What Fines Can the EU AI Act Impose?

November 3, 2026 · Wilhelm von Baumbach · 10 min read

Under Article 99 of Regulation (EU) 2024/1689, breaches of the EU AI Act’s transparency and labelling obligations can be fined up to EUR 15 million or 3 percent of worldwide annual turnover for the preceding financial year, whichever is higher. For prohibited AI practices, the ceiling rises to up to EUR 35 million or 7 percent. The penalty provisions have applied since 2 August 2025, but they only take effect once the relevant obligation itself applies. (Source: Regulation (EU) 2024/1689, Article 99; European Commission, Digital Strategy, as of 11 May 2026)

If you use AI video or AI content in your marketing and want to build compliance properly, you will find more on our service page for AI advertising.

What is the maximum fine?

The EU AI Act’s penalty framework is set out in Article 99 of Regulation (EU) 2024/1689. Fines are tiered by the severity of the infringement, and there are three categories in total.

(Source: Regulation (EU) 2024/1689, Article 99(3), (4) and (5))

In all three cases, the higher amount applies. For a company with worldwide annual turnover of EUR 500 million, the maximum penalty for a breach of the transparency obligations is therefore EUR 15 million, because 3 percent of turnover (EUR 15 million) equals the fixed amount. For a company with EUR 2 billion in turnover, it would be EUR 60 million.

Which category applies to missing labels on AI content?

For companies that publish AI-generated content in their marketing, the middle category is the most relevant. Infringements of Article 50 (transparency and labelling obligations) fall under Article 99(4) and can therefore be fined with up to EUR 15 million or 3 percent of worldwide annual turnover. (Source: Regulation (EU) 2024/1689, Article 99(4))

The short, quotable version: if you fail to label AI images, AI videos or deepfakes where the obligation applies, you risk fines of up to EUR 15 million or 3 percent of worldwide annual turnover from August 2026.

When do the penalties apply?

The timing often causes confusion in practice, so it is worth being precise.

The penalties under Article 99 have been legally applicable since 2 August 2025. That does not mean, however, that every obligation has applied since then. Fines only take effect once the underlying obligation applies.

For the transparency obligations in Article 50, which cover AI images, AI videos and chatbots, the relevant date is 2 August 2026. (Source: European Commission, Digital Strategy, “AI Act”, as of 11 May 2026)

Important: following the Commission proposal of 19 November 2025 and the political agreement of 7 May 2026, the Digital Omnibus (also called the AI Omnibus) postponed the deadlines for certain high-risk AI systems to 2 December 2027 and 2 August 2028 respectively. The transparency rules are not affected and remain applicable from 2 August 2026. (Source: European Commission, Digital Strategy, 2026)

Relief for SMEs and startups

An important point that is often overlooked: Article 99(6) of the Regulation provides explicit relief for small and medium-sized enterprises (SMEs) and startups. Specifically, for these groups the lower of the percentages or amounts set out in paragraphs 3, 4 and 5 applies. (Source: Regulation (EU) 2024/1689, Article 99(6))

In practice, this means a startup with five employees and low turnover does not have to expect the same multi-million-euro penalties as a multinational group. The fine is still capped at the top, but there is no fixed lower limit.

The AI Omnibus has also extended some simplified requirements to small mid-cap companies (SMCs), for example simplified requirements for technical documentation. (Source: European Commission, Digital Strategy, 2026)

How do authorities decide on the actual amount of a fine?

Article 99 does not prescribe a rigid formula. Instead, the Regulation gives the competent national authorities a margin of discretion. In every decision on whether to impose a fine and in what amount, all relevant circumstances of the individual case are taken into account.

According to the Regulation, the typical factors include:

• The nature, gravity and duration of the infringement and its consequences
• The number of people affected and the level of damage suffered
• Previous fines imposed on the same operator
• The size, annual turnover and market share of the company
• Cooperation with the supervisory authorities
• Aggravating or mitigating circumstances

(Source: Regulation (EU) 2024/1689, Article 99(7))

A practical rule of thumb follows from these criteria: anyone who reports an infringement themselves, remedies it quickly and cooperates transparently with the authorities has a good chance of a considerably lower penalty. Anyone who tries to withhold information or obstruct the investigation, on the other hand, should expect the full force of the law.

Beyond fines: reputational and liability risks

A fine is not the only risk of missing labels. For marketing and communications teams, three further areas of risk matter in practice.

First, reputational damage. If it becomes known that a company published AI content without labelling it, public trust can suffer lasting harm. In sectors with high credibility requirements (finance, healthcare, B2B software), the reputational damage often weighs more heavily than the fine itself.

Second, claims under competition law. Competitors or consumer protection associations can send cease-and-desist letters under national competition law (in Germany, for example, under the Unfair Competition Act, UWG) if advertising is considered misleading. AI content that can be perceived as real is particularly vulnerable here.

Third, civil liability. Where unlabelled deepfakes infringe personality rights, the people affected can bring claims for injunctive relief and damages. These are to be assessed independently of the AI Act fines.

These three areas of risk are cumulative. A single unlabelled spot can trigger a fine under Article 99, a cease-and-desist letter, a lawsuit and a social media storm all at once.

A practical guide: four steps to reduce your risk

The penalty framework and the Commission’s official implementation guidance point to four concrete measures.

First, build an AI inventory. Record all AI systems in your company that generate or manipulate content. For each system, assess whether labelling obligations can arise.

Second, define clear responsibilities. Decide who in the company is responsible for labelling AI content. Without named ownership, gaps arise that can reinforce an accusation of negligence if something goes wrong.

Third, document your processes. Keep a simple register of the tools used, the content produced and the labels applied. If the supervisory authorities ask questions, orderly documentation is a significant help.

Fourth, use the official channel. The European Commission’s AI Act Service Desk at ai-act-service-desk.ec.europa.eu is the central point of contact for questions about implementation. The voluntary AI Pact also offers support for early implementation. (Source: European Commission, Digital Strategy, 2026)

To avoid getting that far in the first place, our AI labelling kit with checklist shows which AI content you need to label, and how.

Conclusion: compliance is an investment, not a cost

The fines under the EU AI Act are substantial, but above all they are proportionately tiered. If you take the labelling obligations seriously, communicate transparently and document your processes, you are on the safe side.

Experience with the GDPR since 2018 also shows that in the first twelve to 18 months after a deadline, supervisory authorities typically work with guidance, warning letters and smaller fines. The first large penalties almost always hit big corporations, not mid-sized companies. You should not rely on that, though: if you commit an infringement, you have committed it, regardless of when it is discovered.

At ThatWorksMedia, we help companies produce and label AI content properly, so that compliance does not become a burden but the basis for trustworthy brand communication. Less noise. More signal.

Disclaimer: not legal advice

This blog post does not constitute legal advice. It is intended solely as general information on the EU AI Act’s penalty framework under Article 99 of Regulation (EU) 2024/1689.

The information presented is based on publicly available sources of the European Commission (in particular digital-strategy.ec.europa.eu, as of 11 May 2026) and on the text of Regulation (EU) 2024/1689, and reflects the state of knowledge at the time of publication. The specific amount of any fine is at the discretion of the competent national supervisory authorities. How high a penalty is in an individual case depends on many factors and cannot be predicted in general terms. In addition, some detailed questions have not yet been conclusively clarified by the courts.

For a binding interpretation in an individual case, in particular for assessing specific risks in your company, please consult a specialist lawyer for IT and media law. Binding information on the AI Act is available from the European Commission’s official AI Act Service Desk at ai-act-service-desk.ec.europa.eu and in the full text of Regulation (EU) 2024/1689 in the Official Journal of the European Union.

ThatWorksMedia accepts no liability for the currency, accuracy or completeness of the information provided, or for any action taken or omitted on the basis of this post.

Editorially reviewed by Johannes Westphal, CEO of That Works Media, in September 2026.