The EU AI Act creates a graduated fine structure, with the largest penalties reserved for the most serious violations. Fines apply per infringement and are determined by national enforcement authorities following national procedural rules. Understanding the tiers and what triggers them is essential for any compliance risk assessment.
The three fine tiers
| Tier | Maximum fine | What triggers it |
|---|---|---|
| Tier 1 (highest) | EUR 35M or 7% global turnover | Violations of Article 5: deploying a prohibited AI practice in the EU. Applies to banned uses such as social scoring, subliminal manipulation, or real-time biometric identification by law enforcement without a lawful exception. |
| Tier 2 | EUR 15M or 3% global turnover | Violations of most other provisions: failure to meet high-risk AI obligations, GPAI model requirements, transparency duties, or obligations on deployers and providers. This is the tier that applies to most compliance failures. |
| Tier 3 (lowest) | EUR 7.5M or 1.5% global turnover | Supplying incorrect, incomplete, or misleading information to national competent authorities or notified bodies in the context of an investigation or conformity assessment. |
In each case, the fine is the higher of the absolute amount or the percentage of global annual turnover. For a company with EUR 500 million in global revenue, a Tier 1 violation could attract a fine of up to EUR 35 million (7% of EUR 500M = EUR 35M, so the cap is EUR 35M). For a company with EUR 1 billion in global revenue, the same violation would attract a maximum of EUR 70 million (the 7% figure exceeds the absolute EUR 35M cap, so the percentage applies).
Who enforces the EU AI Act
Enforcement operates at two levels:
- European AI Office: responsible for overseeing GPAI model providers at EU level, conducting investigations, and coordinating with national authorities. Can recommend fines to the Commission.
- National market surveillance authorities: each EU member state must designate a national competent authority responsible for enforcing the Act within their territory for all AI systems other than GPAI models. In practice, enforcement will be shaped by how aggressive each member state's regulator is, similar to the experience with GDPR enforcement.
For companies with operations in multiple EU member states, enforcement jurisdiction follows where the provider is established or, for non-EU companies, where the EU representative is designated. This means a US company with EU customers may face enforcement by the authority in the member state where its EU representative is located.
Factors that affect fine size
The Act directs enforcement authorities to consider several factors when setting fines within the permitted range:
- The nature, gravity, and duration of the infringement
- Whether the violation was intentional or negligent
- Actions taken by the provider or deployer to mitigate harm
- Degree of responsibility, including technical and organizational measures taken
- Any relevant previous violations
- Degree of cooperation with the authority
- The size and market share of the company (relevant for SME mitigation)
Member states may set lower maximum fines for SMEs and startups. The Act explicitly encourages proportionality for smaller operators, but it does not create a blanket exemption.
How to reduce your fine exposure
The most effective way to reduce fine exposure is straightforward: comply before the deadline. But for companies still in their compliance process, a few risk-reduction strategies are worth noting:
- Document everything. Authorities consider the measures you took before and after a violation. A well-documented compliance process, even an incomplete one, demonstrates good faith.
- Self-report issues proactively. Voluntarily reporting a discovered non-compliance to the relevant authority, before a complaint or investigation, is a strong mitigating factor in most regulatory frameworks.
- Fix issues fast. The duration of an infringement is a factor in fine-setting. Identifying and remediating a problem quickly limits exposure on the duration dimension.
- Cooperate with authorities. Non-cooperation is an aggravating factor. Cooperating fully and promptly with any authority inquiry is both the right thing to do and the strategically sensible one.
The cheapest non-compliance event is the one you prevent. Better Societies delivers a 6-week compliance engagement that systematically closes gaps before they become fines. Start your assessment.