The EU AI Act backs its rules with some of the largest fines in technology regulation — deliberately, to make compliance a board-level issue. This guide breaks down the penalty structure, who enforces it, and how to reduce your exposure. Part of our guide to the EU AI Act.
The Act sets three tiers of maximum fines, each the higher of a fixed amount or a percentage of worldwide annual turnover:
For SMEs and startups, the fine is the lower of the fixed amount or the percentage, to keep penalties proportionate.
Enforcement is shared: national market-surveillance authorities in each member state oversee most systems, while the European AI Office supervises general-purpose AI models. Authorities can investigate, conduct inspections, demand documentation, require corrective action, and impose fines. Penalties consider the nature and gravity of the breach, whether it was intentional, and any mitigating action.
Like the GDPR, the Act ties its top fines to a percentage of global turnover — so the real exposure scales with company size, and for a large multinational the 7% figure dwarfs the €35 million headline. It's designed so that compliance is cheaper than the risk of ignoring it.
The EU AI Act's top tier (7% of turnover) is actually higher than the GDPR's (4%), reflecting how seriously the EU treats prohibited AI. Many organisations will be subject to both regimes at once, since AI systems usually process personal data.
Which tier a system falls into starts with its classification — see EU AI Act risk categories.
AramGRC helps you close the gaps that lead to the largest fines — classification, high-risk conformity and documentation — with an EU AI Act readiness audit. See EU AI Act compliance.
Up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for other breaches, and up to €7.5 million or 1% for supplying incorrect information — each the higher of the amount or percentage (the lower, for SMEs).
€35 million or 7% of total worldwide annual turnover, whichever is higher, for engaging in prohibited AI practices.
Yes — the top fines are the higher of a fixed amount or a percentage of global annual turnover, so exposure scales with company size (SMEs pay the lower of the two).
National market-surveillance authorities enforce most systems, and the European AI Office supervises general-purpose AI models. They can investigate, inspect and impose fines.
What the EU AI Act is, the risk categories, obligations, timeline and penalties.
A step-by-step guide and checklist to comply with the EU AI Act.
The four risk tiers, prohibited practices and high-risk AI systems.
What providers and deployers of high-risk AI must do.
The phased dates — and what the 2026 Digital Omnibus changed.
Fines up to €35M or 7% of global turnover — the full structure.
You're here
AI compliance across the EU AI Act, ISO 42001, NIST AI RMF and India's DPDP.