EU AI Act penalties: what you actually risk

The EU AI Act's penalty regime is set out in Article 99 of Regulation (EU) 2024/1689 (EUR-Lex). Member States lay down the detailed rules, but the Regulation fixes the ceilings.

The three fine tiers

• Up to €35,000,000 or 7% of total worldwide annual turnover (whichever is higher) — for prohibited AI practices under Article 5 (Article 99(3)).
• Up to €15,000,000 or 3% of total worldwide annual turnover (whichever is higher) — for non-compliance with a list of provisions including the transparency obligations of Article 50 for providers and deployers (Article 99(4)(g)).
• Up to €7,500,000 or 1% of turnover — for supplying incorrect, incomplete or misleading information to authorities (Article 99(5)).

For SMEs and start-ups, each fine is capped at the lower of the percentage or fixed amount (Article 99(6)).

So a missing chatbot disclosure can cost €15M?

That is the statutory ceiling, not the automatic outcome. Article 99(7) requires authorities to weigh the nature, gravity and duration of the infringement, whether it was intentional or negligent, remedial actions taken, cooperation, and prior infringements. But the exposure is real: transparency breaches sit in the same tier as most substantive obligations for high-risk systems. A visible, documented disclosure programme is cheap insurance by comparison.

Who enforces it?

National market surveillance authorities designated by each Member State enforce Article 50 against providers and deployers; the Commission's AI Office supervises general-purpose AI model providers (Articles 74-75, 88). Individuals can lodge complaints with their national authority (Article 85).

When does the risk start?

Article 113 sets the timeline: the Act entered into force on 1 August 2024; prohibitions applied from 2 February 2025; GPAI rules from 2 August 2025; and the bulk of the Act — including Article 50 and the Article 99 penalty regime — applies from 2 August 2026. The transparency obligations were not postponed by later legislative packages; do not rely on rumours that “the AI Act was delayed”.

Reduce your exposure this week

1. Identify features in scope of Article 50 (chatbots, generators, synthetic media).
2. Ship clear disclosures at first interaction/exposure.
3. Add machine-readable marking for generated media.
4. Record what you did and when — evidence of good faith matters under Article 99(7).