Penalties: what non-compliance actually costs

The EU AI Act's administrative fines (Art. 99) are deliberately GDPR-scale — and they have applied since 2 August 2025.

The three fine tiers

Each fine is defined as a fixed cap or a percentage of total worldwide annual turnover for the preceding financial year:

• Prohibited practices (Art. 5) — up to €35 million or 7% of worldwide turnover (Art. 99(3)). Deploying a banned practice — social scoring, emotion inference at work — sits in this top band.
• Most other obligations — up to €15 million or 3% (Art. 99(4)). This covers the bulk of the Act: high-risk provider and deployer duties, importer and distributor duties, authorised-representative duties, the Art. 50 transparency obligations, notified-body duties.
• Incorrect, incomplete or misleading information to authorities — up to €7.5 million or 1% (Art. 99(5)). Giving a notified body or regulator bad information is its own offence.

Higher-of vs lower-of

For most undertakings the fine is the higher of the cap or the percentage — so a large group's 3% can dwarf €15 million. For SMEs and start-ups, Art. 99(6) flips this: the fine is the lower of the two, which materially limits exposure for smaller companies. The Digital Omnibus extended the same lower-of rule to small mid-caps (SMCs) for the Art. 99(4) and (5) tiers, not for Art. 5 breaches. In every case the authority weighs the nature, gravity and duration of the infringement, intent, cooperation and any earlier fines (Art. 99(7)).

GPAI model providers

Fines on providers of general-purpose AI models are imposed by the Commission, not the national authorities, under Art. 101: up to €15 million or 3% of worldwide turnover for infringing Chapter V, for failing to answer a request for documentation or information, or for refusing access for an evaluation.

Who enforces

• National market surveillance authorities (Art. 74) supervise AI systems in their market, investigate complaints (Art. 85 gives anyone the right to lodge one), and impose fines under national procedures. Each Member State lays down its own penalty rules within the Art. 99 caps.
• The Commission's AI Office (Art. 64) enforces the GPAI-model obligations and has market-surveillance powers over systems built on GPAI models where the same provider makes both (Art. 75).

Estimate your own exposure

Veritome's free Fine Exposure Calculator at /tools/fine-calculator does the maths for you: enter your worldwide annual turnover, pick the breach type and company size, and it shows the cap, the percentage amount, and your maximum exposure under the higher-of / lower-of rule — no signup needed, with a shareable result card. It is an estimate, not legal advice, but it makes the risk conversation with leadership very short.