In this article
- What Are the EU AI Act Fines?
- EU AI Act Penalty Thresholds
- 1. When Can the €35 Million Fine Apply?
- 2. When Can Fines of Up to €15 Million Apply?
- 3. What Does the €7.5 Million Fine Cover?
- 4. How Are EU AI Act Fines Calculated?
- 5. Do Small Businesses and Start-ups Face the Same Maximums?
- 6. General-Purpose AI Model Providers Have a Separate Fine Provision
- 7. What Should Companies Review to Reduce Compliance Gaps?
- AI inventory and ownership
- Risk assessment and classification
- Obligation mapping
- Documentation and evidence
- Ongoing review
- 8. How AI Compliance Software Supports This Work
- How AnnexOps Supports AI Compliance Operations
- 9. Common Mistakes When Assessing EU AI Act Fines
- Conclusion: Make Penalty Awareness Part of AI Governance
- Ready to Strengthen Your AI Compliance Readiness?
- Author: Nitin Grover
A company introduces an AI tool to screen job applications. Another develops a recruitment system and sells it to employers across Europe. Both work with AI, but their responsibilities under the EU AI Act may differ.
That distinction matters when a business assesses its regulatory exposure. The potential penalty depends on the infringement, the organisation’s role, the applicable provision and the circumstances of the case.
The EU AI Act sets maximum administrative fines of up to €35 million or 7% of worldwide annual turnover for certain prohibited AI practices. Other infringements have lower maximum thresholds. These figures are not automatic penalties for every compliance mistake.
For businesses operating in Europe, understanding EU AI Act fines is part of planning an effective AI governance process. Companies need to know which systems they use, what obligations apply, and how they will document the decisions they make.
This guide explains the main penalty thresholds, the rules for smaller businesses, the risks that deserve attention, and how AI compliance software can help teams organise their work.
Is Your Business Prepared for EU AI Act Fines?
Identify AI risks, understand applicable obligations, and organise compliance documentation with AnnexOps.
What Are the EU AI Act Fines?
Article 99 of the EU AI Act establishes penalty rules for several categories of infringement. It requires Member States to provide for effective, proportionate and dissuasive penalties and enforcement measures.
The regulation distinguishes between prohibited AI practices, certain operator obligations and incorrect information supplied to notified bodies or competent authorities.
The maximum amounts also depend on the type of organisation involved. For qualifying small and medium-sized enterprises (SMEs), including start-ups, the applicable rule uses the lower of the specified monetary amount or turnover percentage. The amended regulation also provides a similar lower-of-two approach for small mid-cap companies for the infringements covered by Article 99(4) and (5).
Businesses should therefore avoid treating the headline €35 million figure as the penalty that applies to every breach.
EU AI Act Penalty Thresholds
| Type of infringement | Maximum administrative fine |
| Non-compliance with the prohibitions in Article 5 | Up to €35 million or 7% of worldwide annual turnover, whichever is higher |
| Certain operator or notified-body obligations under Article 99(4) | Up to €15 million or 3% of worldwide annual turnover, whichever is higher |
| Supplying incorrect, incomplete or misleading information in response to a request from a notified body or competent authority | Up to €7.5 million or 1% of worldwide annual turnover, whichever is higher |
These are maximum thresholds, not fixed fines. The amount imposed in an individual case depends on the applicable legal provisions and the circumstances considered by the relevant authority.
1. When Can the €35 Million Fine Apply?
The highest threshold relates to non-compliance with the prohibited AI practices listed in Article 5.
This category is different from an ordinary documentation gap or a missed internal review. Article 5 addresses practices that the regulation prohibits, subject to the wording and conditions of the relevant provisions.
For example, a business should examine whether a proposed AI use could fall within a prohibited practice before putting it into operation. The assessment should consider what the system does, how it is used and the conditions under which it operates.
A business should not assume that every high-risk AI system falls into this prohibited category. High-risk classification and prohibited AI practices are distinct regulatory questions.
The practical response is to assess intended purpose and actual use before deployment, record the reasoning behind the decision, and seek qualified legal review where the classification or interpretation is uncertain.
2. When Can Fines of Up to €15 Million Apply?
Article 99(4) covers specified obligations involving operators and notified bodies, other than the prohibited practices covered by Article 5.
The listed provisions include certain duties of providers, authorised representatives, importers and distributors. They also cover specified deployer obligations and transparency requirements for providers and deployers under Article 50.
This matters because a company can have responsibilities even when it did not develop the AI system itself.
Consider a European employer using an AI system in recruitment. The employer needs to understand its role as a deployer and determine which obligations apply to its use of the system. The provider’s responsibilities do not automatically remove the deployer’s own duties.
A company developing and supplying an AI product will need to examine its provider obligations instead. If a business develops some systems and deploys others, it may need to assess both roles.
An EU AI Act compliance platform can help teams maintain system records and connect them to the relevant obligations. However, the software’s output should be reviewed against the regulation and the organisation’s actual circumstances.
3. What Does the €7.5 Million Fine Cover?
Article 99(5) addresses the supply of incorrect, incomplete or misleading information to notified bodies or national competent authorities in response to a request.
The maximum is €7.5 million or 1% of worldwide annual turnover, whichever is higher, subject to the applicable rules for smaller businesses.
This provision makes the quality of compliance records important. Teams should know which version of a document was submitted, who approved it, and whether the information was complete when provided.
For instance, if a company submits technical or compliance information in response to a formal request, it should have a process for checking the material before submission. Missing records, conflicting versions and unsupported statements can create avoidable problems.
Maintaining organised evidence does not remove the need to provide accurate information. It does make it easier to trace what was recorded, reviewed, and communicated.
4. How Are EU AI Act Fines Calculated?
The regulation expresses several maximum fines as either a monetary amount or a percentage of worldwide annual turnover. For the general thresholds in Article 99(3), (4) and (5), the higher of the two is the stated maximum for an undertaking.
A simplified example illustrates the calculation.
Suppose an undertaking has worldwide annual turnover of €600 million in the preceding financial year. Seven per cent of that turnover is €42 million. Under the Article 99(3) threshold, the stated maximum would be the higher figure: €42 million rather than €35 million.
This example explains the arithmetic only. It does not mean a breach automatically results in a fine of €42 million. The applicable provision, the circumstances and the authority’s decision all matter.
Businesses should also avoid using this general calculation without checking whether a special rule applies. Article 99 contains specific provisions for SMEs, including start-ups, and the amended text includes a separate rule for certain small mid-cap companies.
5. Do Small Businesses and Start-ups Face the Same Maximums?
Not necessarily. Article 99(6) states that, for SMEs including start-ups, each fine referred to in the article is capped by whichever is lower: the specified monetary amount or the applicable turnover percentage.
The amended regulation also adds Article 99(6a). For small mid-cap companies, this lower-of-two rule applies to fines under paragraphs 4 and 5.
These provisions are important when a business estimates its potential exposure. A start-up should not simply copy the calculation used for a large undertaking and assume that the same maximum applies to it.
However, smaller organisations should not treat the rules as a reason to postpone governance work. The applicable requirements still need to be identified, and the precise effect of the penalty provisions depends on the organisation’s status and the infringement involved.
Before relying on a particular threshold, businesses should confirm their company category and review the current legal text. Where the answer affects a material business decision, qualified legal advice is appropriate.
6. General-Purpose AI Model Providers Have a Separate Fine Provision
Article 101 addresses fines for providers of general-purpose AI (GPAI) models. It gives the European Commission the power to impose fines of up to 3% of worldwide annual turnover in the preceding financial year or €15 million, whichever is higher, for specified intentional or negligent infringements.
The provision covers particular failures involving the GPAI rules, including certain requests for information or documents. Its scope is specific to the obligations and circumstances described in Article 101.
This is not the same as applying the general Article 99 thresholds to every AI business. A company that provides a GPAI model should examine the relevant GPAI obligations separately from any duties arising from its use or deployment of AI systems.
7. What Should Companies Review to Reduce Compliance Gaps?
The most useful starting point is not to calculate the largest possible fine. It is to identify the AI systems the organisation uses or supplies and understand what responsibilities apply to each one.
A practical review can cover five areas.
AI inventory and ownership
List the AI systems used across the organisation, including systems embedded in products and services. Record their purpose, owner, provider, deployment context and relevant dependencies.
Without an inventory, compliance teams may overlook AI used by individual departments or introduced through third-party software.
Risk assessment and classification
Assess the intended purpose and context of each system. Determine whether the system may fall under a prohibited practice, a high-risk category, or another relevant part of the regulation.
An AI risk classification tool can support a consistent process, but a classification should not be accepted without checking the underlying facts and applicable legal criteria.
Obligation mapping
Once the regulatory position is understood, connect the relevant obligations to the system and the responsible team. Record the actions required, review dates and evidence needed.
This is more practical than giving every department the same generic checklist.
Documentation and evidence
Keep relevant assessments, approvals, technical records, policies and other supporting material organised. Make sure the team can identify the current version and understand who reviewed it.
A record is more useful when it explains the decision it supports, rather than simply existing in a folder.
Ongoing review
AI systems can change after launch. A model may be updated, a new use case may be introduced, or a business may begin using a system in a different context.
Set review triggers for meaningful changes. Revisit the risk assessment and related obligations when the facts behind the original decision no longer hold.
These steps help organisations manage AI compliance operations as an ongoing process instead of a one-time documentation exercise.
8. How AI Compliance Software Supports This Work
Managing multiple AI systems through separate spreadsheets, document folders and email approvals can make it difficult to see what remains outstanding.
AI compliance software helps bring related activities into a structured workflow. Depending on the product, it may support AI inventory, risk classification, obligation tracking, documentation, evidence management and monitoring.
For organisations operating in Europe, an AI governance platform can help connect system-level decisions with the work needed to maintain records and prepare for reviews.
The software does not decide every legal question for the organisation. Teams still need to validate the system’s intended purpose, review uncertain classifications, and confirm that the records reflect actual operations.
How AnnexOps Supports AI Compliance Operations
AnnexOps is AI compliance software designed to help organisations manage EU AI Act and GDPR-related governance activities.
Its capabilities include:
- AI system inventory: Organise records of AI systems and their relevant information.
- Risk Classification Engine: Support structured risk classification, including Annex III use cases, with versioned classification logic and review information.
- Obligation Engine: Connect identified requirements with relevant systems and compliance activities.
- Documentation and evidence management: Help teams organise compliance documentation, supporting evidence, and review workflows.
- Continuous monitoring and audit preparation: Support ongoing visibility into compliance activities and the records available for review.
These capabilities can help teams maintain a more connected view of their AI governance work. They do not guarantee compliance, determine the outcome of regulatory proceedings, or replace qualified legal advice.
Explore AnnexOps AI compliance software or review the Risk Classification Engine to understand how these workflows can fit into an organisation’s process.
9. Common Mistakes When Assessing EU AI Act Fines
Several assumptions can make a penalty assessment less useful.
Treating €35 million as the standard fine. This is the maximum threshold for a particular category of infringement, not a universal penalty.
Confusing high-risk systems with prohibited practices. These are separate legal categories and need separate assessments.
Ignoring the organisation’s role. Providers, deployers, importers and other operators may have different responsibilities.
Using an outdated version of the regulation. Businesses should check amendments and the consolidated legal text before relying on a threshold.
Keeping records without a clear owner. Documentation is harder to maintain when nobody is responsible for updating it or checking whether it remains accurate.
Assuming software alone resolves legal questions. Tools can structure and support the work, but organisations still need appropriate human review and decisions grounded in the facts.
Conclusion: Make Penalty Awareness Part of AI Governance
The EU AI Act sets different maximum penalties for different categories of infringement. The €35 million or 7% threshold is important, but it should not distract companies from understanding the obligations that apply to their own AI systems.
A sensible first step is to create an accurate AI inventory, establish each system’s intended purpose, assess the organisation’s role and document the reasoning behind its classification. Teams can then map applicable obligations, assign responsibility and keep evidence current.
For companies managing several AI systems, AI compliance software can support this process by connecting inventory, risk classification, obligation tracking, documentation and evidence management.
AnnexOps helps organisations organise these AI compliance operations through a connected workflow. The objective is to give teams a clearer view of their systems, outstanding actions and supporting records, not to promise a particular legal outcome.
Ready to Strengthen Your AI Compliance Readiness?
Build a more structured approach to AI risk classification, obligation tracking, and compliance documentation with AnnexOps.
Author: Nitin Grover
Nitin Grover is an AI compliance strategist and writer focused on EU AI Act compliance, AI governance, Annex IV documentation, AI risk management, and AI compliance operations for AI startups, SaaS companies, and enterprise AI teams across Europe.
