How EU AI Act fines are calculated
The EU AI Act uses a two-number system for every fine tier. Regulators take whichever is higher: a fixed euro amount or a percentage of global annual turnover. This means large companies always pay more than small ones for the same violation — but the percentage system also protects genuinely small businesses.
The three fine tiers
- Article 5 violations (banned practices): Up to €35 million or 7% of global annual turnover — whichever is higher. These include emotion inference in workplaces, social scoring, real-time biometric surveillance in public spaces, and manipulation of vulnerable persons. These prohibitions have applied since 2 February 2025.
- High-risk AI non-compliance (Articles 6–49): Up to €15 million or 3% of global annual turnover. This covers failing to meet obligations as a provider (documentation, conformity assessment) or deployer (disclosure, human oversight, log retention). Applies from 2 August 2026.
- Misleading authorities (Article 101): Up to €7.5 million or 1.5% of global annual turnover. For providing incorrect, incomplete, or misleading information to national supervisory authorities during investigations.
SME and startup protection
Article 99(6) of the EU AI Act halves the maximum fine for SMEs and startups (under 250 employees and under €50M turnover). This is not a discretionary reduction — it is a statutory cap. A qualifying startup's Article 5 maximum is €17.5M or 3.5% of turnover, not €35M or 7%.
Mitigating factors that reduce actual fines
The maximum is a ceiling, not the expected fine. National supervisory authorities must take proportionality into account and consider:
- Nature, gravity, and duration of the infringement
- Whether the organisation cooperated with the authority
- Degree of responsibility and technical/financial capacity
- Steps taken to mitigate harm after discovering a violation
- Whether the organisation notified the authority voluntarily
In practice, first-time violations by organisations that cooperate and remediate promptly are likely to attract fines well below the statutory maximum. The maximum signals severity — it does not predict average enforcement.
When does enforcement start?
Article 5 prohibited practices have been enforceable since 2 February 2025. If your organisation uses emotion inference AI or social scoring, that risk is live now — there is no August 2026 grace period for banned practices.
High-risk AI deployer obligations (disclosure, human oversight, log retention, AI literacy) apply from 2 August 2026. The Digital Omnibus proposal (currently under European Parliament review) would defer some provider obligations to December 2027, but deployer obligations remain at August 2026.
National market surveillance authorities must be designated by August 2025. Enforcement activity is expected to build through 2026 and 2027 as authorities operationalise their remits.