Penalties: three tiers, and the one everyone quotes wrong
€35M or 7% is real, and it applies to Article 5 prohibited practices. It does not apply to high-risk non-compliance, and it does not apply to a transparency breach. Those sit at €15M or 3%. Getting this right matters, because the wrong figure in a board paper turns a proportionate programme into a panic.
The tiers
| Basis | What it covers | Maximum | Enforced by |
|---|---|---|---|
| Art. 99(3) | Non-compliance with the Article 5 prohibitions | €35M or 7% of total worldwide annual turnover | National MSA |
| Art. 99(4) | Non-compliance with obligations on providers, deployers, importers, distributors, authorised representatives or notified bodies, other than Article 5: this includes the Chapter III high-risk requirements and Article 50 transparency | €15M or 3% | National MSA |
| Art. 99(5) | Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities | €7.5M or 1% | National MSA |
| Art. 101 | GPAI model provider obligations | €15M or 3% | Commission / AI Office |
Each cap is the higher of the fixed amount and the percentage, except for SMEs including start-ups, where the lower applies.
The error to stop repeating
“High-risk non-compliance carries €35M or 7%” is wrong. So is applying that figure to an Article 50 chatbot disclosure failure. Both are Article 99(4) at €15M or 3%. If a vendor deck, a board paper or a consultant’s slide says otherwise, that is a useful signal about the rest of the document.
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
Penalty calculator
Indicative maximum exposure by violation type and turnover. Actual penalties depend on severity, intent, duration, cooperation and the factors in Article 99(7).
—
SME and small mid-cap relief
Beyond the lower-of rule, Regulation (EU) 2026/1744 introduced further relief for SMEs and small mid-caps, reported to include reduced fine caps, simplified technical documentation, proportionate quality management requirements and priority sandbox access.
Verify before relying on this. The detail of the relief and the definitions of the entities eligible for it sit in the consolidated text. If you intend to plan around reduced obligations, read Article 99 and the relevant Omnibus amendments directly rather than a summary, including this one.
Who enforces what
- National market surveillance authorities enforce most of the Regulation. Their powers took effect on 2 August 2026.
- The Commission’s AI Office enforces the GPAI model obligations, and following Reg. (EU) 2026/1744 has exclusive supervisory competence over AI systems built on a GPAI model developed by the same provider or group, and over AI systems integrated into VLOPs and VLOSEs designated under the Digital Services Act. GPAI & the AI Office →
- Article 85 gives any natural or legal person the right to lodge a complaint with a market surveillance authority. Enforcement will not only be regulator-initiated.
Status labels on this page
Verified fact: The Art. 99(3), 99(4), 99(5) and Art. 101 ceilings, the higher-of rule and the SME lower-of rule, and the enforcement split.
Expert analysis: The observation that misquoted penalty tiers are a signal about document quality, and the calculator's treatment of SME cases.
Unsettled: The precise content of the SME and small mid-cap relief introduced by Reg. (EU) 2026/1744, which should be read in the consolidated text.
Exposure is a function of classification
The tier you are exposed to is decided by what your system is, not by how large the number in a headline is. Classification first, then the exposure calculation means something.
Not sure where you sit?
The classifier maps your system against Articles 5, 6, 50 and Annex III. Twelve questions, no email.
Frequently asked
What are the EU AI Act fines?
Article 99 sets three tiers for national enforcement. Breach of the Article 5 prohibitions: up to 35 million euro or 7 percent of total worldwide annual turnover for the preceding financial year, whichever is higher. Breach of other obligations on providers, deployers, importers, distributors, authorised representatives or notified bodies, including the high-risk requirements and the Article 50 transparency obligations: up to 15 million euro or 3 percent.
Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities: up to 7.5 million euro or 1 percent. Article 101 separately covers general-purpose AI model providers at up to 15 million euro or 3 percent, enforced by the Commission.
Is the EU AI Act fine 35 million or 7 percent?
Whichever is higher, and only for breaches of the Article 5 prohibitions. Applying the 35 million euro or 7 percent figure to a high-risk or transparency breach is the single most common error in AI Act commentary. Those fall under Article 99(4) at up to 15 million euro or 3 percent.
Do SMEs pay lower EU AI Act fines?
Yes. For SMEs including start-ups, each cap is the lower of the fixed amount and the percentage rather than the higher. Regulation (EU) 2026/1744 also introduced further relief for SMEs and small mid-caps, reported to include reduced fine caps alongside simplified technical documentation and proportionate quality management requirements. Confirm the current position against the consolidated text.
Who enforces the EU AI Act?
National market surveillance authorities designated by each member state enforce most of the Regulation, and their powers took effect on 2 August 2026. The Commission's AI Office enforces the general-purpose AI model obligations. Regulation (EU) 2026/1744 gave the AI Office exclusive supervisory competence over AI systems based on a general-purpose AI model developed by the same provider or group, and over AI systems integrated into very large online platforms and search engines designated under the Digital Services Act.
Obligations, article by article
- Art. 5 prohibitions
- Art. 4 AI literacy
- Art. 50 transparency
- Art. 9 risk management
- Art. 10 data governance
- Art. 11 / Annex IV
- Arts. 12–13 logging
- Art. 14 human oversight
- Art. 15 accuracy & security
- Art. 17 QMS
- Arts. 43–48 conformity
- Art. 49 registration
- Art. 57 sandboxes
- Open source
- Art. 72 monitoring
- Art. 73 incidents
- Arts. 51–56 GPAI
- Compliance checklist
- FRIA template (Art. 27)
- When Annex III does not apply →