EU AI Act fines: the complete penalty guide

The EU AI Act borrows GDPR’s enforcement design and raises the ceiling. Article 99 sets three penalty tiers, each expressed as a fixed amount or a share of worldwide annual turnover — whichever is higher. Since 2 August 2026 the tiers are live for Annex III high-risk systems, which moves AI compliance from a policy discussion to a board-level number.

The three tiers

How authorities size a fine

Article 99 requires proportionality: the nature, gravity and duration of the infringement, whether it was intentional or negligent, actions taken to mitigate, degree of cooperation, and prior findings all count. Two practical consequences follow. First, a documented compliance effort is itself mitigation — an inventory, dated classifications and a remediation plan materially change how an authority reads you. Second, obstruction is its own tier: answering an information request badly can cost €7.5M / 1% on top of the underlying issue.

Where exposure actually concentrates

• Unclassified inventories.You cannot show an authority your posture if you don’t know which of your systems are high-risk in the first place. This is the cheapest gap to close and the worst one to be caught with.
• Missing Annex IV documentation — the first document requested, and a per-system provider breach if absent. See the Annex IV guide.
• Deployer blindness.Companies using vendor AI for hiring or credit assume the fine risk is the vendor’s. Article 26 breaches sit in the €15M / 3% tier and attach to the deployer.
• Silent Article 50 gaps — undisclosed chatbots and unmarked synthetic content: trivial to fix, embarrassing to be fined for.

The rational response to a penalty regime this asymmetric is not panic-buying a consultancy engagement — it is producing, this month, the paper trail that turns any future authority conversation into a short one: inventory, classification, gap report, remediation plan, documentation. That is exactly the sequence the compliance checklist walks through.