The EU AI Act sets three tiers of financial penalty under Article 99, ranging up to €35 million or 7% of worldwide annual turnover, whichever is higher — with lower caps for SMEs and start-ups. Which tier applies depends on which obligation was breached, not the size of the company.
The three penalty tiers
€35 million or 7%
of worldwide annual turnover, whichever is higher
Using a prohibited AI practice under Article 5 (e.g. manipulative or exploitative AI, social scoring, certain biometric categorisation).
Art. 99(3)
€15 million or 3%
of worldwide annual turnover, whichever is higher
Breaching other operator obligations — including Article 50's transparency duties (disclosing AI interaction) and Annex III high-risk system requirements.
Art. 99(4)
€7.5 million or 1%
of worldwide annual turnover, whichever is higher
Supplying incorrect, incomplete, or misleading information to notified bodies or national authorities.
Art. 99(5)
Source: Regulation (EU) 2024/1689 on EUR-Lex. For SMEs and start-ups, each fine is capped at the lower of the two amounts (Art. 99(6)).
What actually triggers a fine
The highest tier (€35M / 7%) is reserved for Article 5's prohibited practices — things like manipulative AI that exploits vulnerabilities, or certain forms of biometric categorisation and social scoring. Most businesses using ordinary AI tools (chat assistants, CV screening, marketing content generation) are far more likely to encounter the second tier: breaching Article 50's transparency duty by not disclosing that a chatbot is AI, or failing to meet Annex III's requirements for a high-risk system like a hiring tool.
The practical takeaway: knowing which of your AI tools falls into which risk category — the job an AI inventory does — is what determines which penalty tier you're actually exposed to, not a general sense that "AI regulation exists."
Frequently asked questions
Are the fine amounts different for small businesses?
Yes. Under Article 99(6), for SMEs and start-ups, each fine is capped at whichever of the two amounts (the fixed euro figure or the turnover percentage) is lower — rather than the higher amount that applies to larger companies. It doesn't exempt SMEs from the Act, but it changes the ceiling.
Has anyone actually been fined under the EU AI Act yet?
The Act's obligations phase in on a staggered timeline — prohibited practices under Article 5 applied first, with other obligations including Article 50 following in 2026 and Annex III high-risk requirements later still. Check the regulation's own text on EUR-Lex for the exact dates that apply to a specific obligation, since enforcement follows those effective dates.
Does the fine apply per violation or per company?
The percentages are based on the undertaking's total worldwide annual turnover for the preceding financial year, not a per-incident calculation — meaning a single violation can still expose the full percentage of global revenue, not just revenue tied to the violation.
Can I be fined if my company isn't based in the EU?
Yes, if your AI system's output is used in the EU. The Act applies to providers and deployers established outside the Union where the AI system's output is used within it — where your company is incorporated doesn't determine whether the obligations apply.
Find out which tier applies to you
DiscloseAI's free assessment scores each of your AI tools against the EU AI Act's actual requirements, so you know which obligations — and which penalty tier — apply before a regulator asks. Free EU AI Act check →