EU AI Act Penalties and Enforcement Explained

EU AI Act penalties are tiered: up to EUR 35 million or 7% of global annual turnover for prohibited practices, up to EUR 15 million or 3% for most other breaches including transparency obligations, and up to EUR 7.5 million or 1% for supplying incorrect or misleading information to authorities.

The three fine bands

The highest band covers prohibited AI practices. The middle band covers most other operator obligations, which is where transparency and marking duties sit. The lowest band covers incorrect, incomplete or misleading information given to notified bodies or national authorities. Each band is expressed as the higher of a fixed amount or a percentage of worldwide annual turnover, with lower caps for SMEs and start-ups.

Who enforces

National market surveillance authorities handle enforcement in each Member State, with the AI Office coordinating at Union level and supervising general-purpose AI models directly. Existing sectoral regulators keep their powers where AI sits inside a regulated product. For a publisher, the practical implication is that the first contact is usually a national authority asking documented questions.

What an investigation looks for

Not intent — evidence. Was a disclosure made, when, by whom, and can it be checked independently? Was marking applied at publication, or reconstructed after the complaint arrived? Records created after the fact are the weakest possible position. Records that were time-anchored at publication and are checkable by a third party are the strongest.

Mitigating factors

Authorities weigh the nature and gravity of the infringement, whether it was intentional or negligent, actions taken to mitigate harm, cooperation, and whether the operator had systems in place beforehand. A demonstrable, pre-existing transparency process is the difference between a governance gap and a governance failure.

How to lower exposure

Make disclosure part of the publishing pipeline rather than a manual step. Keep evidence outside the system that produced the content, so the record and the claim do not share a single point of failure. And keep declarations narrow and accurate — overclaiming creates its own liability. A declaration you can prove you made at the time is worth more than any retrospective analysis.

Frequently asked questions

What is the maximum fine under the EU AI Act?

Up to EUR 35 million or 7% of global annual turnover, whichever is higher, for engaging in prohibited AI practices.

What is the fine for breaching transparency obligations?

Transparency duties fall in the middle band: up to EUR 15 million or 3% of global annual turnover, whichever is higher.

Are there lower caps for small companies?

Yes. For SMEs and start-ups the applicable cap is the lower of the fixed amount or the percentage, rather than the higher.

Can non-EU companies be fined?

Yes, where their AI systems or outputs are placed on the EU market or affect people in the EU.

Build evidence before you need it

See what an independently checkable disclosure record looks like.