Penalties: what non-compliance actually costs

The EU AI Act's administrative fines (Art. 99) are deliberately GDPR-scale — and they have applied since 2 August 2025.

The three fine tiers

Each fine is defined as a fixed cap or a percentage of total worldwide annual turnover:

• Prohibited practices (Art. 5) — up to €35 million or 7% of worldwide turnover. Deploying a banned practice (e.g. social scoring, workplace emotion recognition) sits in this top band.
• Most other obligations — up to €15 million or 3%. This covers the bulk of the Act: high-risk provider and deployer duties, importer/distributor duties, transparency obligations.
• Incorrect, incomplete or misleading information to authorities — up to €7.5 million or 1%. Getting caught giving a notified body or regulator bad information is its own offence.

Higher-of vs lower-of

For standard undertakings the fine is the higher of the cap or the percentage — so a large group's 3% can dwarf €15m. For SMEs and start-ups, Art. 99(6) flips this: the fine is the lower of the two, which materially limits exposure for smaller companies.

Who enforces

• National market surveillance authorities (Art. 74) supervise AI systems in their market, investigate complaints (Art. 85 gives anyone the right to lodge one), and impose fines under national procedures.
• The Commission's AI Office (Art. 64) enforces the GPAI-model obligations and has market-surveillance powers over systems built on GPAI models (Art. 75).

Estimate your own exposure

Veritome's free Fine Exposure Calculator at /tools/fine-calculator does the maths for you: enter your worldwide annual turnover, pick the breach type and company size, and it shows the cap, the percentage amount, and your maximum exposure under the higher-of / lower-of rule — no signup needed, with a shareable result card. It is an estimate, not legal advice, but it makes the risk conversation with leadership very short.