How big are the fines under the AI Act and GDPR?
Short answer
The AI Act has three fine caps: up to €35 million or 7% of global annual turnover for prohibited AI, up to €15 million or 3% for most other requirements (for example high-risk obligations and Article 50) and up to €7.5 million or 1% for supplying incorrect information to the authorities. For small and medium-sized businesses, the lower of the amount and the percentage applies. GDPR has caps of €20 million or 4% and €10 million or 2%. The authorities can also issue warnings and orders.
The fine caps
| Infringement | Maximum fine | Legal basis |
|---|---|---|
| Prohibited AI practices | €35 million or 7% of worldwide annual turnover | Art. 99(3) AI Act |
| Other AI Act requirements, e.g. human oversight, logging and transparency obligations | €15 million or 3% | Art. 99(4) AI Act |
| Automated decision-making, data subject rights and transfers outside the EU | €20 million or 4% | Art. 83(5) GDPR |
| E.g. a missing data protection impact assessment (DPIA) or no data protection by design | €10 million or 2% | Art. 83(4) GDPR |
The fine is rarely the biggest cost
For most small businesses, the risk isn't the big fine but an order to stop using an AI tool, demands from customers and employees, and lost trust. That is why it makes sense to get the basics in place: a register of how you use AI, a policy, a course and records showing that people decide matters about people.
What to do
- Stop prohibited uses.The highest cap applies to prohibited AI.
- Document what you do.A register, policy, course and recorded decisions show that you take the rules seriously.
- Fix mistakes quickly.The authorities look at whether you have cooperated and put things right.
What the law says
- Article 99 AI Act – penalties
- Fine caps, consideration for small businesses and – after the Digital Omnibus – warnings and non-monetary measures.
- Article 83 GDPR – administrative fines
- Caps of €20 million / 4% and €10 million / 2%.
Questions and answers
Do small businesses get lower fines?
Yes. For small and medium-sized businesses, the lower of the amount and the percentage applies. The authorities must also take the business's economic viability into account.
Who imposes the fines?
That depends on the country. Under GDPR, the national supervisory authority usually imposes fines; in a few countries, such as Denmark and Estonia, the courts do. Under the AI Act, each Member State sets its own penalty rules and authorities.
What does it cost not to have AI literacy?
Article 4 falls under national penalty rules. Supervision of Article 4 began in August 2026.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.