Penalties

What it actually costs to get wrong.

€35 million or 7% is quoted everywhere and applies to almost nobody reading it. Here are the three tiers, and the SME rule that most published guidance states backwards.

Last updated 20 August 2026 · Regulation (EU) 2024/1689 as amended by the June 2026 Omnibus · Self-assessment, not legal advice

The EU AI Act's headline number is €35 million or 7% of global turnover. It is quoted constantly and it is the wrong number for almost every company that reads it — wrong tier, wrong breach, and for SMEs, the arithmetic runs the opposite way to how most articles describe it.

If you are an SME or start-up, the fine is the lower of the fixed amount and the percentage — not the higher. Article 99(6) says so explicitly. Most published summaries get this backwards.

The three tiers

TierWhat triggers itLarge undertakingSME / start-up
Art 99(3) Article 5 prohibited practices — social scoring, untargeted facial scraping, emotion inference at work or school, certain biometric categorisation Up to €35m or 7% of worldwide annual turnover, whichever is higher Whichever is lower
Art 99(4) Most other operator duties — including Article 50 transparency, provider obligations under Art 16, deployer duties under Art 26 Up to €15m or 3% of turnover, whichever is higher Whichever is lower
Art 99(5) Supplying incorrect, incomplete or misleading information to authorities or notified bodies Up to €7.5m or 1% of turnover, whichever is higher Whichever is lower

What that means in real numbers

Take a start-up with €2m annual turnover that breaches Article 50 by shipping an undisclosed chatbot.

That is a ceiling, not a tariff. Article 99(7) requires authorities to weigh the nature and gravity of the breach, whether the operator self-reported, whether the infringement was negligent or intentional, and any action taken to mitigate harm. A documented, dated self-assessment that turned out to be imperfect is a materially different position from having never looked.

The percentage is of worldwide group turnover, not EU revenue and not the subsidiary's revenue. A small European entity inside a large group is fined against the group's number.

GPAI model providers are a separate regime

If you cross the line into being a general-purpose AI model provider, fines sit under Article 101 rather than Article 99: up to €15m or 3% of worldwide turnover, imposed by the Commission's AI Office rather than a national authority. Whether fine-tuning puts you there is the subject of the Article 53 guide.

When can you actually be fined

ObligationEnforceable
Article 5 prohibitionsNow — since 2 August 2026
Article 4 AI literacyNow
Article 50 transparencyNow — not deferred by the Omnibus
Article 53 GPAI dutiesNow
Chapter III high-risk obligations (Annex III)2 December 2027
Annex I — AI in regulated productsAugust 2028

The practical read: the fine exposure that exists today is Article 5, 4, 50 and 53. Everything in the high-risk column is a 2027 problem — but one that takes 12 to 18 months of conformity work to solve, which is why it is not a 2027 start date. Full deadline map.

Member States set their own penalty regimes within these ceilings under Article 99(1), so national implementations differ in procedure and in how aggressively they are applied. The ceilings above are the EU-level maxima.

Which tier are you exposed to?

The free check tells you which obligations attach to your system — and therefore which fine tier could ever apply.

Start the free scan

No card, no account. Full gap report from €59. See a real report first.

Self-assessment, not legal advice. This page and the Reglynn report are a structured self-assessment based on the EU AI Act (Regulation 2024/1689, as amended by the June 2026 Omnibus). They indicate where you likely stand and what to verify with a qualified advisor. Reglynn is not a notified body and issues no certification.

How this was made. Reglynn reports are generated by an AI system and reviewed before delivery. Reglynn is a Limited Risk AI system under Article 50; we disclose AI involvement wherever it occurs, including in our chat assistant. Our own self-assessment.