EU AI Act Fines Explained: The SME Cap Most Articles Miss

Short answer: Fines are tiered: up to €35 million or 7% of global annual turnover for prohibited practices; up to €15 million or 3% for most other breaches including transparency and provider obligations; and up to €7.5 million or 1% for supplying incorrect or misleading information to authorities. For SMEs and startups, each cap applies as the lower of the fixed sum or the percentage — the reverse of how it works for large companies.

General information, not legal advice.

The three tiers

Tier one — prohibited practices. Up to €35 million or 7% of total worldwide annual turnover for the preceding financial year. Reserved for the banned uses: social scoring, certain manipulative techniques, untargeted facial image scraping, emotion inference in workplaces and education, and specified biometric applications.

Tier two — most other obligations. Up to €15 million or 3% of worldwide annual turnover. This covers provider and deployer obligations, transparency requirements under Article 50, and notified body duties. This is the tier most businesses would ever encounter.

Tier three — incorrect information. Up to €7.5 million or 1% for supplying incorrect, incomplete or misleading information to notified bodies or national authorities.

General-purpose AI model providers face a separate regime, with the Commission able to impose fines up to €15 million or 3% of worldwide turnover — powers that became exercisable from 2 August 2026.

The SME provision that changes the arithmetic

For large companies, each tier applies as whichever figure is higher — so a large firm faces the greater of €15 million or 3%. For SMEs, including startups, the Act specifies that each cap applies as whichever is lower.

For a small business, 3% of turnover is a far smaller number than €15 million, so the percentage governs. The headline figures that dominate the coverage are structurally inapplicable to a business turning over a few hundred thousand pounds.

This is not a reason to ignore the rules. It is a reason to reject the framing that a small consultancy faces existential fines for a missing chatbot notice.

How penalties are actually determined

The Act requires that fines be effective, proportionate and dissuasive, with authorities taking into account a list of factors including:

• The nature, gravity and duration of the infringement.
• Whether other authorities have already fined the same operator for the same conduct.
• The size, annual turnover and market share of the operator.
• Any financial benefit gained or loss avoided.
• Whether the infringement was intentional or negligent.
• Actions taken to mitigate harm.
• The degree of cooperation with authorities.

The Act also expressly requires that the interests of SMEs and their economic viability be taken into account. Documented good-faith effort matters materially to where you land within a range.

The risk that's more likely than a fine

For a small business, the realistic exposure isn't a regulator's penalty notice. It's three quieter things:

• Failed procurement. Larger clients increasingly require evidence of AI governance from suppliers. No policy, no contract.
• Contractual liability. If AI output causes a client loss and you had no documented controls, your position is weak regardless of regulation.
• Employment and data protection exposure. An untrained employee causing a data breach through an AI tool engages UK GDPR, where the ICO has an established enforcement record.

Proportionate compliance addresses all three, which is the actual business case.

Who enforces this

National market surveillance authorities in each member state, with penalties set by national law within the Act's ceilings. The AI Office handles general-purpose AI models at EU level. There is no single pan-EU enforcement body for the rest, which means practice will vary between member states in the early years.

Frequently asked questions

Have any fines been issued yet?

Enforcement powers for the earlier obligations became exercisable from August 2025 and 2026 respectively. Check current enforcement news rather than relying on any article's snapshot.

Does the SME cap apply automatically?

It's in the Act's penalty provisions. Whether your business meets the SME definition depends on the EU thresholds for headcount and turnover.

What's the cheapest way to reduce exposure?

An AI use register, a two-page usage policy, recorded training, and transparency notices where they apply. Days of work, not months.

We help businesses find the obligations that genuinely apply — without the scare tactics. Start a free assessment.