and an audit trail in one place rather than across inboxes. It is also why every document AI Comply HQ generates is versioned and timestamped.

When is this enforceable?

The penalty rules have applied since August 2, 2025. Each duty becomes finable once it applies. Breaking the original bans or the Article 50 transparency duties can be fined now. So can breaking general-purpose AI model duties. The Commission's power to fine those providers started on August 2, 2026 (Article 101).

Two new Article 5 bans follow on December 2, 2026. They cover AI that makes intimate images of real people without consent, and AI that makes child sexual abuse material. High-risk duties come last. Annex III systems follow on December 2, 2027. AI in products like medical devices and toys (Annex I, Section A) follows on August 2, 2028. The Digital Omnibus on AI (Regulation (EU) 2026/1744) set these later dates in July 2026. Machinery, vehicles, and other Section B products get their AI rules through their own EU laws (Article 2(2)).

What should you do about it?

Two things this quarter. Classify every system, because tier determines exposure. Then close the gap on whichever obligation list applies. The compliance checklist walks the triage, and the free risk check does the first step for you.

FAQ

Are fines the only risk?

No. Market-surveillance authorities can order systems withdrawn or recalled, which for a software business can hurt more than the fine.

Find your exposure in 3 minutes

Sources

This page is informational content, not legal advice. Talk to a qualified lawyer about your specific situation.