Article 99 sets three fine tiers. Prohibited practices can draw up to 35 million euros or 7 percent of worldwide annual turnover. Most other operator obligations carry up to 15 million or 3 percent. Giving incorrect information to authorities carries up to 7.5 million or 1 percent. For companies the higher figure applies, and for SMEs the lower.
The tiers
From the text of Article 99:
- Article 99(3), prohibited AI practices: up to EUR 35,000,000 or, for an undertaking, up to 7 percent of total worldwide annual turnover for the preceding financial year, whichever is higher.
- Article 99(4), other obligations of providers, deployers, importers, distributors and notified bodies, including Article 50 transparency duties: up to EUR 15,000,000 or up to 3 percent, whichever is higher.
- Article 99(5), supplying incorrect, incomplete or misleading information to notified bodies or national authorities: up to EUR 7,500,000 or up to 1 percent, whichever is higher.
The SME rule
Article 99(6) reverses the comparison for SMEs, including start-ups. Their fine is up to the percentage or the amount, whichever is lower. A small firm facing the top tier would be capped at the smaller of 7 percent of turnover and 35 million euros, which for a small company is almost always the percentage.
What the numbers do not tell you
These are maximums. The actual penalty depends on factors national authorities weigh, and each Member State lays down its own penalty rules within the Act's framework. We did not review the penalty factors list, so do not read the caps as typical outcomes.
Penalties for general-purpose AI model providers sit in a different article, which we also did not review. Check the Act directly if that is your role.
Which duties sit in which tier
Rough map, to be confirmed against the text:
- Tier one: anything on the Article 5 prohibited list.
- Tier two: high-risk provider and deployer duties, transparency duties, importer and distributor duties.
- Tier three: misleading answers to regulators or notified bodies.
The third tier is worth noticing. A careless response to an authority request is its own exposure. Keep your documentation accurate and your answers consistent with it.
Budgeting for it without panic
Fines are the least useful lens for planning. Better questions: Which of our systems could touch a prohibited practice? Which are in Annex III? Could we answer an authority request from our records within days? Evidence that exists and is accurate protects you more than any ceiling analysis.
One more point on proportion: reputational and commercial effects often arrive before any fine. Buyers can ask for your classification notes and incident procedures long before an authority does. That is another reason to keep records tidy, dated and owned by a named person.
Quick check
Is 7 percent the standard AI Act fine?
No. It is the ceiling for prohibited practices. Most other obligations top out at 3 percent, and incorrect information at 1 percent.
Do SMEs get smaller fines?
The cap for SMEs is the lower of the percentage and the fixed amount, instead of the higher.
Sources
- AI Act Article 99, penalties (an unofficial reader; confirm wording against the Official Journal)
Last reviewed: 19 October 2026.
