What are the fines under the EU AI Act?
Short answer
Under Regulation (EU) 2024/1689 (the "EU AI Act" / "AI-verordening"), fines for providers are set in three tiers — the regulator picks whichever is higher between a fixed cap and a share of worldwide annual turnover. Member States set their own penalties for deployers. The penalty regime started to apply on 2 August 2025.
The three tiers (Article 99)
Article 99 of Regulation (EU) 2024/1689 sets administrative fines that national competent authorities may impose on providers (and, where applicable, other operators addressed in the relevant chapters).
| Tier | Maximum fine | Trigger (typical case) |
|---|---|---|
| Article 99(3) | EUR 35 000 000 or 7 % of total worldwide annual turnover of the preceding financial year, whichever is higher | Use of a prohibited AI practice under Article 5 (e.g. social scoring by public authorities, untargeted face-scraping, emotion recognition at work/school, etc.) |
| Article 99(4) | EUR 15 000 000 or 3 % of worldwide annual turnover, whichever is higher | Non-compliance with most other obligations — e.g. requirements for high-risk AI systems (Articles 16–25,26–31, 33–34), transparency obligations for certain systems (Article 50), or core obligations of providers of general-purpose AI (GPAI) models (Articles 53, 55) |
| Article 99(5) | EUR 7 500 000 or 1 % of worldwide annual turnover, whichever is higher | Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities |
Important qualifications
- "Whichever is higher" is the rule. For very large groups the percentage figure, not the EUR cap, will normally bite first.
- SMEs and start-ups (Article 99(6)): where the regulation gives the choice between the EUR amount and the turnover percentage, the lower of the two — i.e. effectively the fixed EUR amount — applies. This caps exposure for smaller providers.
- Deployers (organisations using an AI system in a professional capacity): fines on deployers are not set by Article 99. Under Article 99(7), each Member State must lay down its own rules on penalties for deployers, and notify the Commission. In the Netherlands this is being implemented through the Implementatiewet EU-verordening artificiële intelligentie.
- First-time / minor infringements may, under Article 99(2), lead to a warning rather than a fine; recurring infringements can push the authority toward the top of the tier.
- Aggravating/mitigating factors the authority must weigh (Article 99(7)) include the nature, gravity and duration of the infringement; whether other authorities have already imposed fines for the same conduct; the size, turnover and market share of the operator; and any prior infringements.
- No criminal-law overlap: Article 99(11) clarifies that the EU-level fines regime does not apply to EU institutions, bodies, offices and agencies themselves (those are handled under their internal rules).
When the fines apply
The penalty chapter is governed by Article 113 (application dates). The general regime entered into force on 1 August 2024, but the prohibition rules (Article 5) became enforceable from 2 February 2025, and the bulk of the obligations — together with Article 99's administrative fines — apply from 2 August 2025. Some provisions on high-risk AI systems (Annex I) apply from 2 August 2026 and on embedded high-risk AI from 2 August 2027.
Sources
- Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (Artificial Intelligence Act), full text and consolidated version on EUR-Lex — CELEX number 32024R1689:
- Article 5 (prohibited practices): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
- Article 50 (transparency obligations): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
- Articles 16–25 and 26–34 (high-risk AI system requirements): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
- Articles 53, 55 (GPAI model provider obligations): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
- Article 99 (penalties): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
- Article 113 (application dates): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
Note on verification: in this session the live web search tool did not return results for the AI Act articles, so the figures and article references above rely on the published Regulation (EU) 2024/1689 as it stands (entry into force 1 August 2024, penalties live from 2 August 2025). If you need a binding view for a specific situation — for example, which authority will fine you, or whether an in-house tool triggers the deployer regime — please consult a qualified lawyer.
This is general information, not legal advice.