penaltiesenforcementrisk

    EU AI Act Penalties and Fines: What Non-Compliance Really Costs

    Ready 4 AI Act ยท June 30, 2026 ยท Last updated July 31, 2026

    Cover image for "EU AI Act Penalties and Fines: What Non-Compliance Really Costs"

    The three fine tiers in one sentence

    The EU AI Act sets three maximum fine tiers: EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for most other operator breaches, and EUR 7.5 million or 1% for supplying incorrect information โ€” whichever is higher, with lower caps for SMEs.

    Tier 1 โ€” Prohibited practices (Article 5)

    Up to EUR 35M or 7%. Social scoring, real-time remote biometric ID in public (with narrow exceptions), emotion recognition at work or in education, untargeted scraping of facial images, biometric categorisation inferring sensitive traits, subliminal or manipulative techniques causing harm.

    Tier 2 โ€” Operator breaches

    Up to EUR 15M or 3%. Breaches of high-risk obligations (Articles 9-17), notified body obligations, most Article 50 transparency duties.

    Tier 3 โ€” Incorrect information

    Up to EUR 7.5M or 1%. Incorrect, incomplete, or misleading information to notified bodies or national authorities.

    SME and start-up cap

    For SMEs and start-ups the applicable fine is the lower of the two figures โ€” not the higher.

    GPAI fines (Article 101)

    The Commission can fine GPAI providers up to 3% of turnover or EUR 15M, whichever is higher, for failure to provide information, failure to mitigate systemic risk, or refusal to submit to model evaluation.

    Who enforces

    • National market surveillance authorities for most operator obligations.
    • The European AI Office for GPAI.
    • DPAs where personal data is involved โ€” expect parallel GDPR fines.

    Factors that scale the fine

    Article 99(7): nature and duration of infringement, prior sanctions, operator size, benefits gained, degree of cooperation, intentional vs. negligent. Cooperation genuinely moves the number.

    The under-priced cost

    Fines are only part of the exposure. Mandatory withdrawal, reputational damage, follow-on civil liability, and loss of public procurement eligibility usually cost more.


    Related: EU AI Act overview ยท Compliance checklist ยท Free readiness assessment

    Reviewed by Ready 4 AI Act EU - Editorial team. This article is journalistic information, not legal advice.

    Not sure where you stand?

    Take the free readiness assessment and get a personalised report.

    Start free assessment