Fines for infringements

The three fine tiers in the EU AI Act

The Regulation scales fines according to the severity of the infringement into three clearly defined tiers. Crucially, the higher of the two values applies in each case, either the fixed maximum amount in euros or the percentage of global annual turnover. For SMEs and start-ups, however, the lower amount applies as the cap (details below).

Who imposes the fines?

Enforcement of the EU AI Act is the responsibility of the national market surveillance authorities of the respective EU member states. Each member state designates one or more competent authorities to carry out inspections, investigate complaints and impose sanctions for infringements.

At European level, the European AI Office coordinates the supervision of GPAI models and ensures consistent application of the Regulation across borders. Companies operating across borders may be inspected by authorities in multiple member states, the legal basis for this follows directly from the EU AI Act.

Special rule for SMEs and start-ups

Small and medium-sized enterprises and start-ups benefit from a specific protection against disproportionately high sanctions in the EU AI Act: for them, the lower of the two values (fixed amount or percentage of global annual turnover) serves as the cap, whereas for large companies, the higher amount is decisive.

In practice this means: a start-up with modest turnover pays, for a Tier 2 infringement, at most the percentage of its turnover — as long as this is below €15 million — and not the maximum fixed amount. This protection clause does not, however, release SMEs from the obligations themselves. In particular, the AI literacy obligation under Article 4 applies to everyone who uses AI professionally, regardless of company size.

When can fines be imposed?

The EU AI Act's penalty provisions do not all take effect simultaneously. The timeline is decisive for the question of which fines can actually be imposed from when:

• Since 2 February 2025: The prohibitions under Article 5 (prohibited AI practices) and the AI literacy obligation under Article 4 apply, and with them the corresponding fine provisions of Tiers 1 and 2 for these areas. Companies that have not yet acted are already operating in sanctionable territory.
• From 2 August 2025: The general penalty provisions apply in full, for infringements of all other provider and deployer obligations, including the requirements for general-purpose AI models.
• From 2 August 2026: The extensive obligations for high-risk AI systems become applicable, meaning fines for infringements in this area can also be imposed.

All dates, transitional arrangements and exceptions are explained in detail on the deadlines page.

How companies can avoid fines

The best protection against fines is demonstrable compliance, not just meeting obligations, but being able to document and prove them to authorities. A company that cannot produce evidence during an inspection risks sanctions even if it has in fact been acting compliantly.

• Establish AI literacy under Article 4 verifiably: employees who use AI must have appropriate knowledge of how the AI systems they use work, their risks and their limits. This applies to deployers of every size , from sole traders to large corporations.
• Document training with certified proof: a verifiable EU AI Act training course with automatic audit trail demonstrates to authorities that the company has actively and provably exercised due diligence. This proof has a mitigating effect when calculating fines.
• Inventory your AI use: create a complete overview of which AI systems are used in which processes and which risk class they belong to. Only by knowing what is in use can a company act compliantly.
• Keep track of deadlines: act in good time ahead of the key dates on the deadlines page, in particular 2 August 2025 and 2 August 2026.

Frequently asked questions

Can fines be imposed for minor violations?

Not every infringement automatically incurs the maximum fine. The amount depends on the severity, duration and intent of the infringement, as well as on whether the company has cooperated and taken corrective action. Even seemingly minor violations, such as missing documentation of AI literacy under Article 4, should not be underestimated. Further answers on obligations and exceptions can be found on our FAQ page.

Is the fine per employee or per company?

Fines are directed at the company as a whole, not at individual employees. The global turnover of the company or corporate group, not that of a single site or subsidiary , is decisive for the percentage cap. This makes the percentage ceilings particularly significant for international companies and underlines why systematic, company-wide employee training is so important. The full legal framework is explained on the EU AI Act overview page.

Train your team now The AI literacy obligation

Note: this overview is for information only and does not constitute legal advice.