Obligations
Penalties and enforcement
Who enforces the AI Act, the three tiers of fines, and why the proportionate treatment of SMEs matters more than the headline numbers.
Updated 3 July 2026 · Reference material, not legal advice
The AI Act is enforced by national authorities, with the European Commission taking the lead on general-purpose AI models. Understanding who does what — and how fines actually work — is more useful than any maximum-fine banner.
Who enforces
Each Member State designates a market-surveillance authority (and a notifying authority). These bodies receive risk notifications and serious-incident reports, handle complaints, run conformity oversight, and can order corrective action, withdrawal or recall. For general-purpose AI models, the Commission (AI Office) is the exclusive supervisor. Any person may lodge a complaint with a market-surveillance authority (Article 85).
The three tiers of fines (Article 99)
Penalties are graduated by the seriousness of the breach — the higher of a fixed amount or a percentage of worldwide annual turnover:
- Prohibited practices (Article 5): up to €35 million or 7%.
- Other operator obligations (providers, deployers, importers, distributors, notified bodies, transparency): up to €15 million or 3%.
- Incorrect or misleading information to authorities: up to €7.5 million or 1%.
Providers of general-purpose AI models face a separate regime (Article 101, up to €15 million or 3%).
The part that matters for smaller organisations
For SMEs and start-ups, the applicable cap is the lower of the fixed amount and the percentage — a deliberate proportionality rule. When deciding on a fine, authorities also weigh the nature and gravity of the breach, the operator’s size and turnover, cooperation, whether the operator self-reported, and whether the conduct was intentional or negligent.
Reading this honestly
The headline figures are real, but they are ceilings applied by authorities weighing many factors — not automatic penalties. The productive response is not fear; it is being able to answer, calmly, which of our systems is affected, by when, and where is the evidence.
What this means in practice
Euridium presents the enforcement picture factually — the tiers, the proportionate SME treatment, and the named authority for your country — so you can plan rather than panic.
Run a guided assessment and get the obligations that apply to your role.
This guide is a plain-language summary for orientation. The authoritative text is Regulation (EU) 2024/1689 as published in the Official Journal of the European Union (12 July 2024). It does not constitute legal advice.