EU AI Act Art. 99 — Penalties
Article 99 sets the EU AI Act's fine structure: up to €35 million or 7% for banned practices and GPAI violations, €15 million or 3% for most other obligations, and €7.5 million or 1% for misleading authorities.
At a glance
What this article requires
- Tier 1 — prohibited practices (Art. 5) and GPAI violations: up to €35 million or 7% of worldwide annual turnover.
- Tier 2 — most other obligations (high-risk provider and deployer duties, transparency): up to €15 million or 3%.
- Tier 3 — supplying incorrect, incomplete, or misleading information to authorities: up to €7.5 million or 1%.
- SMEs and start-ups get the lower of the percentage or fixed amounts.
- The penalty framework (Chapter XII) applied from 2 August 2025.
Scope
Who this applies to
Providers, deployers, importers, and distributors — anyone subject to the Act's obligations, with fines set by member state authorities.
Obligations
What you must actually do
Understand which tier your gap lands in
Banned practices are the catastrophic tier; documentation and process gaps are the general tier; lying to authorities has its own tier.
Budget for national enforcement
Member states set the enforcement machinery — check the authority and procedures in each state where you operate.
Never mislead an authority
The €7.5M/1% tier for misleading information is the cheapest way to inflate a fine.
Action plan
Practical first steps
- 1
Map your obligations to the three tiers so you know your exposure per gap.
- 2
Add a fines-and-timeline page to your compliance briefing for leadership.
- 3
Ensure any communication with notified bodies or authorities is vetted and complete.
Penalty exposure
This article sets the penalty tiers themselves: up to €35M/7%, €15M/3%, or €7.5M/1% depending on the violation.
FAQ
Questions about Art. 99
Are fines capped for SMEs?
Yes — the Act says SMEs and start-ups are subject to the lower of the percentage or fixed amounts, and member states can consider size when setting penalties.
Who decides the fine?
National market surveillance or other competent authorities of the member state where the infringement occurred; rules vary by member state within the Act's ceilings.
Sources
Citations & further reading
Related
More article explainers
Wondering which articles apply to your AI?
Describe your system in the free Risk Scanner and get a preliminary risk read with the obligations that likely apply — in seconds.
Check my use casePreliminary EU AI Act clarity summary. Not legal advice.