In short: EU AI Act fines come in three levels. Banned AI practices can cost up to 35 million euros or 7% of worldwide yearly turnover. Breaking most other duties costs up to 15 million euros or 3%. Giving authorities wrong information costs up to 7.5 million euros or 1%. Smaller companies pay the lower of the two amounts.
You bring in AI to grow, serve customers better and get more done with the same team. Fines aren’t the reason to use AI well, but they help you see where the law puts its weight. Knowing how EU AI Act fines work tells you which duties to sort out first. It also shows why being able to prove what your AI does matters as much as the rules themselves.
How high are EU AI Act fines?
The EU AI Act sets three levels of fines in Article 99. Each level has a fixed amount and a share of total worldwide yearly turnover. For large companies, the higher of the two applies. The top level is for AI practices the law bans outright, such as social scoring. The middle level covers most other duties. Examples are the rules for high-risk AI, or the duty to tell people they’re talking to an AI. The lowest level is for giving false or misleading facts to authorities. These are maximums. National authorities set the real amount case by case. Each EU country also sets its own rules for how it enforces them.
| Breach | Maximum fine |
|---|---|
| Banned AI practices | 35 million euros or 7% of worldwide yearly turnover |
| Most other duties, including high-risk and transparency rules | 15 million euros or 3% |
| Wrong or misleading information to authorities | 7.5 million euros or 1% |
Who can get a fine under the EU AI Act?
Fines can hit any company with a role under the law, not only the company that built the AI. That includes providers, who offer an AI system under their own name. It also includes deployers, who use an AI system in their work, and importers and distributors. Say you buy an AI tool and use it for a high-risk task. Then you have your own duties, and you can be fined for missing them. The vendor’s promises don’t cover your part. The law also reaches companies outside the EU when their AI is used in the EU.
Makers of general-purpose AI models, the large models many apps are built on, face a separate set of fines. The European Commission sets those under Article 101, up to 15 million euros or 3% of turnover. For most companies that build on such a model, the national fines in Article 99 are the ones that matter.
Do smaller companies pay less?
Yes. For small and medium-sized companies, including start-ups, each fine is capped at the lower of the two amounts, not the higher. For a company with 10 million euros in yearly turnover, 3% is 300,000 euros. That’s far below 15 million, so the lower amount is the cap. It’s still a real cost for a small firm, and it comes on top of the work to fix the problem. In November 2025, the European Commission proposed changes to the AI Act in its Digital Omnibus. These included extending some of the lighter treatment to slightly larger companies. Check the Commission’s AI Act page for the rules that apply today.
What decides how big a fine is?
Authorities must weigh the full picture before they set an amount, so two similar breaches can end in very different fines. Article 99 lists the points they look at. Several of them are in your own hands.
- How serious the breach was, how long it lasted and how many people it affected.
- Whether it was on purpose or through carelessness.
- What you did to limit the damage once you knew.
- How well you worked with the authority, and whether you reported the problem yourself.
- Whether you were fined before for something similar.
- The size, turnover and market share of your company.
Look at that list again and you’ll see a pattern. A company that tests its AI, keeps records and fixes problems quickly scores better on almost every point. A company that can’t show what its AI did is in a weak spot, even when the breach itself was small.
When do the fines apply?
The rules on fines have applied since 2 August 2025, according to Article 113. But a fine can only follow a duty that already applies. The bans on certain AI practices have applied since February 2025, so fines for those can be given now. The main duties for high-risk AI were set for 2 August 2026 in the original text. The Digital Omnibus proposed to push some of those dates back. Fines are not the only risk either. Authorities can order you to fix an AI system, take it off the market or recall it. And if your AI handles personal data, the GDPR applies as well, with its own fines of up to 20 million euros or 4%.
What this means for your team
Start by knowing where you stand. Check which EU AI Act risk category each of your AI systems falls under. Make sure no system comes near a banned practice. Then work through the duties for your high-risk systems, starting with the one that reaches the most people. Our advice: start keeping evidence now, not when an authority asks. Records built up over months are what show care and good faith.
That evidence is where many teams get stuck, because AI behaviour changes over time. VeritasAI’s PRO plan runs automated weekly tests mapped to the EU AI Act, ISO 42001, OWASP and NIST standards. Every run keeps the exact responses your model gave, so you can show what it did and when. It won’t guarantee you’re compliant, but it gives you the facts to act on before someone else finds the problem.
Know what your AI does each week, with the records to prove it.
Frequently asked questions
What is the maximum fine under the EU AI Act?
The highest fine is 35 million euros or 7% of total worldwide yearly turnover, whichever is higher. It applies to AI practices the law bans outright. Smaller companies pay the lower of the two.
Can a company be fined for using an AI tool it bought?
Yes. A company that uses an AI system is a deployer, with its own duties, especially for high-risk use. Missing those duties can lead to a fine, whatever the vendor promised.
Who enforces the EU AI Act?
Each EU country names national authorities to supervise the market and give fines. The European Commission, through its AI Office, supervises general-purpose AI models.
Do EU AI Act fines replace GDPR fines?
No. They are separate laws. One AI system can break both, and authorities can act under each of them.
