Article 99: Penalties

Article 99 distinguishes several fine ceilings. Infringement of Article 5 may lead to a maximum of EUR 35 million or 7 percent of worldwide annual turnover. The obligations listed in paragraph 4 carry a maximum of EUR 15 million or 3 percent. Incorrect, incomplete or misleading information supplied to a notified body or competent authority carries a maximum of EUR 7.5 million or 1 percent.

Deployer obligations under Article 26 and transparency obligations under Article 50 are expressly included in the category in Article 99(4). In each case, the authority considers factors including gravity, duration, harm, size, cooperation, technical and organisational measures, and whether the conduct was intentional or negligent.

For SMEs and startups, each fine category uses the lower ceiling of the fixed amount or turnover percentage. Regulation (EU) 2026/1744 extended the same approach to the relevant categories for small mid-caps. This does not change the underlying obligations.

Each Member State must determine the extent to which administrative fines may be imposed on its public authorities and bodies. Article 99 therefore does not provide one uniform answer for every public body. Warnings and non-financial measures may also form part of the national penalty system.

Infringement of Article 5 carries a maximum of EUR 35 million or 7 percent of turnover. The obligations specifically listed in paragraph 4 carry EUR 15 million or 3 percent. Incorrect, incomplete or misleading information carries EUR 7.5 million or 1 percent.

Yes, small and medium-sized enterprises (SMEs) and startups are subject to proportionally lower fine caps.

Article 99 of the AI Act does not provide a general exemption for SMEs. However, the AI Act includes supportive measures and potentially lighter obligations for small and medium-sized enterprises, depending on their role in the AI value chain.

Article 99 of the AI Act complements the GDPR. While the GDPR protects personal data, the AI Act focuses on the safety and trustworthiness of AI systems. Organisations must comply with both regulations when their AI system processes personal data.

Chapter XII, including Article 99, has applied since 2 August 2025. The amendments made by Regulation (EU) 2026/1744 entered into force on 27 July 2026.

Yes, Article 99 of the AI Act may also be relevant when you purchase AI systems. As a deployer, you have your own obligations under the AI Act, regardless of whether you developed the system yourself or purchased it from a provider.

Under Article 99 of the AI Act, the provider is the entity that develops or places the AI system on the market, while the deployer is the entity that uses the system under its own authority. Both roles carry different obligations.

Article 99 imposes no standalone general documentation duty. When setting a fine, the authority may consider technical and organisational measures taken and cooperation, so evidence of compliance remains relevant.

The ceilings are EUR 35 million or 7 percent for Article 5, EUR 15 million or 3 percent for the obligations listed in paragraph 4, and EUR 7.5 million or 1 percent for incorrect, incomplete or misleading information.

The AI Act and GDPR each have their own legal bases and ceilings. Article 99 contains no general rule that the highest ceiling automatically applies. Where regimes overlap, authorities must apply the relevant rules and respect the ne bis in idem principle.

Yes. For SMEs, including start-ups, each category uses the lower maximum of the fixed amount or turnover percentage. Regulation (EU) 2026/1744 added this method for small mid-caps for the categories in paragraphs 4 and 5.

The competent national authority applies the national penalty regime within its statutory remit. For certain operators directly supervised by the AI Office, Regulation (EU) 2026/1744 gives the AI Office its own investigation and enforcement powers.