EU AI Act penalty calculator
under Article 99.
Up to €35 million or 7% of worldwide turnover for prohibited practices, €15 million or 3% for most other obligations, €7.5 million or 1% for misleading an authority. Higher of the two for most companies, lower for SMEs. Tick what would be breached and see your ceiling, and when each obligation can actually be enforced.
The tiers of Article 99, and Article 101
Article 99 of the AI Act, Regulation (EU) 2024/1689, sets three ceilings by category of breach. Each is a fixed sum or a percentage of total worldwide annual turnover for the preceding financial year. Providers of general-purpose AI models answer to a fourth, in Article 101, imposed by the Commission rather than by a national authority.
| Tier | What triggers it | Maximum | Larger company / SMC / SME |
|---|---|---|---|
| Prohibited practicesArticle 99(3) | Non-compliance with the prohibitions in Article 5 | €35m or 7% | Higher / higher / lower |
| Operator obligationsArticle 99(4) | Providers (Art. 16), authorised representatives (Art. 22), importers (Art. 23), distributors (Art. 24), value-chain duties (Art. 25(2) and (4)), deployers (Art. 26), notified bodies (Arts 31, 33(1), (3), (4) and 34), and transparency (Art. 50) | €15m or 3% | Higher / lower / lower |
| Incorrect informationArticle 99(5) | Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request | €7.5m or 1% | Higher / lower / lower |
| GPAI model providersArticle 101 | Infringing the GPAI obligations, or failing to comply with a Commission request (Art. 91), measure (Art. 93) or request for access (Art. 92); imposed by the Commission | €15m or 3% | Higher, whatever the size |
Read on EUR-Lex in October 2026: Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, which inserted Article 99(4)(da) and 99(6a) and left the amounts unchanged.
Higher for most, lower for SMEs
For an ordinary undertaking each Article 99 ceiling is the fixed sum or the percentage, whichever is higher. Article 99(6) reverses that for SMEs, including start-ups: each fine is up to the percentage or the amount, whichever is lower, on all three tiers. An SME turning over €20 million faces a prohibited-practices ceiling of 7%, or €1.4 million, rather than €35 million.
The Digital Omnibus on AI, Regulation (EU) 2026/1744, added Article 99(6a) for small mid-cap enterprises (SMCs), the category above SME size defined in Commission Recommendation (EU) 2025/1099. They get the lower-of rule on the Article 99(4) and 99(5) tiers only. For prohibited practices a small mid-cap is treated like any other company.
Article 101 has no equivalent rule. A provider of a general-purpose AI model faces €15 million or 3%, whichever is higher, whatever its size.
When each tier can bite
The penalty provisions in Chapter XII have applied since 2 August 2025, except Article 101. But a fine needs an obligation that applies, and Article 113, as amended by the Omnibus, staggers those.
| From | What becomes enforceable | Source |
|---|---|---|
| 2 Feb 2025 | Article 5 prohibitions (Chapters I and II) | Art. 113(a) |
| 2 Aug 2025 | Article 99 penalties; notified bodies (Chapter III Section 4); GPAI model obligations (Chapter V) | Art. 113(b) |
| 2 Aug 2026 | General application, including Article 50 transparency and Article 101 fines for GPAI providers | Art. 113, second paragraph |
| 2 Dec 2026 | Two prohibitions added by the Omnibus (Art. 5(1)(ba), (bb), 5(1a), (1b)); end of the Article 50(2) grace period for generative systems already on the market | Art. 113(a) as amended; Art. 111(4) |
| 2 Aug 2027 | GPAI models placed on the market before 2 August 2025 must comply | Art. 111(3) |
| 2 Dec 2027 | High-risk obligations for Annex III systems (recruitment, credit scoring, education and the rest) | Art. 113(c)(i) as amended |
| 2 Aug 2028 | High-risk obligations for AI in products covered by Annex I | Art. 113(c)(ii) as amended |
The full timeline, with what each date means for providers and deployers, is in the EU AI Act guide.
How the amount is set
Article 99(1) requires penalties to be effective, proportionate and dissuasive, and to take into account the interests of SMEs, including start-ups, and their economic viability. Article 99(7) lists what the authority weighs in each case:
- The nature, gravity and duration of the infringement and its consequences, the purpose of the system, the number of people affected and the damage they suffered
- Whether other authorities have already fined the same operator for the same infringement, or for breaches of other law arising from the same conduct
- The size, annual turnover and market share of the operator
- Financial benefits gained or losses avoided
- Cooperation with the authorities, and the technical and organisational measures in place
- How the infringement became known, in particular whether the operator notified it
- Whether it was intentional or negligent, and what was done to mitigate the harm
A register of the AI systems you run, a risk classification for each, and documentation dated before any complaint are what make several of those factors work for you. The EU AI Act penalties guide covers the tiers in more depth, and does the EU AI Act apply to me? works out your role and risk tier first.
Sources
- Regulation (EU) 2024/1689 (AI Act), EUR-Lex: Articles 99, 101, 111 and 113.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex: amendments to Article 99 (points (da) and paragraph 6a) and Article 113.
The things people ask us
What is the maximum fine under the EU AI Act?
€35 million or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher, for breaching the Article 5 prohibited practices (Article 99(3)). Most other operator obligations carry up to €15 million or 3%, and supplying incorrect information to authorities up to €7.5 million or 1%.
Do SMEs and start-ups pay less under the EU AI Act?
Their ceiling is lower. Article 99(6) says that for SMEs, including start-ups, each fine is up to the percentage or the fixed amount, whichever is lower, on all three tiers of Article 99. Small mid-cap enterprises get the same rule on the €15 million and €7.5 million tiers under Article 99(6a), added by Regulation (EU) 2026/1744, but not on prohibited practices.
What fines apply to general-purpose AI model providers?
Under Article 101 the Commission can fine a GPAI model provider up to €15 million or 3% of annual total worldwide turnover, whichever is higher, for intentionally or negligently infringing the GPAI obligations or failing to comply with its requests or measures. Article 101 applies from 2 August 2026 and has no lower-of rule for smaller providers.
When can EU AI Act fines be imposed?
Article 99 has applied since 2 August 2025 and Article 101 since 2 August 2026, but a fine needs an obligation in force. The prohibitions apply from 2 February 2025, Article 50 transparency from 2 August 2026, and the high-risk obligations from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products.
Is Article 50 transparency in the €15 million tier?
Yes. Article 99(4)(g) puts the transparency obligations of providers and deployers under Article 50 in the €15 million or 3% tier, alongside the obligations of providers, authorised representatives, importers, distributors, deployers and notified bodies.
Are AI Act fines added together for several breaches?
Article 99 sets a ceiling per fine and contains no rule like GDPR Article 83(3), which caps several infringements of linked processing at the gravest one. How several breaches combine is decided case by case, so the calculator shows the highest single ceiling rather than a total.
Is the result a prediction of our fine?
No. It is the statutory maximum for the categories you ticked. The authority sets the amount using the Article 99(7) factors, including size, cooperation, mitigation and whether the breach was intentional.
Know your AI systems before an authority asks.
The platform keeps a register of the models and AI systems you run, a risk classification for each, and the evaluation record behind it, so the evidence predates the question.