AI Act: how high are the fines and who enforces?

Short answer: The AI Act (Regulation (EU) 2024/1689) sets tiered fines in Article 99, rising to EUR 35 million or 7% of total worldwide annual turnover for breaching the prohibition on certain AI practices — whichever is higher applies. Enforcement is shared: national market surveillance authorities enforce within the Member States, while the European Commission's AI Office supervises providers of general-purpose AI models.

The fine tiers in Article 99

The regulation uses three main tiers, each expressed as a fixed cap or a percentage of worldwide annual turnover, with the higher amount applying:

Infringement	Maximum
Prohibited AI practices (Article 5)	EUR 35 million or 7% of total worldwide annual turnover
Most other obligations for providers, deployers and other actors	EUR 15 million or 3% of total worldwide annual turnover
Incorrect, incomplete or misleading information to authorities	EUR 7.5 million or 1% of total worldwide annual turnover

For SMEs and start-ups, Article 99 provides that the lower of the two amounts applies in each case, keeping the fine proportionate. When setting the amount, factors such as the nature and gravity of the infringement, the size of the undertaking and prior infringements must be taken into account.

A separate regime applies to providers of general-purpose AI models: Article 101 enables the AI Office to impose fines of up to 3% of worldwide annual turnover or EUR 15 million, again whichever is higher.

Who enforces?

Enforcement is layered across several levels:

• National market surveillance authorities. Each Member State designates one or more competent authorities that enforce the regulation nationally and impose fines. Member States lay down their own penalty rules within the caps set by the regulation (Article 99(1)).
• The AI Office. This body, set up within the European Commission, directly supervises providers of general-purpose AI models and coordinates implementation across the EU.
• The AI Board, the advisory forum and the scientific panel support coordination and provide advice, but do not themselves impose fines.

For Union institutions, bodies and agencies, Article 100 provides a separate regime under which the European Data Protection Supervisor may impose fines.

Since when does the penalty regime apply?

The penalty regime has applied since 2 August 2025, together with the governance structure and the obligations for general-purpose AI models. The prohibited AI practices themselves have applied since 2 February 2025. The national enforcement infrastructure — the designation of competent authorities — was likewise due to be operational on 2 August 2025, although the pace at which Member States have implemented this varies in practice.

Note that the political agreement on the Digital Omnibus of 7 May 2026 shifts several dates of application for high-risk obligations. That amendment does not change the structure of the penalty regime, but the definitive dates are only fixed upon publication in the Official Journal. For the exact amounts and conditions, always consult the authentic text of Article 99 in the Official Journal.

Read more: AI Act: timeline of obligations.

Take the scan.