Skip to content
SimpleAct Logo

AI Act · Articles 99 and 101

As of 7 October 2026, after the Digital Omnibus

Fines under Article 99 of the AI Act

The AI Act has three tiers of fines, a special rule for small and medium-sized enterprises and separate fines for providers of general-purpose AI models. This page lists the amounts with their legal source, the criteria for setting a fine and what the Digital Omnibus changed.

See the tiersKeep track of obligations

Short answer

Breaches of the prohibitions in Article 5 can be fined up to EUR 35 million or, for undertakings, up to 7 % of total worldwide annual turnover for the preceding financial year (Art. 99(3)); breaches of the obligations listed in Article 99(4) up to EUR 15 million or 3 %; and supplying incorrect, incomplete or misleading information to authorities or notified bodies up to EUR 7.5 million or 1 % (para. 5). In each case the higher amount applies. For SMEs, including start-ups, the lower amount applies (para. 6). The Commission can fine providers of general-purpose AI models up to EUR 15 million or 3 % (Art. 101(1)).

Fine tiers

The three tiers under Article 99(3) to (5)

The amounts are maximums. For undertakings, the percentage of total worldwide annual turnover for the preceding financial year applies if it is higher than the fixed amount.

InfringementMaximumSource
Non-compliance with the prohibited AI practices in Article 5Up to EUR 35 million or up to 7 % of worldwide annual turnover, whichever is higherArt. 99(3)
Non-compliance with the obligations listed in para. 4 (see below)Up to EUR 15 million or up to 3 % of worldwide annual turnover, whichever is higherArt. 99(4)
Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a requestUp to EUR 7.5 million or up to 1 % of worldwide annual turnover, whichever is higherArt. 99(5)

Middle tier

Which obligations fall under Article 99(4)

  • Art. 99(4)(a)

    Providers

    Obligations of providers pursuant to Article 16.

  • Art. 99(4)(b) to (d)

    Authorised representatives, importers, distributors

    Obligations of authorised representatives (Art. 22), importers (Art. 23) and distributors (Art. 24).

  • Art. 99(4)(da) (new)

    AI value chain

    Since Regulation (EU) 2026/1744: obligations of providers and operators pursuant to Article 25(2) and (4), i.e. the duties to cooperate and provide support along the AI value chain.

  • Art. 99(4)(e)

    Deployers

    Obligations of deployers pursuant to Article 26.

  • Art. 99(4)(f)

    Notified bodies

    Requirements and obligations under Article 31, Article 33(1), (3) and (4) and Article 34.

  • Art. 99(4)(g)

    Transparency

    Transparency obligations for providers and deployers pursuant to Article 50.

Obligations not listed in paragraph 4, such as Article 4 (AI literacy) or Article 27 (fundamental rights impact assessment), have no fine tier of their own in the Regulation. Since the Digital Omnibus, however, Member States must lay down penalties for any infringement (Art. 99(1) as amended).

SMEs and small mid-caps

For SMEs the lower amount applies

For SMEs, including start-ups, each fine under Article 99 is capped at the lower of the percentage and the amount in paragraphs 3, 4 and 5 (Art. 99(6)). An SME with EUR 10 million annual turnover would therefore face a cap of 3 % of turnover for a paragraph 4 infringement, not EUR 15 million.

New in Regulation (EU) 2026/1744: the lower amount also applies to small mid-cap enterprises (SMCs), but only for fines under paragraphs 4 and 5, not for breaches of Article 5 (Art. 99(6a)). Article 3 point 14b as amended defines an SMC by reference to point 2 of the Annex to Recommendation (EU) 2025/1099.

Member States must also take into account the interests of SMEs, including start-ups, and SMCs and their economic viability when imposing penalties (Art. 99(1) as amended).

Setting the fine

What determines the amount: Article 99(7)

Whether a fine is imposed and how high it is depends on all relevant circumstances of the specific case, with regard, as appropriate, to:

  • the nature, gravity and duration of the infringement and its consequences, the purpose of the AI system, the number of affected persons and the level of damage (point a)
  • whether other market surveillance authorities have already fined the same operator for the same infringement (point b)
  • whether other authorities have already fined the same operator under other Union or national law for the same activity or omission (point c)
  • the size, annual turnover and market share of the operator (point d)
  • any other aggravating or mitigating factor, such as financial benefits gained or losses avoided (point e)
  • the degree of cooperation with the authorities to remedy the infringement and mitigate its effects (point f)
  • the degree of responsibility, taking into account technical and organisational measures (point g)
  • how the authorities became aware of the infringement, in particular whether the operator notified it (point h)
  • intent or negligence (point i)
  • any action taken to mitigate the harm suffered by affected persons (point j)

General-purpose AI models

Fines for GPAI model providers under Article 101

For providers of general-purpose AI models, the Commission rather than a national authority is competent. It can impose fines of up to 3 % of total worldwide annual turnover in the preceding financial year or EUR 15 million, whichever is higher, where the provider intentionally or negligently infringed the relevant provisions, failed to comply with a request for documents or information under Article 91 or supplied incorrect information, failed to comply with a measure under Article 93, or failed to give access for an evaluation under Article 92 (Art. 101(1)(a) to (d)).

Before deciding, the Commission gives the provider an opportunity to be heard (Art. 101(2)). The Court of Justice of the European Union may cancel, reduce or increase the fine (Art. 101(5)). Article 101 applies from 2 August 2026 (Art. 113, second paragraph, and third paragraph, point (b)).

Who imposes fines

Competence, public authorities and application

QuestionAnswerSource
Who lays down the penalty rules?The Member States, for any infringement of the Regulation; penalties must be effective, proportionate and dissuasiveArt. 99(1) as amended
Can public authorities be fined?Each Member State decides to what extent fines may be imposed on public authorities and bodiesArt. 99(8)
Who imposes the fine?Depending on the legal system, an authority or a national courtArt. 99(9)
And the AI Office?For AI systems within its exclusive competence it can impose penalties under Article 99(3) to (7)Art. 75c(4) and Art. 75(1) as amended
Since when does Article 99 apply?Since 2 August 2025 (Chapter XII)Art. 113, third para., point (b)

When a specific obligation can be fined depends on when the obligation itself applies. For high-risk obligations under Annex III, that is 2 December 2027 after the Digital Omnibus (Art. 113, third para., point (c)(i) as amended).

Implementation

How SimpleAct reduces the risk of fines

  • Art. 99(7)(g)

    Show your measures

    Technical and organisational measures count when setting a fine. SimpleAct documents classification, obligations, evidence and owners for every AI system.

  • Art. 5

    Check prohibitions first

    The AI check starts with prohibited practices, the highest fine tier, before moving on to high-risk and transparency.

FAQ

Frequently asked questions about AI Act fines

Up to EUR 35 million or, for undertakings, up to 7 % of total worldwide annual turnover for the preceding financial year, whichever is higher. This tier applies to breaches of the prohibitions in Article 5 (Art. 99(3)).
Breaches of the deployer obligations in Article 26 fall under Article 99(4)(e): up to EUR 15 million or 3 % of worldwide annual turnover, whichever is higher. For SMEs the lower amount applies (para. 6).
They also fall in the middle tier: up to EUR 15 million or 3 % (Art. 99(4)(g)).
The AI Act itself sets no specific fine for Article 4: Article 99(4) lists the obligations subject to fines exhaustively and does not mention Article 4. Since the Digital Omnibus, however, Article 99(1) requires Member States to lay down penalties for any infringement of the Regulation. Whether and how a breach of Article 4 is sanctioned is therefore a matter of national law. The obligation applies either way.
Yes. For SMEs, including start-ups, each fine under Article 99 is capped at the lower of the percentage and the amount (para. 6). Since Regulation (EU) 2026/1744 this also applies to small mid-cap enterprises for paragraphs 4 and 5 (para. 6a).
All circumstances of the case, including the nature, gravity and duration of the infringement, the size and turnover of the operator, cooperation with the authority, intent or negligence and the measures taken (Art. 99(7)(a) to (j)).

More questions? We're happy to help. Send email · Get started

Sources and status

As of · SimpleAct editorial team

Editorial information, not legal advice. The text published in the Official Journal is authoritative; interpretation and national implementation can differ in individual cases. For specific questions, seek legal advice.

Keep reading

Meet your obligations before it gets expensive

Record your AI systems, classify them and keep measures and evidence in one place. We will show you what that looks like in SimpleAct.

Book a demoTry for 7 days