Loading
Fines, enforcement, and the risk curve: what the penalty numbers in the EU AI regulation mean
·5 min read
A company processing €400 million in annual revenue looks at the EU AI Act fine ceiling and sees €28 million at worst, because 7 percent of global turnover caps exposure below the €35 million nominal figure. A company processing €200 million in revenue sees €14 million. A startup with €3 million in revenue sees €210,000. Same prohibited practice, same ceiling in the regulation, three very different numbers once you apply the arithmetic. That asymmetry is built into Article 99 of Regulation (EU) 2024/1689 by design, and it changes what the fine structure actually means depending on which side of the revenue line you sit on.
The headline number travels further than the detail that qualifies it. Every summary of the Act quotes €35 million or 7 percent of worldwide annual turnover, whichever is higher, as the ceiling for breaching the Article 5 prohibitions on practices such as social scoring, real-time biometric identification in public spaces, and AI systems that exploit psychological vulnerabilities. Decode the Future's August 2026 analysis notes that this ceiling is nearly double GDPR's maximum of €20 million or 4 percent of global turnover, which makes for an arresting comparison. What gets less attention is the word "higher" and what it implies for smaller organisations. For an SME or startup, the fine is calculated as the lower of the fixed euro amount or the turnover percentage, which is the opposite rule. The regulation protects small companies from fines that would exceed their actual means; it does not protect large ones from fines that scale with them.
Below the top tier, Article 99 sets two further ceilings. Non-compliance with high-risk AI requirements, including the quality management and documentation obligations that providers of systems in Annex III must meet, reaches €15 million or 3 percent of global turnover. Providing incorrect or misleading information to national authorities reaches €7.5 million or 1.5 percent. As Axis Intelligence's June 2026 analysis records, zero formal fines have been issued under Article 99 as of that date, so the tiers are still theoretical maximums rather than precedents. They matter structurally even before the first fine lands, because they tell you which failure modes regulators will eventually treat as most serious.
For a large technology company with €5 billion in global turnover, the 3 percent tier means potential exposure of €150 million for high-risk system failures, which comfortably exceeds the nominal €15 million ceiling. For those companies, the percentage governs; the nominal ceiling is irrelevant. For a company with €40 million in turnover, the €15 million nominal ceiling exceeds the 3 percent figure of €1.2 million, so the percentage becomes the actual limit. The regulation's structure means that proportional exposure stays roughly constant across the bottom half of the market while becoming steeper, in absolute terms, at the top.
This is where enforcement timing enters the picture. The high-risk obligations under Annex III, which cover AI used in employment decisions, credit scoring, education, and critical infrastructure, became enforceable on 2 August 2026, following the Digital Omnibus adjustment, Regulation (EU) 2026/1744, which pushed the hard compliance deadline for most Annex III systems to December 2027. As Fello AI's August 2026 summary notes, that law came into force on 27 July 2026, six days before enforcement powers activated. Enforcement powers and final compliance deadlines are two separate things: authorities can now investigate and open proceedings, but companies deploying existing Annex III systems have until December 2027 to have the full requirements in place. For companies that have done nothing, that window is shrinking.
The ceiling figures describe the maximum a regulator can impose, not what regulators will actually impose, and those two things will diverge considerably in practice. GDPR enforcement history offers an instructive parallel: the regulation's €20 million or 4 percent ceiling has been reached rarely, and most fines sit well below it. National authorities calibrating AI Act sanctions will weigh the severity of actual harm, the organisation's cooperation, and its compliance history in much the same way. A company that can demonstrate it ran a genuine conformity assessment, maintained technical documentation, and had human oversight arrangements in place is in a structurally different position from one that did none of those things, even if both technically exceeded a requirement.
That said, Article 5 violations work differently from the other two tiers. Crossing a prohibition means doing something the regulation forbids outright, not failing to document something adequately. A regulator finding that a company ran a social scoring system or used subliminal manipulation techniques against consumers has less room to treat compliance posture as a mitigating factor. The prohibition has been in force since 2 February 2025. Any organisation that crossed it after that date did so with the law already live.
For companies working through what this means for their own systems, the sequencing established in the EU AI Act timeline is the right starting point: prohibited practices first, then GPAI obligations, then Annex III high-risk requirements. The fine structure follows that same order of severity. European compliance platforms capable of supporting conformity assessments and documentation obligations on EU infrastructure are directly relevant to that work; the EU alternatives to OneTrust, Vanta, and Drata piece covers which of those platforms are best placed for each tier.
What the ceilings do not capture is that the real exposure for any company is the distance between its current AI practices and what the regulation requires, multiplied by the probability that a national authority investigates. For large companies, that distance can generate very large absolute numbers under the percentage formula. For smaller ones, the nominal ceilings bind first, and actual exposure is more bounded. Both groups face real risk, but through a different part of the formula.