EU AI Act penalties for companies: the fines, sized and dated.

• 1.1

  Tier one — breach the bans. €35 million or 7%, whichever is higher.

  Violating Article 5's prohibited practices exposes an undertaking to administrative fines of up to €35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)). This is the tier that beats GDPR's headline, and the bans have applied to users as well as builders since 2 February 2025 — building a banned tool and buying one sit in the same tier.

• 1.2

  Tier two — breach most other obligations. €15 million or 3%, whichever is higher.

  Up to €15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)). The tier covers most of the Act's obligations — the verified examples are provider duties under Article 16, high-risk deployer duties under Article 26, and the transparency duties under Article 50. Transparency is the newest of the three: live since 2 August 2026, and it lands on the workflows most companies already run. For a company whose staff use AI tools, this is the tier the daily work actually touches.

• 1.3

  Tier three — mislead the authorities. €7.5 million or 1%, whichever is higher.

  Supplying incorrect, incomplete or misleading information to notified bodies or authorities costs up to €7.5 million or 1% of total worldwide annual turnover, whichever is higher (Article 99(5)). The smallest tier and the most avoidable: answer authority requests accurately, and keep the records that make your answers checkable.

• 1.4

  The fourth regime — enforced from Brussels.

  Providers of general-purpose AI models answer to the Commission directly, with fines of up to €15 million or 3% of annual worldwide turnover, whichever is higher (Article 101), with Commission enforcement active from 2 August 2026. Most companies will never meet this regime — it binds model providers, not the businesses deploying tools. It is on the map because “who fines whom” is part of sizing the risk.

All four figures are ceilings, not tariffs — member-state rules must make penalties effective, proportionate and dissuasive, and the cap is the worst case, not the quote.

• 2.1

  The bans — tier-one exposure, since 2 February 2025.

  Article 5 breaches are the top-tier kind, and the bans bind deployers as much as providers. The closest-to-home trap for a 50–500 person company is emotion inference in the workplace — an HR tool or people-analytics script inferring feelings from staff. A banned practice cannot be papered over; it has to stop.

• 2.2

  Transparency — tier-two exposure, since 2 August 2026.

  Article 50 duties sit squarely in the €15 million tier. On the deployer side: disclose deepfakes you publish, and disclose AI-generated text published to inform the public on matters of public interest — human-reviewed editorial content (with a natural person holding editorial responsibility) is exempt outright, and evidently artistic, creative, satirical or fictional work owes a lighter-touch disclosure, not zero. That lands on the marketing team's workflow, not on legal's abstraction. Provider-side duties — chatbot disclosure and machine-readable marking — attach if you ship your own bot.

• 2.3

  The other live obligations — and the record that defends you.

  Member-state penalty regimes cover infringements of the whole Regulation, not just the headline duties. The literacy duty under Article 4 has been live since 2 February 2025; skipping it is an infringement like any other, and which cap it lands under is a question no company should need answered — the duty costs less to satisfy than any fine is to dispute. Write the inventory, run the ban screen, keep the training records: the file is the defense.

• 3.1

  The high-risk fines moved, twice.

  Regulation (EU) 2026/1744 was adopted by Parliament on 16 June 2026, by Council on 29 June 2026, published in the Official Journal on 24 July 2026, and in force from 27 July 2026. It pushed the standalone high-risk package (Annex III — recruitment screening, credit scoring, insurance pricing, education, biometrics) to 2 December 2027 and product-embedded high-risk (Annex I) to 2 August 2028. Until those dates, the high-risk obligations are not applicable, so their paperwork cannot be a fineable breach.

• 3.2

  The tiers did not change — the dates under them did.

  The Omnibus left every cap untouched; what it moved is the high-risk regime to 2 December 2027 and 2 August 2028. That makes penalty guidance unusually easy to go stale on: a page written before 24 July 2026 can quote all three tiers correctly and still carry the pre-Omnibus assumption that high-risk obligations arrive in 2026. Dated, calendar-anchored sources beat evergreen ones here — check any penalty guidance against Regulation (EU) 2026/1744 before you size a budget off its fear.

• 3.3

  What did not move.

  Article 4 and Article 5 kept their 2 February 2025 date. Article 50 kept 2 August 2026. The penalty regimes kept 2 August 2025. The live exposure has been live for months — which is why the cheap-to-close list and the fineable list are the same list.

• 4.1

  The general formula.

  For undertakings generally, each cap is the amount or the percentage, whichever is higher. That is how the €35 million figure is real arithmetic for a multinational — and why adopting it as a working assumption for a 200-person company is how vendors sell panic.

• 4.2

  The SME inversion.

  For SMEs and start-ups, Article 99(6) flips the formula: each fine is capped at the lower of the amount or the percentage. Worked example — an SME with €10 million in worldwide annual turnover: the tier-one cap is not €35 million, it is 7% of €10 million — €700,000. The tier-two cap is 3% — €300,000. Authorities must additionally weigh the interests of SMEs, including start-ups, and their economic viability. That is the number to put in the risk register, and it sits more than an order of magnitude below the headline.

• 4.3

  The new mid-cap band.

  The Omnibus extended SME-style relief — simplified documentation, sandbox priority, tailored penalty caps — to a new small mid-cap category: fewer than 750 employees and up to €150 million annual turnover (or ≤€129 million balance-sheet total). If your company sits between the SME definitions and the multinationals, check whether the band catches you before assuming the headline caps.

• 4.4

  The fine is not the whole cost.

  A banned practice has to stop — the tool goes, mid-workflow. Corrective orders, re-papering and disclosure duties carry weeks, not euros. One industry expert's year-one prediction, reported by Help Net Security: corrective orders will outnumber headline fines. Build the file before you need it.

The full duty-and-deadline picture behind these numbers — what is live, what moved, and what an SME doesn't have to buy — is the EU AI Act compliance checklist for SMEs.