EU AI Act penalties can be significant, but fear is a poor compliance architecture. The defensible sequence is to identify the real AI system and operator role, determine the applicable obligation, preserve the evidence, disclose gaps and maintain the record as facts change.
Current consolidated Article 99 provides penalty tiers including up to €35 million / 7% for Article 5 prohibited-practice violations, up to €15 million / 3% for specified operator and notified-body duties, and up to €7.5 million / 1% for certain incorrect, incomplete or misleading information. Actual enforcement and fine amounts depend on the Regulation and case circumstances.
Start with the actual system, role, use case and evidence boundary. The same regulation can produce different obligations for different actors and systems.
Article 99(3) sets the highest general tier for non-compliance with Article 5 prohibited AI practices: up to €35 million or, for an undertaking, up to 7% of worldwide annual turnover for the preceding financial year, whichever is higher.
Article 99(4) sets a tier of up to €15 million or 3% of worldwide annual turnover for specified obligations including provider, authorised-representative, importer, distributor, deployer, notified-body and Article 50 transparency duties.
Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request can reach €7.5 million or 1% of worldwide annual turnover for an undertaking.
For SMEs, including start-ups, Article 99(6) states that each fine in paragraphs 3–5 is up to the percentage or fixed amount specified there, whichever is lower. The actual penalty also depends on the circumstances considered under Article 99.
The goal is not merely to reach an answer. It is to preserve what facts, evidence, scope and limitations supported that answer at that time.
Start by identifying the actual AI system, operator role, use, classification and applicable provision. A headline penalty does not prove that a particular obligation applies.
Connect the relevant requirement to current documentation, controls, logs, accountable actors and source text so the organization can show what position it took and why.
Where evidence or controls are missing, record the gap, responsible owner, remediation and chronology rather than relying on a retrospective assertion that the organization was compliant.
A changed system, use, model, operator role, legal source or enforcement fact can alter the prior position. Preserve the old basis and establish a new current record.
Choose the smallest operating tier that fits the portfolio today. Upgrade when system count, team size or governance scope actually requires it.
Keep a living system-level evidence record with obligations, gaps, versions and revalidation state.
START EVIDENCE PASSPORT →Coordinate evidence, owners, documentation, incidents and team compliance work in one governed workspace.
START COMPLIANCE WORKSPACE →Operate broader high-risk, GPAI, FRIA, post-market and material-change governance across a growing portfolio.
START GOVERNANCE PRO →Run institutional governance with expanded users, authority workflows, examiner rooms and portfolio reporting.
START INSTITUTION →Use the free classifier to establish the system, intended purpose, possible actor role, EU exposure and unresolved facts. When continuing evidence infrastructure is needed, paid access begins at $19 per month. Independent human readiness review remains a separate service.
Under current Article 99(3), non-compliance with Article 5 prohibited AI practices can be subject to administrative fines up to €35 million or, for an undertaking, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher.
No. Article 99 contains different tiers and enforcement circumstances. The 7% / €35 million tier concerns Article 5 prohibited practices. Listed operator and notified-body obligations have a separate €15 million / 3% tier, and misleading information has another tier.
Article 99(4) covers specified duties including provider Article 16, authorised representative Article 22, importer Article 23, distributor Article 24, specified Article 25 duties, deployer Article 26, notified-body requirements and Article 50 transparency obligations.
Article 99(6) provides that for SMEs, including start-ups, the fine ceilings in paragraphs 3–5 use the percentage or fixed amount stated there, whichever is lower. Article 99 also requires consideration of relevant circumstances when determining whether and how much to fine.
No. Enforcement belongs to competent authorities and depends on the facts and applicable law. TA-14 can help establish the system, role, obligation map, evidence state, gaps, provenance and corrective-action record so the organization is not operating from an untraceable assumption.
Article 101 contains a separate Commission fine framework for providers of general-purpose AI models, including a ceiling based on worldwide turnover or a fixed euro amount. The applicable enforcement route should be checked against the current consolidated Regulation.
TA-14 Exchange Activity
Live cumulative activity recorded across the public Exchange surface.
···
Visitors
Recorded public visitors
···
Page Views
Recorded Exchange views