What are the fines for non-compliance with the EU AI Act?
Article 99 sets offence-specific ceilings, not one fine for every business using AI. Establish your role, the duty breached, enterprise size and the applicable date before calculating an amount.
What are the three tiers?
- Prohibited practices under Article 5: up to EUR 35 million or 7% of turnover.
- Breaches of the listed duties in Article 99(4), including Article 50 transparency: up to EUR 15 million or 3%.
- Incorrect, incomplete or misleading information supplied to a notified body or national competent authority in response to a request: up to EUR 7.5 million or 1%.
For an undertaking, the percentage uses total worldwide annual turnover for the preceding financial year. These are maxima. An actual penalty depends on the case, including gravity, duration, intent or negligence, cooperation and action to reduce harm.
When does the higher or lower figure apply?
The general rule compares the fixed sum and percentage and takes the higher ceiling. For SMEs, including start-ups, the Article 99 rule takes the lower value across the three tiers.
After the amendment, relief for small mid-cap enterprises (SMCs) concerns paragraphs 4 and 5, not the prohibited practices in paragraph 3. SME and SMC are different categories. Check the legal criteria rather than infer status from the number of people in an office.
An example for a qualifying SME: 7% of EUR 2 million turnover is EUR 140,000, below EUR 35 million. This illustrates the ceiling choice in that tier. It does not predict an actual fine or establish a breach.
Who imposes penalties?
Article 99 provides for national rules and procedures, including a possible court role depending on the legal system. Check the current competent authority and procedure for the particular case.
General-purpose AI model providers have a separate Commission procedure under Article 101. Do not apply that role mechanically to a business merely using a ready-made tool.
What does the table not tell you?
A ceiling does not establish whether a particular duty already applies, who is responsible or whether a breach occurred. Transparency, prohibitions and high-risk rules have different conditions and transitions. One later date does not postpone the whole Act.
Article 4 on AI literacy is not listed in Article 99(4). That neither cancels the duty nor establishes a blanket absence of consequences under all applicable rules. Separate assessing a use from calculating a sanction.
Questions
Could a small company pay a EUR 35 million fine?
Do not derive your own penalty from the headline maximum. Article 99 uses the lower ceiling for a qualifying SME; the example shows the choice. The actual case and applicable procedure need separate assessment.
Is a business fined just for using ChatGPT?
A product name is not a breach. Use, role and the particular unmet duty matter. A ready-made tool does not create a blanket exemption.
Do these fines apply already?
Read the penalty provision with the date and transition for the relevant duty. A later high-risk deadline does not excuse ignoring an already applicable prohibition or transparency duty. Check current national procedures.
Sources
Related reading
Next step
Connect each AI duty to an article and a date.
EU AI Act Readiness provides a tools register and a map of applicable duties with their sources and dates. Legal classification and an actual penalty require legal assessment.
or write to contact@ergostrat.com