EU AI Act Fines Explained: The Three Article 99 Tiers, How Penalties Are Calculated, and What Actually Triggers Them
The headline number in the EU AI Act is EUR 35 million or 7% of worldwide turnover. It is also the number most often misapplied. Article 99 actually sets three tiers, and most compliance failures land in the middle one. This guide explains each tier, how amounts are decided, and what is likely to start an investigation.
The three Article 99 tiers
| Tier | Maximum | Typical breach |
|---|---|---|
| 1 | EUR 35M or 7% of worldwide annual turnover | Prohibited AI practices (Article 5) |
| 2 | EUR 15M or 3% | Non-compliance by providers, deployers and others with operator obligations, including high-risk requirements and GPAI obligations |
| 3 | EUR 7.5M or 1% | Supplying incorrect, incomplete or misleading information to authorities |
For large companies the higher of the fixed amount and the turnover percentage applies; SMEs and start-ups get lower-of treatment under the Act's text, and member states can adjust further per this enforcement overview. Check the consolidated Act and your member state's implementing law for the exact SME rule.
Worked example
A group with EUR 2 billion in worldwide turnover that deploys a prohibited practice faces a Tier 1 cap of 7%, which is EUR 140 million, because that exceeds EUR 35 million. The same group failing a Tier 2 duty faces a cap of 3%, or EUR 60 million. A start-up with EUR 10 million turnover would face the lower of EUR 35 million and EUR 700,000 for Tier 1. These are ceilings, not predictions.
What shapes the actual amount
Regulators weigh aggravating and mitigating factors. Aggravating factors include the nature, gravity and duration of the infringement, the number of people affected and damage caused, financial gain, previous violations, and the size, turnover and market share of the offender. Mitigating factors include cooperation with authorities, self-reporting, prompt remedial action and participation in the AI Pact as summarised here. That page also suggests fines will typically sit well below the maximums, but it offers no enforcement data, so treat that as an assumption, not a fact.
Who fines whom
The AI Office handles providers of general-purpose AI models, national authorities handle most other cases, and the EDPS supervises Union institutions. Member states had to lay down penalty rules by 2 August 2025, and GPAI fines became enforceable on 2 August 2026. See our enforcement architecture guide for who has jurisdiction over you.
What the Digital Omnibus changed
The Digital Omnibus (Regulation (EU) 2026/1744) moved the high-risk deadline to December 2027, so Tier 2 exposure for most high-risk duties starts later. Not everything moved: Article 5 bans, GPAI duties and Article 50 transparency are live now. Our post on procurement and Article 25 notes that breaches of Article 25 now sit in the EUR 15 million tier, which matters if you repurpose a vendor's AI.
Article 4 AI literacy is not a fineable provision under Article 99, but a literacy gap can aggravate another breach. See our Article 4 guide.
What tends to trigger investigations
Reported triggers include unregistered high-risk systems, missing conformity assessments, late serious incident reports and transparency failures. Investigations can begin from authority audits, complaints, incident reports or cross-border coordination per the same source. A new AI Office complaints tool and early information requests to GPAI providers are covered in our first 60 days of enforcement review.
Reducing exposure
Screen every use case against the prohibited practices first; this is the only tier-1 risk and mitigation counts for less.
Classify systems and register high-risk ones when due.
Know who reports serious incidents and in what time, and rehearse it.
Route authority requests through one owner; tier 3 is easy to trigger by accident.
Keep a log of remedial action and self-reporting; both mitigate.
Is 7% of turnover global or EU turnover?
Worldwide annual turnover of the preceding financial year, per Article 99.
Have any AI Act fines been issued yet?
We have not seen a confirmed public AI Act fine at the time of writing; check the AI Office and national authority announcements.
Do fines stack with GDPR fines?
They are separate regimes and can both apply to the same facts; see our dual-compliance guide.
Do SMEs pay less?
Yes, the Act applies the lower of the two limits to SMEs and start-ups, and member states may refine this.
Bottom line
The 7% figure applies only to banned practices. For most businesses the realistic exposure is the EUR 15 million or 3% tier plus the cost of corrective orders, so the best protection is early classification, clean records and prompt cooperation.
Related reading
Article 14 EU AI Act: Engineering Human Oversight That Actually Works
Article 14 is a design obligation, not an HR policy. Here's how to engineer the five oversight capabilities, split provider vs deployer duties, handle the biometric two-person rule, and build an audit-ready evidence trail.
EU AI Act Article 13: What Your Instructions for Use Must Contain, and What Deployers Should Demand From Vendors
Article 13 turns the instructions for use into the contract between a high-risk AI provider and its deployers. Here is what Article 13(3) requires, the evidence deployers should ask for, and where harmonised standards stand after 14 October 2026.
GPAI Models With Systemic Risk: The Safety and Security Chapter of the Code of Practice, Explained
Providers of the most capable general-purpose AI models carry extra duties. Here is what the Safety and Security chapter of the GPAI Code of Practice asks for, the incident timelines, and the dates that matter now the AI Office can enforce.