Guide
EU AI Act Penalties & Enforcement
Fines under the EU AI Act are substantial — up to €35 million or 7% of global annual turnover. Here's what you need to know about enforcement and how to stay compliant.
How enforcement works
The EU AI Act is enforced by national regulators in each EU member state. Each country must designate a national competent authority responsible for monitoring compliance and imposing penalties. The European AI Office coordinates enforcement at the EU level.
Fines are structured in three tiers, proportional to the severity of the violation. The exact fine depends on the type of violation, the size of the organisation, and the duration of non-compliance.
Fine amounts by violation type
Banned AI practices — up to €35M or 7% of global turnover
For violations involving prohibited AI practices (unacceptable risk systems like social scoring or untargeted biometric surveillance): fines can reach up to €35 million or 7% of global annual turnover, whichever is higher. This is the maximum penalty under the Act.
High-risk obligations — up to €15M or 3% of global turnover
For failing to meet high-risk AI obligations (risk management, technical documentation, human oversight, etc.): fines can reach up to €15 million or 3% of global annual turnover. This covers most compliance failures — missing documentation, inadequate risk management, or failure to implement human oversight.
Incorrect information — up to €7.5M or 1% of global turnover
For supplying incorrect or incomplete information to authorities or notified bodies: fines can reach up to €7.5 million or 1% of global annual turnover. This includes misleading regulators about your system's capabilities, risk level, or compliance status.
Enforcement timeline
The EU AI Act entered into force in August 2024 with obligations phasing in over several years:
- February 2025 — Banned practices took effect. Prohibitions on unacceptable-risk AI are now enforceable.
- August 2025 — GPAI rules apply. Rules for general-purpose AI models kicked in.
- August 2026 — Transparency obligations. Article 50 rules for AI-generated content labelling came into force.
- December 2027 — High-risk obligations. Full compliance required for Annex III systems covering employment, credit, education, law enforcement, and critical infrastructure.
Enforcement is handled by national regulators with wide discretion. The message is clear: compliance is not optional, and the penalties are designed to be meaningful even for large organisations.
Don't risk non-compliance
Generate your compliance documentation package in minutes with Evideva.