AI Act Fines: When Turnover-Based Penalties Apply
The EU AI Act sets fines by comparing fixed amounts with a percentage of global turnover. Here’s when the percentage becomes larger, and what the SME rule changes.
👁 114 reads
The EU AI Act’s penalty rules have applied since 2 August 2025. Headlines often reduce them to “up to €35 million or 7% of global turnover,” but that shorthand leaves out an important detail: the authority applies whichever amount is higher. I’ve worked through the thresholds to show when the percentage-based figure overtakes the fixed amount - and how the rules differ for small and medium-sized enterprises (SMEs).
The highest tier covers prohibited practices under Article 5, including social scoring, real-time remote biometric identification in publicly accessible spaces, and emotion recognition in workplaces and schools. Article 99(3) sets the maximum at €35 million or 7% of total worldwide annual turnover, whichever is higher. The second tier, in paragraph 4, covers breaches of obligations for providers and deployers of high-risk systems: €15 million or 3% of turnover. The third, in paragraph 5, covers supplying authorities with incorrect, incomplete or misleading information: €7.5 million or 1% of turnover.
When does a percentage-based AI Act fine exceed the fixed amount?
The calculation is straightforward. Since the authority applies the higher of the two figures, the percentage-based fine for the first tier exceeds €35 million only when 7% of worldwide annual turnover is greater than €35 million. Dividing 35 by 0.07 gives €500 million in annual worldwide turnover. The second tier reaches the same threshold: €15 million divided by 0.03 is also €500 million. For the third tier, the threshold is higher: €7.5 million divided by 0.01 is €750 million.
Below those thresholds, the fixed amount is higher than the corresponding percentage of turnover. Above them, the percentage can exceed the fixed amount. The threshold differs by tier, so it is worth checking the calculation that applies to the specific breach rather than assuming that one turnover figure covers every penalty.
There is another important detail in paragraph 6 of the same article, which is often missing from summaries. For SMEs, including start-ups, a fine in any of the three categories must not exceed the lower of the percentage or fixed amount. That means the ordinary “whichever is higher” calculation does not apply to these businesses in the same way: the SME rule sets a ceiling based on the lower figure.
Which AI systems count as high-risk under the AI Act?
The list in Annex III is specific. For employment, it includes systems used for recruitment - particularly targeted job advertising, analysing and filtering applications, and evaluating candidates - as well as systems used to make decisions about promotion or termination, assign tasks based on people’s behaviour or personal traits, or monitor and evaluate performance. In finance, it includes assessing the creditworthiness of natural persons, except systems used to detect financial fraud, and assessing risk and setting prices for life and health insurance.
In practical terms, an automated CV-ranking tool used in recruitment can fall into the high-risk category. So can a scoring model used to assess individual borrowers, or a system that measures employees’ work performance and uses that assessment to allocate bonuses. By contrast, using ChatGPT to draft a job advert, a graphic generator for social media, or an assistant to summarise emails does not make those tools high-risk by itself. The deciding factor is the system’s intended function, not the technology used.
“For SMEs, including start-ups, each fine referred to in this Article must not exceed the percentages or amounts referred to in paragraphs 3, 4 and 5, whichever is lower.” This is a translation of the original Polish wording of Article 99(6), not a verbatim quotation from the English text. - Article 99(6) of Regulation 2024/1689 on EUR-Lex
Why the AI Act’s fines are only part of the compliance picture
The regulation required EU member states to designate a notifying authority and a market surveillance authority by 2 August 2025. National implementation and enforcement arrangements may differ, so check the status with the relevant authority in your country. The absence of a designated authority does not mean that the regulation creates no obligations.
The rules on penalties have applied since August 2025. Obligations for high-risk systems listed in Annex III apply from 2 August 2026. The prohibition on certain practices under Article 5, along with the obligation to ensure AI literacy among staff, has applied since 2 February 2025. The AI literacy requirement in Article 4 applies to providers and deployers: if you provide staff with AI tools for work, you must take measures to ensure they have sufficient AI literacy, taking account of their knowledge, experience, education and training, as well as the context in which the systems will be used.
GDPR obligations can apply to automated decisions already
If your organisation uses an algorithm to screen applicants, Article 22 of the GDPR may already be relevant. It restricts decisions based solely on automated processing when they produce legal effects or similarly significantly affect a person. In applicable cases, a person has the right to obtain human intervention, express their point of view and contest the decision. GDPR fines can reach €20 million or 4% of annual worldwide turnover, whichever is higher.
Employment discrimination rules are also relevant. An algorithm trained on historical hiring data can reproduce discriminatory patterns, including indirect discrimination. In its December 2023 judgment in C-634/21 (SCHUFA), the Court of Justice of the European Union held that the automated creation of a credit score by a credit information agency can itself amount to automated decision-making under Article 22 when the recipient relies heavily on that score in making its decision.
Google · Your sourcesQuantslant higher in your Google - one clickAdd to preferred sources →What to do if your organisation uses AI
Start by listing where algorithms affect decisions about people: recruitment, promotion, bonuses, termination, loans or insurance premiums. If your AI use is limited to tasks such as drafting text or creating graphics, that alone does not make it a high-risk system. If it affects decisions about people, check whether the system falls within the categories in Annex III and clarify in your supplier contract who qualifies as the provider under the regulation.
Deployers’ obligations under Article 26 are generally different from providers’ obligations under Article 16. They include human oversight, keeping logs under your control for at least six months, and informing workers and their representatives before putting a high-risk system into use in the workplace.
Next, document your measures to ensure staff AI literacy. Article 4 does not prescribe a certificate or require an external training provider. Keep a record of the steps you have taken, such as internal training materials and attendance records.
Finally, check whether any tool you use recognises emotions in the workplace. Emotion recognition in workplaces is prohibited under Article 5, except where the system is intended for medical or safety reasons. It is not simply another high-risk use, so check whether the prohibition applies before continuing to use such a tool.
Facts checked on 25 October 2026. Penalty thresholds and application dates were checked against Regulation 2024/1689.
Sources:
