What Penalties Apply Under Article 99?

How are penalty rules set?

Article 99 does not itself impose a fine on any operator. It requires each Member State to lay down rules on penalties for infringements, to take all measures necessary to ensure they are implemented, and to notify those rules to the Commission. Member States had to adopt their penalty rules as part of the governance work that applied from 2 August 2025, and the rules must provide for penalties that are effective, proportionate and dissuasive. That structure means the penalty exposure of an operator depends on two layers: the ceilings fixed by the Regulation, and the national rules that set the penalty framework, the procedure and the decision-maker in the Member State concerned. An organisation should therefore confirm the national penalty rules for each Member State in which it operates, and should not assume that the Regulation's ceilings are the penalty that would be imposed. The ceilings are maxima, and the amount in a case is shaped by the factors in Article 99 and by national law.

What is the highest tier for prohibited practices?

The highest tier applies to non-compliance with the prohibitions in Article 5. For an undertaking, the maximum administrative fine is 35,000,000 euro or, if higher, 7 percent of its total worldwide annual turnover for the preceding financial year. That tier reflects the seriousness the Act attaches to prohibited practices: systems that must not be placed on the market or put into service at all, or must not be used, in the circumstances the prohibition describes. The tier applies to the infringement of the prohibition itself, and it should not be applied to other breaches by analogy. A team that quotes the 35,000,000 euro or 7 percent figure for a high-risk or transparency breach is misreading Article 99, and a compliance file that does so will misstate exposure. The correct tier for a given infringement must be identified from the provision infringed, and the figure should be cited with its Article 99 paragraph and with the national rules that implement it.

For the broader regulatory framework, see enforcement and market surveillance.

What is the tier for most other obligations?

Non-compliance with most other obligations in the Act, including the obligations of providers, deployers, importers, distributors and authorised representatives, the high-risk requirements and the Article 50 transparency obligations, carries a maximum administrative fine of 15,000,000 euro or, if higher, 3 percent of total worldwide annual turnover for the preceding financial year, for an undertaking. That tier covers a wide range of duties, from risk management and documentation to registration, oversight and disclosure, and its breadth is why a single compliance failure can carry significant financial exposure even where no prohibited practice is involved. The tier is a maximum, not a tariff: the amount in a case depends on the factors Article 99 lists, including the nature, gravity and duration of the infringement, the number of people affected, the cooperation of the operator and any previous infringements. A team should therefore assess exposure by the provision, the facts and the national framework, not by the ceiling alone.

What is the tier for incorrect information?

Supplying incorrect, incomplete or misleading information to notified bodies or to national competent authorities, including in response to a request for information, carries a maximum administrative fine of 7,500,000 euro or, if higher, 1 percent of total worldwide annual turnover for the preceding financial year, for an undertaking. That tier addresses the integrity of supervision itself: an authority that cannot rely on the information it receives cannot evaluate a system, and the Act treats misleading an authority as a distinct infringement with its own ceiling. The practical consequence is that every response to an authority, a notified body or a registration entry should be checked for accuracy and completeness before it is sent, and corrections should be made promptly when an error is found. A deliberate misstatement, a material omission and a careless inaccuracy can all engage the provision, and the record should show that information was verified, not merely asserted.

How are SMEs and start-ups treated?

Article 99 provides that, for small and medium-sized enterprises, including start-ups, the maximum fines in the three tiers are the lower of the fixed sum and the percentage of turnover, rather than the higher. That lower-of rule softens the impact of the ceilings on smaller operators, whose turnover may be low relative to the fixed sums, and it reflects the proportionality requirement that runs through the penalty regime. Regulation (EU) 2026/1744 extended simplified treatment in defined respects to small mid-caps, and the current position for small mid-caps, including any penalty treatment, should be checked in the consolidated text rather than assumed from a summary. Member States must also take the interests of SMEs, including start-ups, and their economic viability into account when setting penalty rules. A smaller operator should therefore not assume it is exempt from penalties, and should not assume the lower-of rule removes exposure: it caps the maximum differently, and the amount in a case still depends on the infringement and the national framework.

Continue with fines for general-purpose AI providers under Article 101.

What does this guide not decide?

This guide does not state the penalty that would be imposed for any particular infringement, does not describe any Member State's penalty rules, and does not advise on whether a given set of facts amounts to an infringement. Penalty amounts depend on the provision, the facts, the factors in Article 99, the national rules and the decision of the competent authority, and they require the consolidated text and the national law to be applied to the specific case. The guide also does not cover criminal penalties, which Member States may provide for under national law, or penalties under other regimes that can run in parallel. Where penalty exposure is in issue, confirm the national rules and the current consolidated text with a legal adviser, and keep the records that show how the position was assessed.

Frequently asked questions

Continue through this AI Act cluster

• enforcement and market surveillance
• fines for general-purpose AI providers under Article 101
• the market surveillance procedure under Article 74
• corrective actions, restrictions and withdrawals
• SMEs, startups and open source
• prohibited practices under Article 5