EU AI Act Article 99: penalties, ceilings, and SME proportionality

The penalty ladder

Article 99(3): non-compliance with Article 5 prohibited practices - up to €35M or 7% of global annual turnover for the preceding financial year, whichever is higher.

Article 99(4): non-compliance with provisions other than Article 5 (high-risk obligations, Article 50 transparency, GPAI Article 53 and 55) - up to €15M or 3% of global annual turnover.

Article 99(5): supplying incorrect, incomplete, or misleading information to notified bodies or national authorities - up to €7.5M or 1% of global annual turnover.

Article 99(6): SME and start-up proportionality - the lower of the two amounts (absolute or percentage) applies.

What 'global annual turnover' means

Article 99 uses global turnover, not EU turnover. For a SaaS with €5M ARR globally and €1M EU revenue, the high-risk penalty ceiling is €150,000 (3% of €5M global) not €30,000 (3% of €1M EU). For multinational groups, the relevant turnover is the parent group's consolidated global revenue. This makes the ceiling theoretically very high for established companies and provides regulators with significant leverage.

SME proportionality under Article 99(6)

For SMEs (under 250 employees, under €50M turnover) and start-ups, Article 99(6) applies the lower of the absolute amount or the percentage of turnover. This typically reduces small-SaaS exposure substantially. National authorities also have proportionality discretion under Article 99(7), considering factors: nature, gravity, and duration of the infringement; intentional or negligent character; previous violations; cooperation; remediation; size of the operator. In practice, SME first-offence fines often land at 10-30% of the theoretical ceiling.

Enforcement authorities and procedure

Article 99(8) requires member states to lay down rules on penalties applicable to infringements by Union institutions, agencies, and bodies (the European Data Protection Supervisor handles this). National authorities handle private-sector enforcement following member-state procedural law. Typical procedure: investigation triggered by complaint or supervisory action, notice of preliminary findings, opportunity to respond, decision, administrative appeal route, judicial review. Average resolution time: 12 to 24 months from initial complaint.

What enforcement actually looks like

Based on early signals from the GDPR enforcement era plus 2025-2026 AI Act enforcement actions (Article 5 cases since February 2025), expect: most first-offence cases resolved via compliance orders without fines; clear violations of Article 50 transparency drawing €10,000 to €500,000 fines; clear violations of Article 5 prohibitions or high-risk obligations drawing €100,000 to €2M fines; severe or repeated violations approaching the absolute ceilings. The procurement and reputational cost typically exceeds the fine itself by 5-10x.

Frequently asked questions

What is the maximum EU AI Act penalty?

€35M or 7% of global annual turnover, whichever is higher. Applies to Article 5 prohibited practice violations.

When do penalties apply?

Article 5 penalties since 2 February 2025. Other penalties from 2 August 2026.

Are SMEs really exempt from large fines?

Not exempt - SMEs benefit from proportionality. The lower of absolute or percentage ceiling applies, and national authorities apply discretion reducing fines further. Typical first-offence SME fines: 10-30% of theoretical ceiling.

Can fines be cumulative across articles?

Yes - a single incident can trigger multiple article violations. Cumulative fines are possible. Article 99(7) directs authorities to ensure the overall penalty is proportionate.

What is the appeal process?

Administrative appeal within the national enforcement authority, then judicial review through national courts, with potential reference to the Court of Justice of the European Union on points of EU law.

Sources

• https://eur-lex.europa.eu/eli/reg/2024/1689/oj