What are the fines under the EU AI Act, and can a municipality be fined?

Imagine you are the data protection officer (DPO) or privacy adviser of a Dutch municipality. The municipality runs a chatbot on its website and a model that gives social assistance files a risk score. The executive board asks you: "What fine do we risk under the AI Act?" The honest answer has two sides. The AI Act sets high fines, but in the Netherlands no supervisor can impose one yet. The GDPR fine can be imposed, today, on a municipality too.

Lesson 1: the AI Act has three tiers of fines

Article 99 of the AI Act sets three maximums:

1. Up to 35 million euros or 7 percent of worldwide annual turnover for breaching a prohibition in Article 5, such as social scoring or emotion recognition at work (paragraph 3).
2. Up to 15 million euros or 3 percent for a list of other obligations (paragraph 4): those of providers (Article 16), authorised representatives, importers and distributors, the cooperation duties along the value chain (Article 25(2) and (4)), the obligations of deployers (Article 26), the requirements for notified bodies and the transparency obligations of Article 50.
3. Up to 7.5 million euros or 1 percent for supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request (paragraph 5).

Providers of general-purpose AI models have a separate regime. There the European Commission fines, up to 3 percent of worldwide annual turnover or 15 million euros, whichever is higher (Article 101(1)).

Note what is not on the list in paragraph 4. The AI literacy obligation of Article 4 and the fundamental rights impact assessment (FRIA) of Article 27 have no fine tier of their own in the Regulation. Member States must lay down penalties for any infringement by operators (paragraph 1). Whether that is a fine or, for example, an order subject to a penalty payment is their own choice in national law. More on that in lesson 5.

Lesson 2: for a municipality the amount counts, not turnover

In all three tiers the percentage applies only "if the offender is an undertaking" and if it is higher. A municipality carrying out public tasks is, as a rule, not an undertaking. For it, only the amount is then the maximum: 35, 15 or 7.5 million euros. That is a ceiling, not a tariff. For every fine the supervisor weighs, among other things, the nature, gravity and duration of the infringement, the number of people affected, the intentional or negligent character and the cooperation to remedy the infringement (paragraph 7).

For undertakings there are two reductions. For an SME or start-up the lower of amount and percentage applies in all three tiers (paragraph 6). For a small mid-cap enterprise the lower one applies only in the tiers of paragraphs 4 and 5 (paragraph 6a). For a prohibited practice a small mid-cap therefore pays the higher one, like a large undertaking.

Lesson 3: a fine is only possible once the obligation itself applies

The penalties chapter of the AI Act (Chapter XII) has applied since 2 August 2025; the fines for model providers in Article 101 since 2 August 2026 (Article 113). But a fine is only possible for an obligation that already applies:

• Prohibited practices (Article 5): since 2 February 2025. The new prohibitions on AI-generated non-consensual intimate images and child sexual abuse material apply from 2 December 2026.
• Transparency (Article 50), such as telling people they are talking to a chatbot and labelling deepfakes: since 2 August 2026.
• Obligations for high-risk systems in Annex III, such as Article 26 for deployers: from 2 December 2027. If a system intended to be used by public authorities has been placed on the market or put into service before that date, they apply only after a significant change, and at the latest from 2 August 2030 (Article 111(2)).

For the municipality in our example this means: Article 50 already applies to the chatbot, with the 15 million euro tier. But note who holds which obligation. Telling people they are interacting with AI is an obligation of the provider (Article 50(1)). If the municipality had the chatbot built and put it into service under its own name, it may be the provider. If it buys an off-the-shelf chatbot, that obligation lies with the vendor. As a deployer, the municipality must then mainly label deepfakes itself, and AI-generated text it publishes to inform residents on matters of public interest, unless an employee has reviewed the text and the municipality holds editorial responsibility for it (Article 50(4)). For the welfare model the high-risk obligations do not apply yet. A prohibition in Article 5, such as social scoring, does already apply. For such a model, also read our article on AI for fraud signals in social assistance.

Lesson 4: no Dutch supervisor can impose an AI Act fine yet

The AI Act sets the maximums but leaves imposing fines to the Member States. They lay down the rules on penalties and notify them to the Commission at the latest by the date of entry into application (Article 99(1) and (2)). Each Member State also decides to what extent public authorities can be fined (paragraph 8).

The Netherlands has not done this yet. No market surveillance authority for the AI Act has been designated. The bill that is to arrange this, the Dutch AI implementing act (Uitvoeringswet AI-verordening), was in public consultation from 20 April to 1 June 2026. According to the government's planning it will be submitted to the House of Representatives in the second quarter of 2027 (Parliamentary paper 26643, no. 1554). Both chambers of parliament then still have to deal with it.

Without that act, no Dutch supervisor can impose an AI Act fine. Only the European Commission can already fine, and only providers of general-purpose AI models (Article 101). The Dutch General Administrative Law Act (Awb) is clear: the power to impose an administrative sanction exists only insofar as it has been conferred by or pursuant to an act of parliament (Article 5:4(1) Awb). Nor does a fine work retroactively: a sanction may only be imposed if the offence and the sanction were laid down in a statutory provision before the conduct (Article 5:4(2) Awb). In our reading, only an infringement that continues after the implementing act enters into force can therefore be met with an AI Act fine. That is no free pass. The prohibitions and transparency obligations apply directly, and anyone breaching them now is breaking the law. Moreover, the same conduct can often already be fined under the GDPR today (lesson 6).

Lesson 5: what the Dutch bill proposes

The draft bill shows what is coming. It is a consultation version and may still change. Three points matter for municipalities.

The AP is the intended supervisor for many public sector uses. Under Article 2.2 of the draft the AP supervises the prohibited practices (together with the AFM and DNB, the financial supervisors) and the high-risk systems in Annex III points 1, 3, 4, 5(a) and (d), 6, 7 and 8(b). Point 5(a) covers systems public authorities use to assess whether someone is eligible for benefits, or to reduce, revoke or reclaim them. For the transparency obligations of Article 50, the AP and the AFM are the intended supervisors.

The FRIA becomes subject to fines. Article 3.7(2) of the draft gives the supervisors for Annex III the power to impose a fine up to the maximum in Article 99(4) (15 million euros) for, among others, Article 27 (the FRIA), Article 49(2) and (4) (certain registrations in the EU database) and Article 86 (the right to explanation). These provisions are not on the European list, but the Netherlands adds them. A municipality's own registration duty (Article 26(8) with Article 49(3)) is already on the European list, through Article 26. The AI literacy obligation of Article 4 is not in the fining provision. According to the memorandum, enforcement there stays limited to remedial sanctions, in particular an order subject to a penalty payment: an order to improve within a set period, on pain of a sum of money.

Fines on public bodies are not excluded. The explanatory memorandum says so in so many words: the provisions on administrative fines do not exclude that such fines are imposed on public authorities or bodies (section 4.5.4.2 of the draft explanatory memorandum). Under Article 5:1(2) Awb the offender is whoever commits or co-commits the offence, and according to the memorandum that includes public bodies. If this survives in the final act, a municipality can also receive an AI Act fine, up to the same fixed amount as a company, but without the turnover percentage.

Lesson 6: the GDPR fine already exists, for municipalities too

The GDPR also leaves it to Member States whether public bodies can be fined (Article 83(7) GDPR). The Netherlands has done so: the AP can impose an administrative fine on a public authority or body up to the amounts in Article 83(4) to (6) GDPR (Article 18 UAVG). That is up to 10 million euros, for example for a missing or late DPIA, and up to 20 million euros for breaching the principles, the legal basis or the ban on special category data.

The AP has done exactly that, in risk models and fraud detection:

• Tax Administration, 2.75 million euros (December 2021): applicants' nationality for childcare benefits was used, among other things, as an indicator in a system that automatically flagged applications as risky. According to the AP this was unlawful and discriminatory (AP press release, in Dutch).
• Tax Administration, 3.7 million euros (April 2022): the FSV blacklist, without a legal basis, with often incorrect data and an internal privacy supervisor who was not involved in time when the list was set up (AP press release, in Dutch).
• Ten municipalities, 250,000 euros in total (February 2026): files with sensitive information on the religion and political views of Muslim residents, which the municipalities were not allowed to hold, without those residents knowing. The AP took into account that the breaches were short, largely time barred and took place in a complex political and administrative context (AP press release, in Dutch).

A fine is not always the end of the story. In 2021 the AP fined the municipality of Enschede 600,000 euros for wifi tracking in the city centre. The district court revoked the fining decision, and the Council of State confirmed this on 29 July 2026: the AP had not proven in its decision that personal data were involved, and a new position it only took in court did not count (ECLI:NL:RVS:2026:4403, in Dutch). The lesson is not that wifi tracking is allowed. The lesson is that a public body too is entitled to a carefully proven decision.

Lesson 7: the same mistake can fall under two laws

A risk model that profiles residents on nationality without a legal basis breaches the GDPR today. If it is a high-risk system and those obligations apply, the same defect can also fall under the AI Act. Two fines do not simply add up. When fining under the AI Act the supervisor must take into account whether other market surveillance authorities have already fined the same operator for the same infringement, and whether other authorities have already fined it for infringements of other Union or national law resulting from the same act or omission (Article 99(7)(b) and (c)). Under the draft, the AP is moreover the intended supervisor under both laws for many public sector uses.

Also for banks and employers

A bank is an undertaking. For it the percentage applies if higher than the amount: up to 3 percent of worldwide annual turnover for the obligations in paragraph 4, and up to 4 percent under the GDPR. Under the draft, the AFM, DNB and the AP are the intended supervisors for creditworthiness and life and health insurance (Annex III point 5(b) and (c)).

An employer that has employees' emotions recognised at work has breached a prohibition since 2 February 2025 (Article 5(1)(f)), except for medical or safety reasons. That is the highest tier, and a small mid-cap gets no reduction there. For AI in recruitment and selection the high-risk obligations apply from 2 December 2027.

What to do now

1. List your AI uses and note for each which obligation already applies: a prohibition (Article 5), transparency (Article 50) or, later, the high-risk obligations.
2. Start with Article 50: check that your vendor has built the AI disclosure into the chatbot, and label deepfakes yourself, as well as AI-generated text you publish to inform residents, unless an employee has reviewed the text and the municipality holds editorial responsibility for it.
3. Treat the GDPR as the framework under which you can be fined today. For a risk model, do the DPIA before the system goes live and involve the DPO in time.
4. Follow the bill: if the FRIA fine stays in, the FRIA is no longer an optional document for municipalities.
5. Want to see quickly which obligations apply to your use? Run the case check.

More on the transparency obligations and their enforcement in Article 50: enforcement and fines. On the AP's enforcement policy under the GDPR we wrote the Dutch DPA's enforcement policy for municipalities.