Penalties and enforcement under the AI Act
The Act has teeth: fines that scale with global turnover. Here is the structure of the penalties, who enforces them, and the proportionality built in for smaller companies.
The fine tiers
The Act sets three broad tiers. The heaviest, for prohibited practices under Article 5, reaches up to 35 million euros or 7% of total worldwide annual turnover. Breaches of most other obligations reach up to 15 million euros or 3%. Supplying incorrect, incomplete, or misleading information to authorities reaches up to 7.5 million euros or 1%.
For companies, the figure used is generally the higher of the fixed amount or the percentage of turnover.
Proportionality for SMEs and startups
The Act recognises that the same fine lands very differently on a multinational and a small business. For SMEs and startups, the cap is the lower of the fixed amount or the percentage, and authorities are told to take the size and viability of the business into account.
The point is to make compliance achievable for small businesses, not to bankrupt them for honest mistakes.
Who enforces it
Enforcement is mainly national: each member state designates market surveillance authorities that supervise, investigate, and can fine. At the EU level, the AI Office oversees general-purpose AI, and the European Artificial Intelligence Board coordinates so the rules are applied consistently across countries.
For an ordinary business, that means the regulator you would actually hear from is national, in the country where you operate. Knowing which body that is, is part of being ready.
When enforcement bites
The penalties follow the phased timeline. The prohibitions and the literacy duty have applied since February 2025, general-purpose AI obligations since August 2025, and the core high-risk obligations from December 2027. Enforcement ramps up as each set of duties takes effect.
In practice, full enforcement of the high-risk duties tracks the December 2027 date, which the 2026 Digital Omnibus moved back from August 2026. That makes the time before it the window to get your house in order, rather than a grace period to ignore.
What reduces your exposure
An organised, honest compliance posture is the best protection: a current inventory, classifications a person has reviewed, the documents the Act asks for, and an audit trail of what you did and when. It shows good faith and makes any question quick to answer.
How any penalty applies in a specific case is for the authorities and qualified counsel. This is general information, not legal advice.
This guide is general educational information, not legal advice. For how the Act applies to your organisation, classify your systems and consult qualified counsel.
Put it into practice
Classify your AI systems against the Act and generate the documents this guide describes.