EU AI Act Fines: Penalty Tiers, Enforcement, and What They Mean for Your Business

The EU AI Act establishes a penalty regime designed to ensure compliance is not treated as optional. Fines can reach up to €35 million or 7% of global annual turnover — whichever is higher — for the most serious violations. For mid-market EU companies with 50 to 500 employees, these penalties are material, and they apply to deployers as well as providers.

This article explains the three penalty tiers, what conduct triggers each, who enforces the rules, and what your organisation can do now to reduce exposure.

The three penalty tiers

The AI Act’s fine structure is set out in Article 99. It follows a graduated model with three tiers, each tied to a category of violation:

Member states set their own penalty frameworks within these ceilings, which means the actual fine imposed may vary across jurisdictions. The percentage-of-turnover thresholds are calculated on the basis of the undertaking’s total worldwide annual turnover in the preceding financial year, mirroring the approach used under GDPR.

A critical detail: the fines apply to both providers and deployers. A company that deploys a prohibited AI system — even if it bought the tool from a third-party vendor — can face Tier 1 penalties.

What triggers each tier: realistic mid-market examples

Tier 1 — prohibited practices

These fines target the most serious violations: using AI systems that fall under Art. 5 prohibitions. Common scenarios in mid-market companies include:

• A 300-person logistics company uses an AI platform that scores workers on “reliability” based on social-behaviour data. This is social scoring — a prohibited practice.
• A SaaS firm deploys a recruitment tool that uses facial-analysis to infer emotions from candidates during video interviews. Emotion recognition in the workplace is prohibited (with narrow medical exceptions).
• A fintech uses an AI-powered people-search tool that scrapes facial images from public databases to build a custom recognition model. Untargeted scraping for facial-recognition databases is prohibited.

These violations carry the highest fines because the AI Act treats them as fundamentally incompatible with EU values and fundamental rights.

Tier 2 — non-compliance with high-risk and deployer obligations

The most common mid-market exposure falls into this tier. Examples include:

• A 200-person SaaS company uses an AI-powered CV screening tool (Annex III high-risk) but has not established a human-oversight process as required by Art. 26.
• A mid-sized insurer deploys an AI system for life-insurance risk assessment (Annex III high-risk) but has not conducted the mandatory Fundamental Rights Impact Assessment under Art. 27.
• A company deploys a high-risk AI system without informing affected individuals that AI is being used in the decision-making process.
• An employer deploys an AI performance-monitoring tool for workers without notifying employees or their representatives, breaching Art. 26(7).

Tier 3 — misleading information

This tier applies when a company provides incorrect, incomplete, or misleading information to a supervisory authority in response to an investigation or audit. It also covers the submission of inaccurate technical documentation. The fine is lower than the other tiers, but the reputational damage of an adverse finding can be significant.

When did enforcement begin?

The AI Act did not switch on all at once. The enforcement timeline has three key dates:

1. 2 February 2025 — the Art. 5 prohibited practices and the Art. 4 AI-literacy obligation entered into force. From this date, using a prohibited AI system is unlawful, and organisations must ensure their staff have sufficient AI literacy.
2. 2 August 2026 — the Act’s general applicability date. This brings in GPAI (general-purpose AI) enforcement powers, national market-surveillance authority competence, the Art. 50 transparency obligations (chatbot disclosure, synthetic-content marking, deepfake disclosure), and the full penalty regime.
3. 2 December 2027 — the delayed high-risk obligations for Annex III systems take effect (pushed from August 2026 by the Digital Omnibus regulation, Council final approval 29 June 2026).

This means that from 2 August 2026, authorities can impose fines for prohibited practices, transparency breaches, and GPAI-related violations. The high-risk penalty regime for Annex III systems activates on 2 December 2027.

Who enforces the AI Act?

Enforcement is not handled by a single EU-wide AI regulator. Instead, the AI Act relies on a distributed enforcement model:

• National market-surveillance authorities are the primary enforcement bodies. Each member state designates one or more authorities responsible for monitoring the market, investigating non-compliance, and imposing penalties.
• Data protection authorities (DPAs) play a complementary role, particularly where AI systems process personal data and GDPR obligations intersect. In practice, DPAs will be involved in cases where the AI Act and GDPR overlap — for example, AI systems making automated decisions under GDPR Art. 22 that also qualify as high-risk under the AI Act.
• The EU AI Office coordinates cross-border enforcement and oversees GPAI model compliance, but it does not directly impose fines on individual deployers.

The enforcement model mirrors GDPR’s multi-supervisory-authority approach. Companies operating across multiple member states will need to engage with the relevant national authority in each jurisdiction where a non-compliant AI system is deployed.

How penalties compare to GDPR enforcement

The AI Act’s fine structure is deliberately modelled on GDPR. The percentage-of-turnover thresholds are comparable, and the graduated tier system follows a familiar pattern. However, there are important differences:

• GDPR fines are primarily enforced by DPAs. AI Act fines are primarily enforced by market-surveillance authorities, with DPAs playing a supporting role where data protection is implicated.
• GDPR applies to all personal-data processing. AI Act penalties are triggered only by specific AI-system-related violations. A company could be fully GDPR-compliant and still breach the AI Act.
• GDPR enforcement has been concentrated on large tech companies. AI Act enforcement may be more evenly distributed because market-surveillance authorities monitor specific product categories rather than data-processing activities.

For mid-market companies, the practical lesson is that GDPR compliance is a necessary but not sufficient condition. The AI Act introduces independent obligations that require their own compliance programme.

Mitigation: what your organisation should do now

Reducing your AI Act exposure requires a structured approach. The following four steps are achievable for organisations of any size:

1. Inventory all AI systems — cataloguing every tool, module, and embedded AI feature across your SaaS stack. Include tools that your teams use without central IT approval — shadow AI is a compliance risk.
2. Classify each system — mapping each AI tool to the correct risk tier (prohibited, high-risk, limited-risk, or minimal-risk) using the criteria in Articles 5, 6, and Annex III.
3. Document your compliance — recording the classification rationale, the obligations that apply to each system, and the steps taken to satisfy them. This documentation is the evidence base that supervisory authorities will examine.
4. Train your staff — the Art. 4 AI-literacy obligation has been in force since 2 February 2025. All staff who use or manage AI tools must have sufficient literacy to understand the risks, obligations, and proper use of those systems. This is not a one-off exercise — it requires ongoing training as tools and regulations evolve.

For organisations seeking a streamlined way to manage these steps, Renomira provides a purpose-built platform for AI inventory, risk classification, and compliance documentation aligned with the EU AI Act.

Frequently asked questions

Can a deployer face the same fine as a provider?

Yes. Article 99 applies to both providers and deployers. A deployer that uses a prohibited AI system, or fails to meet its obligations under Article 26 (human oversight, informing affected individuals, logging), faces the same maximum penalties as the provider that built the system. The deployer cannot shift liability by pointing to the vendor.

Are there reduced fines for SMEs?

The AI Act allows member states to set their own penalty frameworks within the Art. 99 ceilings, and some may provide for mitigating factors for SMEs. However, the Act itself does not create a separate SME fine category. Mid-market companies should not assume that smaller size will result in significantly lower penalties.

What does the Art. 4 AI-literacy obligation actually require?

Article 4 requires that providers and deployers ensure their staff and other persons dealing with AI systems have sufficient AI literacy. The Act defines this as the ability to understand the system’s risks, limitations, and proper use. In practice, this means documented training programmes, regular refreshers, and evidence that staff have been trained — particularly for those managing high-risk or limited-risk systems.

Do fines apply retroactively to AI systems deployed before the AI Act entered into force?

No. The AI Act does not apply retroactively. However, the prohibited practices have been in force since 2 February 2025, and the full penalty regime applies from 2 August 2026. Any AI system deployed before those dates that falls under Art. 5 prohibitions must be discontinued or brought into compliance before those deadlines.

How do member states enforce across borders?

The AI Act uses a distributed enforcement model. National market-surveillance authorities in each member state enforce the Act within their jurisdiction. For companies operating across multiple member states, compliance must be assessed in each jurisdiction where an AI system is used. The EU AI Office coordinates cross-border enforcement but does not directly impose fines on individual deployers.