EU AI Act Penalties: What European Companies Risk for Non-Compliance

1. Penalty Framework Overview

The EU AI Act (Regulation (EU) 2024/1689) establishes administrative fines in Article 99 and corrective measures in Article 98. The penalty framework is designed to be “effective, proportionate, and dissuasive” (Art. 99(1)) — the same legal standard used in GDPR, but with significantly higher caps.

The regulation uses a three-tier structure where the maximum fine depends on the nature of the violation. Each tier specifies both a fixed Euro amount and a percentage of the preceding financial year's total worldwide annual turnover, whichever is higher. For SMEs and startups, proportionate caps apply.

2. The Three-Tier Fine Structure

Article 99 establishes three tiers of administrative fines, each corresponding to different categories of violations:

3. How Fines Are Calculated

Article 99(7) specifies the criteria national authorities must consider when determining the specific amount of a fine within the applicable tier:

4. Enforcement Mechanism

The AI Act creates a multi-layered enforcement architecture:

4.1 EU Level: The AI Office

The European AI Office, established within the European Commission in February 2024, is responsible for: (1) direct supervision and enforcement of GPAI model obligations, (2) coordinating enforcement across member states, (3) developing standards and guidance, (4) managing the AI regulatory sandboxes framework, and (5) international cooperation on AI governance. The AI Office can impose fines directly on GPAI providers under Articles 101–102, with maximum fines of €15 million or 3% of global turnover for GPAI obligation violations.

4.2 National Level: Market Surveillance Authorities

Each member state must designate at least one market surveillance authority (MSA) and one notifying authority. MSAs have broad investigative powers under Article 74:

• Access to information — Request access to AI systems, source code, training data, technical documentation, and logs
• On-site inspections — Conduct unannounced inspections of premises where AI systems are developed, deployed, or stored
• Testing — Conduct or commission testing of AI systems to verify compliance
• Corrective measures — Require modification or withdrawal of non-compliant AI systems from the market
• Administrative fines — Impose fines within the three-tier framework
• Recall — Order the recall of AI systems that pose risks to health, safety, or fundamental rights

4.3 Coordination: European Artificial Intelligence Board

The European Artificial Intelligence Board (composed of one high-level representative per member state, chaired by the Commission) ensures consistent application of the regulation across the EU. It provides recommendations on enforcement priorities, coordinates joint investigations, and resolves cross-border enforcement conflicts. This mirrors the GDPR's European Data Protection Board (EDPB) model.

5. National Authority Landscape

Member states were required to designate their national competent authorities by 2 August 2025. The choice of authority varies by country — some have assigned responsibility to existing data protection authorities, while others have created new AI-specific bodies or assigned responsibility to existing market surveillance authorities.

The diversity of national approaches means organizations operating across multiple EU markets must track multiple enforcement bodies. Unlike GDPR's one-stop-shop mechanism (which allows designation of a lead DPA based on main establishment), the AI Act does not provide an equivalent single point of contact for cross-border enforcement.

6. SME & Startup Provisions

The AI Act includes explicit protections for small and medium-sized enterprises. Article 99(6) states that for SMEs (including startups), the applicable fine is the lower of the fixed Euro amount or the turnover percentage. This inverts the calculation for large enterprises (where the higher amount applies).

* For large enterprises, the fixed amount applies when it exceeds the turnover percentage. For SMEs, the lower of the two applies (turnover percentage in these examples).

7. Comparison with GDPR Fines

GDPR enforcement data provides the best available indicator for how AI Act enforcement may develop. The GDPR Enforcement Tracker (maintained by CMS Law, 2024 data) reveals the following patterns:

Key GDPR Enforcement Patterns Relevant to AI Act

• Enforcement accelerates over time — GDPR fines grew from €56M in 2019 to €2.1B in 2023. AI Act enforcement will likely follow a similar acceleration curve.
• Big Tech attracts the largest fines — The top 10 GDPR fines were all against technology companies (Meta, Amazon, Google, WhatsApp, TikTok). AI Act enforcement will likely target the same companies for GPAI and prohibited practice violations.
• Some DPAs are far more active than others — Spain's AEPD issued more GDPR fines than any other authority. Spain has also created the EU's first dedicated AI supervisory agency (AESIA), suggesting early aggressive enforcement.
• Cross-border cases take years — The Meta €1.2B fine took 5 years of cross-border proceedings. AI Act cross-border cases may face similar delays absent a one-stop-shop mechanism.

8. Non-Financial Consequences

Administrative fines are only one dimension of non-compliance risk. The AI Act also empowers authorities to impose non-financial corrective measures that can be equally damaging:

• Market withdrawal — Authorities can order removal of non-compliant AI systems from the EU market (Art. 98). For global AI providers, losing access to the EU market of 450 million consumers has severe revenue implications.
• Product recall — AI systems posing risks to health, safety, or fundamental rights can be recalled from all deployers in the EU.
• Operational restrictions — Authorities can restrict or prohibit the placing on the market or putting into service of an AI system until compliance is achieved.
• Public enforcement decisions — Enforcement decisions are typically published, causing reputational damage. GDPR enforcement decisions regularly generate media coverage.
• Civil liability exposure — The EU AI Liability Directive (proposed) and the revised Product Liability Directive extend liability frameworks to AI systems, creating private enforcement alongside regulatory penalties.
• Procurement exclusion — Non-compliant AI providers may be excluded from public procurement processes across the EU, particularly in government and critical infrastructure sectors.

9. How to Mitigate Penalty Risk

Based on the fine calculation criteria in Article 99(7), the following measures directly reduce penalty exposure:

10. Frequently Asked Questions

Related Articles