Skip to main content
The AI Guys

What AI mistakes can cost under EU law

The maximum fines in five EU laws, and fines already imposed, each with its source.

€35 million or 7%

For using a prohibited AI practice

€15 million or 3%

For breaking the obligations the Act lists, such as the transparency duties

€7.5 million or 1%

For giving an authority incorrect information

Every ceiling on this page is the most the law allows, not what is usually imposed. Authorities weigh the breach, the size of the organisation and its conduct; smaller firms face a lower ceiling under the EU AI Act.

We build AI that holds up under these rules. See the AI solutions we build.

Tell us what you want to buildTalk to a partner

The EU AI Act

The European Union Artificial Intelligence Act (EU AI Act) reaches every organisation that provides, imports, distributes or uses AI.

A fine can only follow a duty that applies, so read each ceiling with its date.

  • €35 million or 7%

    Using a prohibited AI practice: up to €35 million or 7% of worldwide annual turnover, whichever is higher.

    Article 99(3), from 2 August 2025

    Source

    Source: Regulation (EU) 2024/1689, Article 99(3), Official Journal text on EUR-Lex, accessed 5 October 2026.

    Non-compliance with the prohibition of the AI practices referred to in Article 5 shall be subject to administrative fines of up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

  • €15 million or 3%

    Breaking the other duties the Act lists, such as the transparency duties: up to €15 million or 3% of worldwide annual turnover, whichever is higher.

    Article 99(4), from 2 August 2026

    Source

    A fine can only follow a duty that applies: the transparency duties from 2 August 2026, the high-risk duties from 2 December 2027 and 2 August 2028.

    Source: EU AI Act, Article 99(4), consolidated version of 27 July 2026, EUR-Lex, accessed 5 October 2026.

    Non-compliance with any of the following provisions related to operators or notified bodies, other than those laid down in Articles 5, shall be subject to administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher: (a) obligations of providers pursuant to Article 16; (b) obligations of authorised representatives pursuant to Article 22; (c) obligations of importers pursuant to Article 23; (d) obligations of distributors pursuant to Article 24; (da) obligations of providers and operators pursuant to Article 25(2) and (4); (e) obligations of deployers pursuant to Article 26; (f) requirements and obligations of notified bodies pursuant to Article 31, Article 33(1), (3) and (4) or Article 34; (g) transparency obligations for providers and deployers pursuant to Article 50.

  • €7.5 million or 1%

    Giving an authority incorrect, incomplete or misleading information: up to €7.5 million or 1% of worldwide annual turnover, whichever is higher.

    Article 99(5), from 2 August 2025

    Source

    Source: Regulation (EU) 2024/1689, Article 99(5), Official Journal text on EUR-Lex, accessed 5 October 2026.

    The supply of incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request shall be subject to administrative fines of up to EUR 7 500 000 or, if the offender is an undertaking, up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

  • 3% or €15 million

    The European Commission can fine providers of general-purpose AI models up to 3% of worldwide annual turnover or €15 million, whichever is higher.

    Article 101(1), from 2 August 2026

    Source

    Source: Regulation (EU) 2024/1689, Article 101(1), Official Journal text on EUR-Lex, accessed 5 October 2026.

    The Commission may impose on providers of general-purpose AI models fines not exceeding 3 % of their annual total worldwide turnover in the preceding financial year or EUR 15 000 000 [...] whichever is higher

Fines regulators have already imposed

All of them were imposed under the General Data Protection Regulation (GDPR).

Not verified: we did not check the outcome with the authority.

The GDPR

It reaches every organisation that handles personal data, the data an AI system uses included.

  • €20 million or 4%

    Breaking the basic principles, the rights of data subjects or the rules on transfers outside the EU: up to €20 million or 4% of worldwide annual turnover, whichever is higher.

    Article 83(5), from 25 May 2018

    Source

    Source: Regulation (EU) 2016/679, Article 83(5), Official Journal text on EUR-Lex, accessed 5 October 2026.

    Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: (a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9; (b) the data subjects' rights pursuant to Articles 12 to 22; (c) the transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49;

  • €10 million or 2%

    Breaking the organisational duties, such as security, breach notification and impact assessments: up to €10 million or 2% of worldwide annual turnover, whichever is higher.

    Article 83(4), from 25 May 2018

    Source

    Source: Regulation (EU) 2016/679, Article 83(4), Official Journal text on EUR-Lex, accessed 5 October 2026.

    Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: (a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43;

DORA

It reaches financial firms and their technology suppliers; each member state sets the fines on the firms.

  • 1% of average daily worldwide turnover, per day, for up to six months

    A technology supplier designated as critical pays this when it does not comply with its overseer.

    Article 35(7) and 35(8), from 17 January 2025

    Source

    It is a daily payment for a critical supplier, not a fine on annual turnover; fines on financial firms are set by each member state.

    Source: Regulation (EU) 2022/2554, Article 35(7) and 35(8), Official Journal text on EUR-Lex, accessed 5 October 2026.

    Article 35(7): The periodic penalty payment referred to in paragraph 6 shall be imposed on a daily basis until compliance is achieved and for no more than a period of six months following the notification of the decision [...] Article 35(8): The amount of the periodic penalty payment, calculated from the date stipulated in the decision imposing the periodic penalty payment, shall be up to 1 % of the average daily worldwide turnover of the critical ICT third-party service provider in the preceding business year.

  • €5 million or 10% of net turnover

    In the Netherlands, breaking the board or supplier duties of DORA: up to €5 million per infringement, or 10% of net turnover if that is more.

    Articles 1:81 and 1:82; Bijlage 35, point 2

    Source

    It is the maximum of Dutch fine category 3 as the law stood on 5 October 2026, and it doubles for a repeat within five years.

    Source: Wet op het financieel toezicht, Articles 1:81 and 1:82, and Besluit EU-verordeningen Wft, Bijlage 35 (wetten.overheid.nl), accessed 5 October 2026.

    Besluit EU-verordeningen Wft, Bijlage 35, table under "Bestuurlijke boete" with the columns "Artikelen" and "Boetecategorie": "5 tot en met 10" with category "3"; "28, eerste tot en met achtste lid" with category "3"; "29" with category "3"; "30, eerste tot en met derde lid" with category "3". Wet op het financieel toezicht, Article 1:81(2), row for category 3: "3", "€ 2 500 000,–", "€ 0,–", "€ 5 000 000,–." Article 1:82(1): "ten hoogste 10% van de netto-omzet van de overtreder in het boekjaar voorafgaande aan de beschikking waarmee de bestuurlijke boete wordt opgelegd, indien dit meer is". Article 1:81(4): "ten hoogste tweemaal het ingevolge het tweede of derde lid toepasselijke maximumbedrag".

The Cyber Resilience Act

It reaches makers and sellers of software and connected products, which the law calls products with digital elements.

A company falls under it for the products it sells, not for the sector it is in.

  • €15 million or 2.5%

    Not meeting the essential cybersecurity requirements or the duties of manufacturers: up to €15 million or 2.5% of worldwide annual turnover, whichever is higher.

    Article 64(2), from 11 December 2027

    Source

    The reporting duty has applied since 11 September 2026; the fines apply from 11 December 2027.

    Source: Regulation (EU) 2024/2847, Article 64(2), Official Journal text on EUR-Lex, accessed 5 October 2026.

    Non-compliance with the essential cybersecurity requirements set out in Annex I and the obligations set out in Articles 13 and 14 shall be subject to administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 2,5 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher.

  • €10 million or 2%

    Breaking the other duties it lists, such as those of importers and distributors: up to €10 million or 2% of worldwide annual turnover, whichever is higher.

    Article 64(3), from 11 December 2027

    Source

    An open-source software steward cannot be fined under it.

    Source: Regulation (EU) 2024/2847, Article 64(3), Official Journal text on EUR-Lex, accessed 5 October 2026.

    Non-compliance with the obligations set out in Articles 18 to 23, Article 28, Article 30(1) to (4), Article 31(1) to (4), Article 32(1), (2) and (3), Article 33(5), and Articles 39, 41, 47, 49 and 53 shall be subject to administrative fines of up to EUR 10 000 000 or, if the offender is an undertaking, up to 2 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

  • €5 million or 1%

    Giving an authority incorrect, incomplete or misleading information: up to €5 million or 1% of worldwide annual turnover, whichever is higher.

    Article 64(4), from 11 December 2027

    Source

    An open-source software steward cannot be fined under it.

    Source: Regulation (EU) 2024/2847, Article 64(4), Official Journal text on EUR-Lex, accessed 5 October 2026.

    The supply of incorrect, incomplete or misleading information to notified bodies and market surveillance authorities in reply to a request shall be subject to administrative fines of up to EUR 5 000 000 or, if the offender is an undertaking, up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

  • no administrative fine

    A micro or small manufacturer cannot be fined for missing the early warning due within 24 hours, and an open-source software steward cannot be fined at all.

    Article 64(10), from 11 December 2027

    Source

    Every other duty and every later deadline can still be fined, and medium-sized firms have no such exception. The authority weighs the size of every company when it sets the amount.

    Source: Cyber Resilience Act, Article 64(10) as corrected on 2 July 2025, and Article 64(5)(c), EUR-Lex, accessed 5 October 2026.

    Article 64(10): By way of derogation from paragraphs 2 to 9, the administrative fines referred to in those paragraphs shall not apply to the following: (a) manufacturers that qualify as microenterprises or small enterprises with regard to any failure to meet the deadline referred to in Article 14(2), point (a), or Article 14(4), point (a); (b) any infringement of this Regulation by open-source software stewards. Article 64(5), point (c): the size, in particular with regard to microenterprises and small and medium sized-enterprises, including start-ups, and the market share of the economic operator committing the infringement.

NIS2 and the Cyberbeveiligingswet

They reach organisations the law calls essential or important, such as energy, water and transport operators; NIS2 itself fines no one.

  • at least €10 million or 2%

    Each member state must allow fines on essential entities of at least €10 million or 2% of worldwide annual turnover, whichever is higher, from 18 October 2024.

    Article 34(4)

    Source

    This is the lowest maximum a member state may set, not what is usually imposed. The Directive fines no one itself; the binding amount is in national law.

    Source: Directive (EU) 2022/2555, Article 34(4), Official Journal text on EUR-Lex, accessed 5 October 2026.

    essential entities are subject, in accordance with paragraphs 2 and 3 of this Article, to administrative fines of a maximum of at least EUR 10 000 000 or of a maximum of at least 2 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the essential entity belongs, whichever is higher.

  • at least €7 million or 1.4%

    Each member state must allow fines on important entities of at least €7 million or 1.4% of worldwide annual turnover, whichever is higher, from 18 October 2024.

    Article 34(5)

    Source

    This is the lowest maximum a member state may set, not what is usually imposed. The Directive fines no one itself; the binding amount is in national law.

    Source: Directive (EU) 2022/2555, Article 34(5), Official Journal text on EUR-Lex, accessed 5 October 2026.

    important entities are subject, in accordance with paragraphs 2 and 3 of this Article, to administrative fines of a maximum of at least EUR 7 000 000 or of a maximum of at least 1,4 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the important entity belongs, whichever is higher.

  • €10 million or 2%

    Under the Dutch Cyberbeveiligingswet an essential entity that breaks the duty of care or the reporting duties: up to €10 million or 2% of worldwide annual turnover, whichever is higher.

    Article 80, third paragraph, from 15 August 2026

    Source

    Whether you are an essential entity depends on the scope of the law.

    Source: Cyberbeveiligingswet, Article 80(3), text valid from 15 August 2026 (wetten.overheid.nl), accessed 5 October 2026.

    € 10.000.000,– of 2% van de totale wereldwijde jaaromzet in het voorgaande boekjaar van de onderneming waartoe de essentiële entiteit behoort, indien het laatstbedoelde bedrag hoger is

  • €7 million or 1.4%

    Under the Dutch Cyberbeveiligingswet an important entity: up to €7 million or 1.4% of worldwide annual turnover, whichever is higher.

    Article 87, third paragraph, from 15 August 2026

    Source

    Whether you are an important entity depends on the scope of the law.

    Source: Cyberbeveiligingswet, Article 87(3), text valid from 15 August 2026 (wetten.overheid.nl), accessed 5 October 2026.

    € 7.000.000,– of 1,4% van de totale wereldwijde jaaromzet in het voorgaande boekjaar van de onderneming waartoe de belangrijke entiteit behoort, indien het laatstbedoelde bedrag hoger is

Smaller firms face a lower ceiling

The rule covers the EU AI Act only, not the other laws on this page.

  • whichever is lower

    For small and medium-sized enterprises, start-ups included, each ceiling of the EU AI Act is the amount or the percentage, whichever is lower.

    Article 99(6) and (6a), from 2 August 2025

    Source

    Since 27 July 2026 this also covers small mid-cap enterprises, for the ceilings of €15 million and €7.5 million only. It lowers the ceiling; it does not take a firm outside the fines.

    Source: EU AI Act, Article 99(6) and (6a), consolidated version of 27 July 2026, EUR-Lex, accessed 5 October 2026.

    Article 99(6): In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower. Article 99(6a): In the case of SMCs, each fine referred to in paragraphs 4 and 5 shall be up to the percentages or amount referred therein, whichever is lower.

When each rule applies

When each rule applies
DateLawWhat appliesSource
2 February 2025EU AI ActMost prohibitions on AI practices apply, and so does the duty to support the AI literacy of staff.Source
2 August 2026EU AI ActThe Act applies in general, the transparency duties and the European Commission's fines on model providers included.Source
2 December 2026EU AI ActTwo added prohibitions apply, and generative systems on the market before 2 August 2026 must mark their output.Source
2 December 2027EU AI ActThe rules for high-risk systems start to apply for the uses listed in Annex III; they do not apply before this date.Source
2 August 2028EU AI ActThe rules for high-risk systems start to apply for AI in products under Annex I, such as medical devices; they do not apply before this date.Source
2 August 2030EU AI ActProviders and deployers of high-risk systems intended to be used by public authorities must comply by this date.Source
17 January 2025DORADORA applies to financial entities in the EU.Source
11 September 2026Cyber Resilience ActManufacturers must report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act.Source
11 December 2027Cyber Resilience ActThe Cyber Resilience Act applies in general, its fines included; an older product only once it is substantially modified.Source

Last checked on .