EU AI Act Fines Explained: What a €35 Million Penalty Looks Like

# The Numbers Are Real, and They Apply to You

With EU AI Act fines explained in plain terms, the picture becomes less abstract and more urgent. Article 99 of the AI Act sets out four distinct penalty tiers, and the highest — €35 million or 7% of annual global turnover, whichever is greater — sits above the GDPR maximum of €20 million. For a Dutch manufacturer with €80 million in global revenue, 7% means €5.6 million. That is a real number, not a worst-case fantasy reserved for Big Tech.

The regulation entered into force on 1 August 2024. The first provisions — covering prohibited AI practices — became enforceable on 2 February 2025. The majority of obligations for high-risk AI providers and deployers apply from 2 August 2026. The clock is running.

# The Four Penalty Tiers Under Article 99

The fine schedule works like a ladder. Each rung corresponds to a category of violation.

Tier 1 — €35 million or 7% of turnover. This applies to breaches of the prohibited practices listed in Article 5. Prohibited systems include AI that uses subliminal techniques to manipulate behaviour, systems that exploit vulnerable groups, and real-time remote biometric identification in public spaces without lawful authorisation. Deploying any of these is the most serious breach the regulation recognises. See Article 5 of the AI Act for the full list.

Tier 2 — €15 million or 3% of turnover. This covers non-compliance with obligations for high-risk AI systems under Chapters III and IV, plus failures by general-purpose AI model providers. If your HR software uses an AI tool to screen CVs and you have not conducted a conformity assessment or registered the system in the EU database, this is the tier that applies to you. Article 99 sets this out directly.

Tier 3 — €7.5 million or 1.5% of turnover. This applies to supplying incorrect, incomplete, or misleading information to national authorities. Regulators view obstruction and inaccurate disclosure as a serious aggravating factor in their own right, so this tier can stack alongside a Tier 1 or Tier 2 penalty if the investigation reveals poor cooperation.

SME adjustment. Article 99(7) states that for SMEs and start-ups, the per-tier caps apply rather than the percentage of turnover calculation — but only where the cap produces a lower number. For a business with €5 million in global revenue, 7% is €350,000. The flat cap of €35 million does not apply here; the percentage does. Smaller companies are not automatically protected by the flat caps.

# GDPR Gives Us a Useful Benchmark

The AI Act is new, but GDPR enforcement history tells us how European regulators actually behave once a penalty framework is in place. The Irish Data Protection Commission fined Meta €1.2 billion in 2023. The Italian DPA fined ChatGPT operator OpenAI €15 million in early 2025 — under GDPR, not yet the AI Act. These are large companies, but the pattern matters: regulators move faster than most companies expect, they target recognisable products, and they use the full range of the penalty schedule.

For SMEs, the more instructive cases are the mid-sized ones. Several companies across the EU have received GDPR fines in the €200,000 to €2 million range for failures that were procedural rather than malicious: missing records of processing activities, no data protection impact assessment, inadequate supplier contracts. The AI Act creates an almost identical documentation and assessment architecture. The lesson from GDPR is that the paper trail is the first thing investigators look for.

# What Pushes a Fine Higher

National market surveillance authorities and the European AI Office do not flip a coin to pick a number inside the tier. Recital 161 of the AI Act identifies factors that can increase a penalty significantly.

Duration matters. A system that has been non-compliant for 18 months is treated differently from one discovered in its first week of deployment. Scope matters. A violation affecting thousands of job applicants across five Member States is more serious than one affecting a single internal process. Intent matters, though regulators do not need to prove deliberate wrongdoing. Negligence is sufficient.

Three specific aggravating factors are worth naming:

1. Failure to cooperate with the authority during investigation. This is the easiest mistake to avoid and the one that unnecessarily escalates penalties. Respond promptly, designate a named contact, and document every communication.
2. Previous violations. If your organisation has already received an AI Act or GDPR sanction, the authority treats that history as evidence of systemic non-compliance. A single prior finding can push a second penalty toward the top of its tier.
3. Concealing or destroying documentation. This converts a regulatory matter into something that looks deliberate. Authorities have explicit power under Article 74 to request access to training data, technical documentation, and logs.

# How an SME Defends Against an Investigation

The best defence is not a legal argument — it is a documented compliance posture that existed before any complaint arrived. Here is what that looks like in practice.

Know which category your AI systems fall into. The AI Act uses a risk-based framework. High-risk systems are listed in Annex III and include AI used in recruitment, access to education, creditworthiness assessment, and critical infrastructure. Annex III is the starting point for every SME audit. If you use an off-the-shelf HR tool that includes AI-driven candidate ranking, that tool almost certainly falls under Annex III and carries obligations for you as a deployer — not just for the vendor.

Build and keep a technical file. For high-risk systems, Article 11 requires a technical file covering the system's purpose, performance metrics, data governance, and human oversight mechanisms. This does not need to be hundreds of pages. For an SME, a structured 15-page document per system, reviewed annually, is defensible.

Appoint a responsible person. You do not need a dedicated AI compliance officer at 50 employees. But you do need someone whose name is on the documentation, who receives supplier AI-related updates, and who can speak to an authority if contacted. Ambiguity about internal responsibility is itself a red flag during investigations.

Run a fundamental rights impact assessment where required. Article 27 requires deployers of high-risk AI systems in public authority contexts to conduct this assessment before deployment. Many HR tools used by companies with public sector clients or processing employees of public bodies fall in scope. Article 27 sets out the minimum content.

Respond to requests within the statutory window. National authorities can issue information requests with response deadlines as short as 15 days. Missing a deadline is itself a Tier 3 violation. Set up an internal triage process now so that regulatory correspondence is never lost in a general inbox.

# The Mitigating Side of the Ledger

Authorities must also consider factors that reduce fines. Voluntary remediation, proactive disclosure, cooperation, and a demonstrated compliance programme all count. The GDPR track record shows that companies which self-report issues and fix them before an authority acts formally receive materially lower penalties — sometimes 50% to 70% lower than the initial assessment.

This is why the compliance programme matters even at 30 or 40 employees. It is not just about avoiding a fine. It is about controlling the outcome if something goes wrong despite your best efforts.

# One Action to Take This Week

Map every AI tool your organisation currently uses — bought, built, or embedded inside a SaaS platform — against the Annex III risk categories. Write it down. Date it. That single document is the foundation of every defence and every compliance programme that follows.

If you want a structured starting point, the free 2-minute compliance check at comply.khairos.ai gives you an initial read on where your organisation sits against the AI Act's key obligations — no legal background required.