EU AI Act Penalties: A Clear 2026 Guide to the 3 Fine Tiers

EU AI Act penalties come in three tiers: up to €35 million or 7% of worldwide annual turnover for a prohibited practice, up to €15 million or 3% for most other obligations, and up to €7.5 million or 1% for supplying incorrect information to authorities. In each case the fine is whichever is higher — except for SMEs and start-ups, where it is whichever is lower, a rule the Digital Omnibus on AI extended in part to small mid-caps in July 2026.

This guide sets out the tiers as Article 99 defines them, who can be fined for what, the separate regime for general-purpose AI model providers, the factors authorities must weigh, which obligations are already enforceable, and the widely repeated claim about AI-literacy fines that the Regulation’s text does not support.

The three tiers of EU AI Act penalties under Article 99

Article 99(1) requires Member States to lay down the penalty rules — administrative fines, but also warnings and non-monetary measures — and to make them effective, proportionate and dissuasive, taking into account the interests and economic viability of SMEs, including start-ups. The fines are imposed by national market surveillance authorities, not by Brussels, which is why enforcement practice will vary by Member State.

EU AI Act penalties for SMEs and small mid-caps: the lower-of rule

For most companies the “whichever is higher” wording in the EU AI Act penalties means the percentage bites: a firm with €2 billion turnover faces up to €140 million under tier 1. Article 99(6) reverses the logic for SMEs, including start-ups: each fine shall be up to the percentages or amount in paragraphs 3, 4 and 5, whichever is lower. A start-up with €5 million turnover therefore faces a tier-1 ceiling of €350,000, not €35 million.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, inserted Article 99(6a), extending the lower-of rule to small mid-cap enterprises — but only for tiers 2 and 3, not for the prohibited-practice tier. A small mid-cap is defined by reference to Commission Recommendation (EU) 2025/1099: an enterprise that is not an SME, employs fewer than 750 people, and has annual turnover not exceeding €150 million or a balance sheet total not exceeding €129 million.

EU AI Act penalties for general-purpose AI models: Article 101

EU AI Act penalties for providers of general-purpose AI models sit in a separate article and are imposed by a different enforcer. Article 101(1) allows the Commission — in practice the AI Office — to impose fines not exceeding 3% of annual total worldwide turnover or €15 million, whichever is higher, for infringing the model-provider obligations in Chapter V, failing to comply with a request for documentation or information, failing to comply with a measure requested under Article 93, or failing to give access to a model for evaluation.

Under Article 113(b), Article 101 is the one part of Chapter XII whose application was deferred to the general application date of 2 August 2026, so the Commission’s fining power over model providers is live now.

Union institutions: Article 100

EU AI Act penalties for Union institutions, bodies, offices and agencies are imposed by the European Data Protection Supervisor rather than by Member States: up to €1,500,000 for a prohibited practice and up to €750,000 for other obligations.

How authorities set EU AI Act penalties: Article 99(7)

The ceilings on EU AI Act penalties are maxima. Article 99(7) requires the decision to take account of all relevant circumstances, and lists the factors:

• the nature, gravity and duration of the infringement and its consequences, including the purpose of the AI system and the number of people affected and the damage they suffered;
• whether other market surveillance authorities have already fined the same operator for the same infringement;
• whether other authorities have fined the same operator for infringements of other EU or national law arising from the same conduct;
• the size, annual turnover and market share of the operator;
• any other aggravating or mitigating factor, including financial benefits gained or losses avoided;
• the degree of cooperation with the authorities to remedy the infringement and mitigate its effects;
• the degree of responsibility, taking into account the technical and organizational measures implemented;
• the manner in which the infringement became known, in particular whether the operator self-reported;
• whether the infringement was intentional or negligent;
• any action taken to mitigate the harm suffered by the affected persons.

Two of those factors are within your control before anything goes wrong: the technical and organizational measures you can show you had in place, and whether you found and reported the problem yourself. A documented governance system is mitigation evidence in its own right.

Which EU AI Act penalties are enforceable now

Chapter XII, which contains Articles 99 and 100, has applied since 2 August 2025 — but a fine needs an obligation that is itself in force. The application dates decide exposure:

The Omnibus moved the two high-risk dates and added four new prohibitions with their own date; it did not postpone the original Article 5 prohibitions, the AI-literacy duty or the model rules. Our EU AI Act deadlines guide has the full Article 113 table.

The EU AI Act penalties claim that is wrong: the AI-literacy fine

A claim repeated across vendor material — and, until recently, in some compliance toolkits — is that breaching the Article 4 AI-literacy duty carries a €7.5 million or 1% fine. Article 99 does not say that. Paragraph 4’s list of obligations that attract the tier-2 fine is exhaustive and does not include Article 4; paragraph 5’s €7.5 million tier is for supplying incorrect information to authorities. Article 4 was also rewritten by the Omnibus into an obligation to take measures that support the development of AI literacy. Member States may attach their own penalties under Article 99(1), but there is no EU-level tier for it.

Overstating your exposure is a mistake in the other direction, and it is common. Our guide to the prohibited AI practices covers the tier-1 conduct that is genuinely enforceable today.

Frequently asked questions

What is the maximum fine under the EU AI Act?
€35 million or 7% of total worldwide annual turnover, whichever is higher, for a prohibited practice under Article 5. For SMEs and start-ups it is whichever is lower.

Are EU AI Act penalties already being enforced?
The penalty chapter has applied since 2 August 2025, and the prohibitions it enforces have applied since 2 February 2025. Transparency obligations became enforceable on 2 August 2026; high-risk obligations follow from December 2027 and August 2028.

Who imposes the fines?
National market surveillance authorities for operators under Article 99; the Commission for general-purpose AI model providers under Article 101; the European Data Protection Supervisor for Union institutions under Article 100.

Do deployers face fines, or only providers?
Deployers too. Article 99(4) lists Article 26 deployer obligations and Article 50 transparency duties, both at the tier-2 ceiling.

Does the lower-of rule apply to all smaller companies?
SMEs and start-ups get it for all three tiers. Small mid-caps, added by the Omnibus, get it for tiers 2 and 3 only — a prohibited practice by a small mid-cap still faces the higher-of ceiling.

Where this leaves you

Read EU AI Act penalties as a schedule rather than a single number: tier 1 for the prohibitions already in force, tier 2 for transparency now and high-risk obligations from December 2027, tier 3 for what you tell the authorities, and Article 101 for model providers. Work out which company-size rule applies to you, and note that the mitigation factors in Article 99(7) reward documented governance and self-reporting — which is a better reason to build the compliance file than the ceiling figures are.

References

• Article 99 — Penalties — the consolidated text with the Omnibus insertion of paragraph 6a.
• Regulation (EU) 2026/1744 — Digital Omnibus on AI — the amending regulation, in force 27 July 2026.
• Commission Recommendation (EU) 2025/1099 — the definition of small mid-cap enterprises.

More on AI governance

• EU AI Act penalties — you are here
• The EU AI Act explained
• EU AI Act deadlines and timeline
• Prohibited AI practices under Article 5
• NIS2 penalties

The prohibited-practice screening procedure and checklist, AI system register and high-risk requirements checklist that evidence the Article 99(7) mitigation factors are in the EU AI Act Toolkit (60 templates), or start with the free templates.