Fines under the EU AI Act — Article 99 tiers explained

Tier 1 — prohibited AI practices (Article 5)

Up to EUR 35 000 000 or, if the offender is an undertaking, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher.

Triggered by deploying any practice prohibited under Article 5: subliminal manipulation exploiting vulnerabilities, social-scoring by public authorities, untargeted scraping of facial images, emotion recognition in workplace or education (with narrow medical/safety exceptions), biometric categorisation by sensitive attributes, and most real-time remote biometric identification in public spaces by law enforcement.

Tier 2 — most operator obligations

Up to EUR 15 000 000 or 3% of total worldwide annual turnover, whichever is higher.

Applies to non-compliance with the obligations of providers (Art 16), authorised representatives (Art 22), importers (Art 23), distributors (Art 24), deployers (Art 26), notified bodies (Arts 31, 33(1), 33(3), 33(4), 34) and transparency obligations under Article 50.

Tier 3 — incorrect or misleading information

Up to EUR 7 500 000 or 1% of total worldwide annual turnover, whichever is higher, for the supply of incorrect, incomplete or misleading information to notified bodies or national competent authorities in response to a request.

SME and start-up rule

Where the offender is an SME, including a start-up, each fine is capped at the percentages or amounts in Article 99(3), (4) or (5), whichever is lower. This reverses the default and ensures small operators are not exposed to absolute caps when their turnover-based percentage would yield a smaller fine.

GPAI model providers — Article 101

For providers of general-purpose AI models, the Commission may impose fines up to 3% of total worldwide annual turnover or EUR 15 000 000, whichever is higher, in the cases listed in Article 101(1) (e.g. infringement of Article 53 or 55, failure to comply with a request for information).

How fines are set

• Nature, gravity and duration of the infringement.
• Whether other Member States’ authorities have already imposed fines for the same.
• Size, annual turnover and market share of the operator.
• Aggravating or mitigating factors, including financial benefit gained or losses avoided.
• Degree of cooperation with the national competent authority.
• Whether the operator notified the infringement on its own initiative.
• Whether the operator has implemented technical and organisational measures.

Enforcement timeline

Penalties under Article 99 apply from 2 August 2025. Article 5 prohibitions apply from 2 February 2025. Annex III high-risk obligations and Article 50 transparency obligations apply from 2 August 2026, so deployer-side enforcement for those duties begins on that date. Member States designate the national competent authorities; market surveillance is decentralised, the AI Office at the Commission supervises GPAI providers.

Indirect consequences

• Withdrawal or recall of the AI system from the EU market.
• Public listing on the EU database for high-risk AI systems.
• Procurement exclusion: many public-sector buyers already require AI Act attestations.
• Customer churn driven by enterprise buyers’ supplier-risk reviews.

Related EU guides

• EU AI Act for recruitment AI
• Article 50 transparency from 2 August 2026
• Deployer vs provider
• AI inventory requirements

Sources

• Regulation (EU) 2024/1689, Articles 5, 99, 101, and 113 (entry into application) — EUR-Lex: eur-lex.europa.eu/eli/reg/2024/1689/oj