EU AI Act penalty structure
The EU AI Act fines structure has four bands. Tier 1 — Article 5 prohibited-practice violations — carries the headline €35M or 7% of global turnover. High-risk system operator and conformity failures sit at €15M or 3%. Incorrect or misleading information to authorities is a separate €7.5M or 1% tier. General-purpose AI provider fines are imposed by the Commission directly, not by Member State authorities.
Tier 1 — highest
Article 99(3)Up to €35M or 7% of global annual turnover
Applies to: Non-compliance with the prohibited AI practices in Article 5.
Reserved for Article 5 violations only. The eight prohibited practices are absolute — no consent, opt-out, or post-hoc mitigation rescues a system once it meets a prohibition's criteria. Imposed by Member State market-surveillance authorities.
Tier 2 — operator and conformity
Article 99(4)Up to €15M or 3% of global annual turnover
Applies to: Non-compliance with provisions related to operators (provider, importer, distributor, deployer) or notified bodies, other than Article 5 and the GPAI Articles 50, 53, 54, 55.
Covers high-risk system obligations under Articles 8–15 (risk management, data governance, technical documentation, accuracy), provider/deployer duties under Articles 16–27, and notified-body conformity assessment failures.
Tier 3 — incorrect or misleading information
Article 99(5)Up to €7.5M or 1% of global annual turnover
Applies to: Supply of incorrect, incomplete or misleading information to notified bodies and national competent authorities in reply to a request.
A separate, lower tier from substantive non-compliance — applies even where the underlying system would not itself trigger a higher tier.
Tier 4 — GPAI (Commission-imposed)
Article 101(1)Up to €15M or 3% of global annual turnover
Applies to: General-purpose AI model providers — for failure to comply with relevant Article 53 obligations (technical documentation, copyright policy, training-data summary) or Article 55 obligations for systemic-risk GPAI.
Distinct enforcement chain from Article 99. GPAI fines are imposed by the European Commission directly (not by Member State authorities), via the AI Office. Procedure: Article 101(2)–(8).
SME and start-up proportionality
For SMEs, including start-ups, each fine in Article 99(3), (4), and (5) shall be up to the percentages or amount referred to therein, whichever thereof is **lower**.
Larger of the two amounts applies for established firms; SMEs and start-ups face whichever is lower of (a) the percentage of their turnover or (b) the absolute euro cap. This is meant to keep penalty exposure proportionate to firm size.
Factors that set the actual fine amount
Per Article 99(7), Member State authorities consider factors including the following when setting the fine within each tier's ceiling (the Article enumerates around ten lettered factors; the highlights below are the most operationally salient):
- Nature, gravity, and duration of the infringement
- Whether other authorities have already imposed administrative fines on the same operator for the same infringement
- Size, annual turnover, and market share of the operator committing the infringement
- Any other aggravating or mitigating factor applicable to the circumstances of the case
- Degree of cooperation with the national competent authorities
- Degree of responsibility of the operator, taking into account technical and organisational measures implemented
Tier-by-tier compliance
When the penalty math becomes a board conversation
Tools surface exposure. Programmes manage it.
A 7% turnover penalty is a number a CFO sees before any technical detail lands. The defensive posture — board narrative, regulator dialogue, programme design — is the surface AskAjay covers, the advisory arm of AI Exponent LLC.
Explore advisory at AskAjay.ai →