AI Act penalties can reach EUR 35 million or 7% of worldwide turnover. Breakdown of fines by type of infringement and comparison with the GDPR.
The European Regulation on Artificial Intelligence (Regulation 2024/1689) introduces one of the most stringent penalty systems in European digital law. With fines of up to EUR 35 million or 7% of worldwide turnover, the AI Act sends a clear signal: non-compliance on AI is not an abstract risk — it is a major financial risk.
Article 99 — Règlement (UE) 2024/1689
Member States shall lay down the rules on penalties and other enforcement measures, which may also include warnings and non-monetary measures, applicable to infringements of this Regulation by operators, and shall take all measures necessary to ensure that they are implemented properly and effectively […].
Article 99 of the regulation defines three tiers of penalties, depending on the severity of the infringement.
The highest level of penalty applies to violations of Article 5 (prohibited practices):
The fine can reach EUR 35 million or 7% of annual worldwide turnover, whichever is higher.
For a business with EUR 500 million in turnover, this could mean a fine of EUR 35 million. For a global group with EUR 10 billion in turnover, the theoretical fine rises to EUR 700 million.
The second tier covers violations of obligations relating to high-risk AI systems and general-purpose AI models:
This last point is crucial: failure to train staff in AI falls under this tier. A business that has taken no measures to ensure a sufficient level of AI literacy for its personnel faces fines of up to EUR 15 million or 3% of worldwide turnover.
The third tier applies when a business provides inaccurate, incomplete or misleading information to competent authorities or notified bodies:
The fine can reach EUR 7.5 million or 1.5% of annual worldwide turnover.
To appreciate the severity of the AI Act regime, the comparison with the GDPR is instructive:
| Criterion | GDPR | AI Act |
|---|---|---|
| Maximum fine (fixed amount) | EUR 20 million | EUR 35 million |
| Maximum fine (% of turnover) | 4% of worldwide turnover | 7% of worldwide turnover |
| Number of tiers | 2 | 3 |
| In force since | May 2018 | Progressive (2025-2027) |
| Supervisory authority | Data protection authorities | National authorities + European AI Office |
The European legislator deliberately set AI Act penalties above those of the GDPR. The message is clear: risks associated with poorly managed AI are considered at least as serious as those related to data protection — and businesses will be penalised accordingly.
As a reminder, GDPR penalties have not remained theoretical. In 2023, Meta received a EUR 1.2 billion fine from the Irish authority. Amazon was fined EUR 746 million in Luxembourg in 2021. The ICO in the United Kingdom has also levied significant fines under the UK GDPR. European authorities have shown that they do not hesitate to apply maximum penalties to major corporations.
The regulation provides for adapted treatment for small businesses. Article 99(6) specifies that fines must be “effective, proportionate and dissuasive”. For SMEs and start-ups, authorities must take account of the business’s economic viability.
In practice:
Each Member State must designate one or more national competent authorities responsible for market surveillance and enforcement of the regulation.
Across the EU:
In the United Kingdom, although the AI Act does not apply domestically, UK organisations serving the EU market must comply. Enforcement coordination domestically involves the ICO (Information Commissioner’s Office) for data-related AI matters, the FCA (Financial Conduct Authority) for AI in financial services, the MHRA for AI medical devices, and the UK AI Safety Institute for frontier model oversight. HMRC automated decision-making systems are also under increasing regulatory scrutiny.
Established within the European Commission, the European AI Office plays a coordinating role and has direct powers over general-purpose AI models. It can:
Beyond fines, the AI Act mechanism rests on a fundamental principle: the burden of proof lies with the business. It is not for the authority to demonstrate that you are non-compliant — it is for you to demonstrate that you are compliant.
A measurable and traceable literacy score for each staff member constitutes particularly strong evidence for Article 4 compliance. Similarly, a complete record of completed training, with dates, content and results, allows you to prove compliance objectively.
In the event of an inspection, the most unfavourable situation is not having an imperfect compliance programme — it is having none at all. Authorities will take account of the efforts made by the business. Having initiated a structured approach, even an incomplete one, is always preferable to total inaction.
📄AI audit in your organisation: a practical step-by-step guide→Penalties apply progressively, in line with the entry into force of the various obligations:
| Date | Obligations in force | Applicable penalties |
|---|---|---|
| 1 February 2025 | Prohibited practices (Article 5) | Up to EUR 35 million / 7% |
| 2 August 2025 | AI literacy (Article 4) + General-purpose models | Up to EUR 15 million / 3% |
| 2 August 2026 | High-risk AI systems | Up to EUR 15 million / 3% |
| 2 August 2027 | High-risk systems integrated into regulated products | Up to EUR 15 million / 3% |
The first two deadlines have already passed. Businesses that have not yet taken action on prohibited practices and AI literacy are already in the risk zone.
Financial penalties are only the visible part. Non-compliance with the AI Act exposes businesses to other equally significant risks:
Ce que ça implique pour vous
The AI Act introduces the heaviest penalties in European digital law: EUR 35 million or 7% of worldwide turnover for prohibited practices, EUR 15 million for high-risk systems and failure to train staff. The key to minimising risk: prove compliance through rigorous documentation, tracked training and measurable assessments. The first deadlines have already passed — every day without action increases exposure.