EU AI Act Fines and Penalties: The Three Tiers, Explained

Violations of Article 5 — manipulative techniques causing significant harm, exploitation of vulnerabilities, social scoring, untargeted facial-image scraping, emotion recognition in workplaces and schools, and the other prohibited practices — draw the top band: up to €35 million or 7% of total worldwide annual turnover, whichever is higher.

These provisions have applied since 2 February 2025, and penalty enforcement has been available since 2 August 2025. There is no transition period left: a prohibited practice running today is a live violation, not a future risk.

Non-compliance with the operative obligations sits here: provider duties for high-risk systems (risk management, data governance, technical documentation, logging, oversight, accuracy), deployer duties, importer and distributor duties, notified-body obligations, and Article 50 transparency duties for chatbots and synthetic content.

This is the band that matters for most SaaS companies. Missing Annex IV documentation on a high-risk system, or an undisclosed chatbot, is a Tier 2 matter — up to €15 million or 3% of worldwide turnover.

Supplying incorrect, incomplete or misleading information to notified bodies or authorities draws up to €7.5 million or 1% of turnover. It exists so that paper compliance — documents describing processes that do not exist — is itself punishable, separately from the underlying violation.

For SMEs and startups, each fine is capped at the lower of the two amounts rather than the higher — the percentages bite less, but €7.5–35M ceilings still apply. Providers of general-purpose AI models face a separate regime: up to €15M or 3%, enforced by the Commission’s AI Office.

Everything else is enforced nationally: each member state designates market surveillance authorities that investigate, order corrective action or market withdrawal, and fine. Factors that move the number: nature and duration of the infringement, intent or negligence, cooperation, mitigation taken, and whether the same operator was sanctioned before by another authority.

Realistically, a mid-size SaaS is unlikely to be the first headline enforcement target — but three cheaper penalties arrive earlier. First, corrective-action orders: an authority can require withdrawal of a non-compliant system from the EU market, which for a SaaS is an existential order, not a fee. Second, procurement: enterprise buyers already ask AI Act questions in vendor reviews, and “we have not classified our systems” ends deals silently. Third, contract risk: EU customers pass their deployer duties through contractually, and a vendor who cannot support them is in breach before any regulator looks.

The rational response is proportionate: classify your systems, produce the core documents, and keep evidence — the same work that answers a buyer questionnaire is the work that mitigates a fine.