AI Act penalties are the fines that Regulation (EU) 2024/1689 sets for breaching its rules on artificial intelligence. Article 99 establishes three tiers, with a maximum of 35 million euros or 7 % of worldwide turnover for prohibited practices. SMEs and start-ups pay at most the lower of the two figures. The Digital Omnibus on AI extends that rule to small mid-cap companies in two of the tiers. Providers of general-purpose models have their own regime, with Commission fines since 2 August 2026. The penalties chapter has applied since August 2025, but today only some of the obligations it punishes are enforceable. And in Spain there is still no law designating the authorities and setting the penalty regime, because the bill lapsed when the Spanish Parliament was dissolved in October 2026.
If you need an AI lawyer in Spain for your business, request a free initial assessment.
Article 99 of Regulation (EU) 2024/1689 divides infringements into three tiers according to the obligation breached. In each one, the maximum fine is a fixed amount or a percentage of worldwide turnover for the preceding financial year, whichever is higher.
| Tier | What is breached | Maximum fine |
|---|---|---|
| First | Prohibitions in Article 5 | 35 million euros or 7 % |
| Second | Obligations of providers, authorised representatives, importers, distributors and deployers, of notified bodies and the transparency obligations in Article 50 | 15 million euros or 3 % |
| Third | Incorrect, incomplete or misleading information to notified bodies or authorities that requested it | 7.5 million euros or 1 % |
The percentage only matters for large companies. In the first tier, 7 % exceeds 35 million when worldwide turnover is above 500 million euros. Below that, the ceiling is the fixed amount.
The second tier is the broadest. It covers the obligations of providers of high-risk systems, those of importers and distributors and those of the deployer under Article 26. It also covers the transparency duties in Article 50. The Digital Omnibus on AI added a letter with the cooperation obligations in Article 25(2) and (4). These are the ones that bind operators along the value chain of a high-risk system.
For SMEs, including start-ups, each fine under Article 99 is capped at the lower of the two figures in its tier, under paragraph 6. An SME that uses a prohibited practice risks at most 7 % of its turnover, not 35 million.
The Omnibus, Regulation (EU) 2026/1744, added paragraph 6a for small mid-cap companies as defined in Recommendation (EU) 2025/1099. The same lower-figure rule applies to them, but only in the second and third tiers. For prohibited practices they are treated like a large company.
The Omnibus also rewrote paragraph 1. Member States may provide for warnings and non-monetary measures in addition to fines. And when imposing penalties they must take into account the interests and economic viability of SMEs, start-ups and small mid-caps.
The amounts in Article 99 are maximums. The authority sets the specific amount using the criteria in paragraph 7, including the following.
The last two criteria reward preparation. Having documented the system and having raised the alarm in time reduce the fine even if they do not prevent the infringement.
Providers of general-purpose models have a separate regime in Article 101. The Commission can fine them up to 3 % of their worldwide turnover or 15 million euros, whichever is higher, from 2 August 2026. It punishes breaches of their obligations, failure to respond to requests for information and failure to give access to the model for evaluation.
The Omnibus also created a regime for the AI Office. It has exclusive supervision of systems based on a general-purpose model from the same provider and of those integrated into very large online platforms and search engines. Its non-compliance decisions can carry the fines in Article 99(3) to (7). The obligations of models are explained in our guide to general-purpose AI models.
The penalties chapter has applied since 2 August 2025, except Article 101, from 2 August 2026. But a fine is only possible if the obligation breached is already enforceable.
| Obligation | Enforceable from |
|---|---|
| Prohibited practices in Article 5 | 2 February 2025 |
| Two new Omnibus prohibitions | 2 December 2026 |
| Transparency in Article 50 | 2 August 2026 |
| High-risk systems in Annex III | 2 December 2027 |
| High-risk systems in Annex I | 2 August 2028 |
The prohibitions are covered in our guide to AI Act prohibited practices, and high risk in our guide to high-risk AI systems.
Article 99 requires each Member State to lay down its rules on penalties. Spain was going to do so with the Organic Law bill on the proper use and governance of artificial intelligence, which the government sent to Congress and which was published on 12 June 2026. The bill lapsed when the Spanish Parliament was dissolved, as published in the Official State Gazette (BOE) on 6 October 2026. The government formed after the elections of 29 November will have to reintroduce it, and nothing ensures it will keep the same content.
The lapsed bill classified infringements as very serious, serious and minor, with maximums aligned with those of the regulation, and classed prohibited practices as very serious. It shared supervision among several authorities.
What remains open is whether infringements committed before the Spanish law exists can be penalised later. The principle of legality requires the penalty to be laid down when the infringement is committed. That doubt does not affect measures on the product, such as withdrawal from the market, nor the Commission’s fines on model providers.
This case is fictitious. Talentia Software, S.L. is an SME in Seville with 40 employees and 6 million euros in turnover. It sells software that screens CVs and scores candidates. In 2026 it adds a module that uses video to analyse the stress levels of its customers’ employees in follow-up meetings.
The CV screener is high-risk under point 4 of Annex III, and its obligations will be enforceable from 2 December 2027. Breaching them would expose it to the second tier. As an SME, its maximum would be the lower figure, 3 % of 6 million, that is, 180,000 euros.
The video module raises a different risk. It infers the emotions of workers in their workplace, so it is a prohibited practice under Article 5(1)(f), in the first tier. The maximum for Talentia would be 7 % of its turnover, 420,000 euros. The ban has been enforceable since February 2025, although a fine in Spain depends on the penalty regime being approved. The general framework is in our AI Act compliance guide for businesses.
Up to 35 million euros or 7 % of worldwide turnover for the preceding financial year, whichever is higher. It is the fine for using a prohibited AI practice under Article 5. The other tiers reach 15 million or 3 % for breaching the remaining obligations. And 7.5 million or 1 % for giving inaccurate information to the authorities.
No. For SMEs and start-ups, each fine is capped at the lower of the two figures in its tier, under Article 99(6). Since the Digital Omnibus on AI, small mid-cap companies also benefit from that rule in the second and third tiers, but not for prohibited practices.
The obligations that are already enforceable, such as the prohibitions in Article 5 or the transparency in Article 50, are in force. But Spain still has no law setting the penalty regime and designating the authorities, because the bill lapsed when the Spanish Parliament was dissolved in October 2026. Whether infringements committed before that law can be penalised later is an open question.
The European Commission, not the national authorities. Article 101 allows it to impose fines of up to 3 % of worldwide turnover or 15 million euros from 2 August 2026. In addition, the AI Office can penalise the systems it supervises exclusively after the Omnibus.
Article 99(7) requires account to be taken of cooperation with the authority, whether the operator notified the infringement and the measures taken to mitigate the damage. Also the degree of responsibility in light of the technical and organisational measures applied. Having the system documented and reacting in time counts in your favour.
The AI Act penalty regime arrives in phases, like the regulation itself. The prohibitions already apply, transparency since August 2026 and high risk in 2027 and 2028, while Spain is still without its law. That gap is useful time to document systems, close contracts with providers and set up the notification process, which are precisely the criteria that reduce a fine. At Innovatech we review your exposure as part of our AI legal advisory service. Write to us and we will give you a free initial assessment.
Marta Suárez-Mansilla is Managing Partner of Innovatech Legal and a Spanish lawyer (abogada), Madrid Bar (ICAM), working in technology law. She completed Harvard Law School's Copyright course and BerkeleyX's Blockchain programme, and has advised technology companies for more than eight years.