Guide · Last reviewed 26 August 2026
EU AI Act fines: how much, for what — and the cap for SMEs
The EU AI Act carries three tiers of administrative fines. Since the Digital Omnibus (Regulation (EU) 2026/1744), the rules for smaller companies are explicitly gentler — a point many summaries still miss.
For violations of the Article 5 prohibited practices — social scoring, manipulative techniques, emotion recognition in the workplace, and (from 2 December 2026) the new prohibitions on generating CSAM and non‑consensual intimate imagery.
For most other violations — including the Article 50 transparency duties, high‑risk obligations, and GPAI model duties enforced by the AI Office since August 2026.
For supplying incorrect, incomplete or misleading information to authorities.
The SME rule: the lower amount applies
For each tier the general rule takes whichever is higher — but Article 99(6) reverses this for SMEs, including start‑ups: they pay whichever of the percentage and the fixed amount is lower. The Digital Omnibus extended comparable relief to small mid‑caps (companies below 750 employees, defined in Recommendation (EU) 2025/1099). Fines must also be effective, proportionate and dissuasive in the individual case — authorities weigh the violation's nature, duration and the company's cooperation.
Who enforces
National market‑surveillance authorities enforce most of the Act; the AI Office enforces GPAI model duties and acts as market‑surveillance authority for certain systems built on a provider's own general‑purpose model (Article 75). Enforcement of the transparency duties began with their applicability on 2 August 2026.