EU AI Act Fines: What They Are and How to Actually Avoid Them

The Three-Tier Penalty Structure

How Fines Are Actually Calculated

The turnover figure is the company’s global annual turnover for the preceding financial year — not EU-only revenue. For large companies, the penalty is whichever is higher between the fixed euro amount and the percentage — meaning very large companies can face fines well above the headline €35M figure once 7% of global turnover is calculated.

The SME Exception Almost Nobody Mentions

For SMEs, including startups, Article 99 flips the formula: the fine is whichever amount is lower between the fixed figure and the percentage, not higher. A small company with €2M in annual turnover facing a Tier 1 violation would face up to 7% of that turnover (€140,000) — not the €35M ceiling designed for large enterprises.

The law explicitly requires penalties to be “effective, proportionate and dissuasive,” while taking into account the interests of SMEs, including their economic viability — this SME provision is how that principle is implemented in the actual fine calculation.

Who Can Actually Be Fined

Aggravating and Mitigating Factors Regulators Must Weigh

• The nature, gravity and duration of the infringement and its consequences
• Whether the infringement was intentional or negligent
• Actions taken to mitigate the damage suffered
• The degree of responsibility, considering technical and organizational measures implemented
• The degree of cooperation with competent authorities
• Any previous infringements by the same operator
• Financial benefits gained or losses avoided from the infringement

Who Actually Enforces This

Most enforcement runs through national market surveillance authorities in each EU member state, who investigate complaints and conduct their own monitoring. The EU AI Office handles enforcement specifically for general-purpose AI model obligations at the EU level, given that GPAI providers often operate across multiple member states simultaneously.

The Real Cost Beyond the Fine Itself

For most companies, the direct fine is not the largest cost of a compliance failure. Losing enterprise customers who require compliance attestations, being forced into expedited remediation under regulatory scrutiny, and the reputational damage of a public enforcement action typically outweigh the penalty amount — especially for the SME tier, where fines are proportionate but customer and reputational consequences are not.

A Practical Playbook for Avoiding Exposure

1. Classify every AI system correctly — misclassifying a high-risk system as limited or minimal risk is one of the most common paths to Tier 2 exposure.
2. Never claim the Article 6(3) high-risk carve-out without a documented assessment — an undocumented claim is treated as a compliance gap, not a valid exemption.
3. Respond to regulator information requests accurately and promptly — Tier 3 exposure comes specifically from incorrect or misleading information, which is often avoidable with a clear internal process for authority requests.
4. Document mitigating actions as you take them — cooperation and mitigation are explicit factors regulators must weigh, so a paper trail matters if an investigation happens.
5. If you're an SME, confirm your turnover classification is accurate and documented — it directly determines which fine formula applies to you.

How This Interacts With the Digital Omnibus Delay

The penalty structure under Article 99 is separate from the high-risk deadline delay currently working through EU institutions. Even if high-risk deadlines move to December 2027 as proposed, the fine structure itself isn't what's being delayed — only the date obligations become enforceable. See EU AI Act Deadlines in 2026 and 2027 for the full status of that delay.

Where Unorma Fits

Primary Sources

• EUR-Lex — Regulation (EU) 2024/1689, Article 99
• European Commission — Regulatory framework for AI