Article 99: Penalties

Article 99 distinguishes several fine ceilings. Infringement of Article 5 may lead to a maximum of EUR 35 million or 7 percent of worldwide annual turnover. The obligations listed in paragraph 4 carry a maximum of EUR 15 million or 3 percent. Incorrect, incomplete or misleading information supplied to a notified body or competent authority carries a maximum of EUR 7.5 million or 1 percent.

Deployer obligations under Article 26 and transparency obligations under Article 50 are expressly included in the category in Article 99(4). In each case, the authority considers factors including gravity, duration, harm, size, cooperation, technical and organisational measures, and whether the conduct was intentional or negligent.

For SMEs and startups, each fine category uses the lower ceiling of the fixed amount or turnover percentage. Regulation (EU) 2026/1744 extended the same approach to the relevant categories for small mid-caps. This does not change the underlying obligations.

Each Member State must determine the extent to which administrative fines may be imposed on its public authorities and bodies. Article 99 therefore does not provide one uniform answer for every public body. Warnings and non-financial measures may also form part of the national penalty system.

Infringement of Article 5 carries a maximum of EUR 35 million or 7 percent of turnover. The obligations specifically listed in paragraph 4 carry EUR 15 million or 3 percent. Incorrect, incomplete or misleading information carries EUR 7.5 million or 1 percent.

Yes, small and medium-sized enterprises (SMEs) and startups are subject to proportionally lower fine caps.

Article 99 imposes no standalone general documentation duty. When setting a fine, the authority may consider technical and organisational measures taken and cooperation, so evidence of compliance remains relevant.

The ceilings are EUR 35 million or 7 percent for Article 5, EUR 15 million or 3 percent for the obligations listed in paragraph 4, and EUR 7.5 million or 1 percent for incorrect, incomplete or misleading information.

The AI Act and GDPR each have their own legal bases and ceilings. Article 99 contains no general rule that the highest ceiling automatically applies. Where regimes overlap, authorities must apply the relevant rules and respect the ne bis in idem principle.

Yes. For SMEs, including start-ups, each category uses the lower maximum of the fixed amount or turnover percentage. Regulation (EU) 2026/1744 added this method for small mid-caps for the categories in paragraphs 4 and 5.

The competent national authority applies the national penalty regime within its statutory remit. For certain operators directly supervised by the AI Office, Regulation (EU) 2026/1744 gives the AI Office its own investigation and enforcement powers.