YTYK You think you know

Card 14 of 15 Dates, penalties, and literacy ●●○ Working knowledge

Three penalty bands

Penalties are tiered: up to €35 million or 7% of worldwide annual turnover for prohibited practices; up to €15 million or 3% for most other breaches, including the high-risk and GPAI obligations; and up to €7.5 million or 1.5% for supplying incorrect or misleading information to authorities.

Why it is like this

The ceilings rank the harms. The highest band is reserved for the uses the regulation decided should not exist at all.

Not to be confused with

A single GDPR-style 4% ceiling. The top band here is higher, and the lowest band — for misleading an authority — is the one organisations trip over during an investigation.

In practice

For SMEs and start-ups, each ceiling is the lower of the fixed amount and the percentage, rather than the higher.

Source: Regulation (EU) 2024/1689 (AI Act) — Article 99. Read on .

Predict Check yourself

An SME is fined under the 3% band. Its turnover-based figure is €400,000 and the fixed ceiling is €15 million. What is the maximum?

  1. €400,000 — for SMEs and start-ups each ceiling is the lower of the two figures.
  2. €15 million — the fixed ceiling always applies.
  3. €15.4 million — the two are cumulative.
  4. €7.5 million — SMEs fall automatically into the lowest band.
Show the answer

€400,000 — for SMEs and start-ups each ceiling is the lower of the two figures.

Article 99(6) inverts the usual rule for SMEs. For everyone else it is the higher of the two.