The EU AI Act introduces strict obligations for any organization that develops, deploys, or distributes AI affecting people in the EU. For those who don't comply, penalties can reach up to 7% of global annual turnover — and financial fines are rarely the only consequence. Understanding what non-compliance actually costs is the first step toward taking compliance seriously.
What are the EU AI Act fines?
Fines are not applied uniformly. Regulators take into account the severity, duration, intentionality, and financial benefit of the violation, the number of people affected, and the organization's cooperation with the authorities. Within each tier, the exact amount is determined case by case.
There are three tiers:
-
7% of global annual turnover or €35 million (whichever is higher). The highest tier, reserved for the most serious violations. This applies to organizations that deploy AI systems that are banned outright under the Act: social scoring, real-time biometric surveillance, manipulative AI.
-
3% of global annual turnover or €15 million (whichever is higher). The middle tier, which covers violations of the core obligations that apply to high-risk systems and general-purpose AI models. This includes failing to conduct conformity assessments, inadequate human oversight, insufficient technical documentation, or non-compliance with transparency requirements.
-
1% of global annual turnover or €7.5 million (whichever is higher). The lowest tier, applied when organizations provide incorrect, incomplete, or misleading information to regulators or notified bodies during an investigation or audit.
In all cases, fines are calculated based on global annual turnover, not EU revenue. For large multinationals, the numbers involved can be substantial even at the lowest tier. For smaller organizations, the fixed euro amounts mean that even modest revenue companies would face significant fines.
Additional risks to your organization
Financial penalties are the most visible consequence of non-compliance, but they are rarely the only one. Organizations that deploy AI irresponsibly will face a broader set of risks.
-
Reputational damage. When AI failures become public, the consequences can outlast any regulatory fine. Loss of client trust, media scrutiny, and lasting association with discriminatory or unsafe AI will be difficult to recover from.
-
Forced system shutdown. Regulators can order non-compliant AI systems to be withdrawn from the market immediately. For organizations whose products or operations depend on those systems, this can mean halting services and losing clients overnight.
-
Increased regulatory scrutiny. A finding of non-compliance does not end with a fine. Organizations that have been flagged are subject to closer monitoring going forward, and repeat violations are explicitly considered an aggravating factor in determining the size of future penalties.
How it looks in practice
To understand the penalty structure better, let's use the example of an HR technology company based in the EU. It builds AI tools for recruitment, uses third-party AI in its operations, and relies on everyday AI for internal productivity.
-
They built a CV screening tool that automatically ranks and shortlists job candidates, which is a high-risk AI system. If deployed without a conformity assessment, human oversight mechanisms, or proper documentation, the company is in violation of its provider obligations. This falls under the 3% tier: up to €15 million or 3% of global annual turnover, whichever is higher. If the system is also found to be biased against protected groups, civil complaints and media scrutiny are likely to compound the regulatory fine.
-
They use a third-party AI chatbot to communicate with candidates, which is a limited-risk system, and a deployer obligation. If candidates are not informed they are interacting with AI, the company is in violation of its transparency obligations. This also falls under the 3% tier: up to €15 million or 3% of global annual turnover, whichever is higher.
-
They use an AI grammar checker internally, which is a minimal-risk system. No specific obligations beyond basic AI literacy apply, and non-compliance here is unlikely to trigger formal enforcement.
The penalties associated with the EU AI Act are significant, but they are avoidable. Organizations that assess their AI systems early and address compliance gaps proactively are much less likely to struggle once the compliance deadlines arrive.