EU AI Act Penalties: The Three Tiers and the Daily Charge That Beats Them

The three penalty tiers

Article 99 sets three ceilings. In each, the fine is the higher of a fixed sum or a percentage of total worldwide annual turnover for the preceding financial year.

Two things about the structure matter more than the numbers. First, the percentage limb is calculated on group worldwide turnover, which decouples exposure from the size of the entity that actually committed the breach. Second, the tiers are set as ceilings for Member States, not as tariffs: each Member State legislates its own penalty regime within them, so the same breach can be priced differently in different jurisdictions.

Who enforces what

Enforcement is split three ways, and the split turns on what your system is built on rather than where your company sits.

The reallocation to the AI Office is the significant change. Before the Omnibus, supervision of AI systems was essentially national, with the AI Office focused on general-purpose models. Article 75(1) now gives it exclusive competence over two categories of AI system: those built on a general-purpose model where the model and the system come from the same provider or undertaking, and those integrated into very large online platforms or search engines under the Digital Services Act.

For a vertically integrated AI company, one that trains a model and ships the product on top of it, that means a single EU-level supervisor rather than 27 national ones. Whether that is better or worse depends on your view of consistency versus proximity, but it is certainly different: the AI Office has investigative powers modelled on competition procedure, not on product safety inspection.

The penalty that outruns the fine

Article 75c lets the AI Office impose periodic penalty payments of up to 5% of average daily income or worldwide annual turnover in the preceding financial year, per day, for as long as a breach continues.

This is the provision least represented in coverage of the Act, and arithmetically it is the largest number in the Regulation. A one-off fine is bounded. A daily charge is not: it compounds until the operator complies.

Read the final column against the €35 million top tier. At the ceiling, sustained non-compliance costs a mid-sized operator more in periodic penalties over a year than the maximum one-off fine for a prohibited practice. These are of course maxima, and the Court of Justice has unlimited jurisdiction to cancel, reduce or increase them, but the shape of the incentive is deliberate. The Regulation is built to make continued non-compliance more expensive than remediation.

How the amount is actually set

Article 99(7) lists nine factors authorities must take into account. Some are fixed by the facts; several are determined by how the organisation behaves once it knows.

1. The nature, gravity and duration of the infringement and of its consequences, taking into account the purpose of the system and, where appropriate, the number of people affected and the level of damage
2. Whether the same operator has already been fined by other market surveillance authorities for the same infringement
3. The size, annual turnover and market share of the operator
4. Any other aggravating or mitigating factor applicable to the circumstances, such as financial benefits gained or losses avoided
5. The degree of cooperation with the national competent authorities
6. The degree of responsibility of the operator, taking into account the technical and organisational measures it implemented
7. The manner in which the infringement became known to the authority: in particular whether the operator notified it, and if so to what extent
8. Whether the infringement was intentional or negligent
9. Any action taken to mitigate the harm suffered by the affected persons

Four of these are within your control after the breach has happened: the technical and organisational measures you had implemented, the degree of cooperation, whether you notified the authority yourself, and what you did to mitigate harm to the people affected. That is the practical argument for having an incident process before you need one, not because it prevents a fine, but because it changes four of the nine inputs.

Smaller firms get the lower figure

For SMEs including start-ups, Article 99(6) inverts the general rule: each fine is up to the percentage or the fixed amount, whichever is lower. The Omnibus extended comparable treatment to small mid-cap enterprises for the Article 99(4) and (5) tiers.

Without the inversion, a €4 million start-up committing a high-risk breach would face the €15 million fixed sum: roughly four times its annual revenue, and a straightforwardly terminal outcome. Article 99(6) is what makes the regime survivable at the small end, and it is worth knowing about before you accept a vendor’s risk framing or price indemnities into a contract.

Union bodies and GPAI providers

Two populations sit outside the Member State regime entirely: Union institutions are fined by the European Data Protection Supervisor under Article 100, and general-purpose AI model providers by the Commission under Article 101.

The Article 101 ceiling is notably lower than the Article 99(3) tier, which surprises people who assume foundation model providers face the largest exposure. They do not, unless the model is used for a prohibited practice, in which case the prohibition and its tier apply on their own terms.

Managing the exposure

Exposure is a function of three things you can measure: which tier a system’s worst plausible breach sits in, how long a breach would run before you noticed, and how well you could evidence the Article 99(7) mitigating factors.

Next: screen for the highest tier in the ten prohibited practices, work out whether Chapter III applies with the high-risk classification guide, or read Article 99 in full.