EU AI Act Penalties and Fines

Article 99 requires Member States to establish penalty and enforcement rules for infringements by operators. They may include administrative fines, warnings and non-monetary measures. Penalties must be effective, proportionate and dissuasive; when imposing them, national authorities must take account of the interests and economic viability of SMEs, including startups, and small mid-cap enterprises (SMCs). The regulation sets maximum tiers. Non-compliance with Article 5 prohibited practices can draw up to EUR 35 million or, for an undertaking, 7% of preceding-year total worldwide annual turnover, whichever is higher. For listed operator and notified-body duties outside Article 5—including specified provider, deployer, representative, importer, distributor and Article 50 transparency obligations—the ceiling is EUR 15 million or 3%, whichever is higher. Incorrect, incomplete or misleading information supplied to a notified body or national competent authority in response to a request has a ceiling of EUR 7.5 million or 1%, whichever is higher. For SMEs, the fine is capped at whichever of the applicable fixed amount or percentage is lower. SMCs receive that lower-of treatment for paragraphs 4 and 5. These are maximum ceilings, not automatic penalties or predictions of an actual case. Authorities consider circumstances such as nature, gravity, duration, consequences, affected people, operator size, cooperation, responsibility, intent or negligence and harm mitigation. Member States determine rules for fines against public authorities and how fines are imposed within their legal systems. Article 101 separately authorizes Commission fines for GPAI providers of up to EUR 15 million or 3% of worldwide turnover, whichever is higher, in specified intentional or negligent circumstances. That separate power is not interchangeable with the general national tiers.