Docs

Appearance

Operationalize the EU AI Act in Modulos

Penalties and enforcement ​

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) has these rules on enforcement and penalties:

  • Articles 70, 74, 75 to 75d, 88, and 91 to 93 — the authorities that enforce the EU AI Act, and their competences and powers.
  • Article 113 — the dates from which the penalties and the enforcement powers apply.
  • Articles 99 to 101 — the rules on penalties and the maximum administrative fines.
  • Advice and complaints — the European Artificial Intelligence Board (Article 66), the Scientific Panel, the Advisory Forum, and the complaint tools of the AI Office.

Enforcement authorities ​

Three groups of authorities enforce the EU AI Act: the national competent authorities, the European Data Protection Supervisor (EDPS), and the Commission. The Commission acts through the AI Office. These authorities have these competences:

  • National competent authorities — Each Member State must "establish or designate as national competent authorities at least one notifying authority and at least one market surveillance authority" (Article 70(1)). These authorities enforce the rules for the AI systems that are not in the competence of the AI Office or the EDPS.

    Article 74(8) covers high-risk systems in Annex III, points 6, 7 and 8. It also covers point 1 systems used for law enforcement, border management, and justice and democracy. For these systems, Member States must designate one of these as the market surveillance authority:

    • The competent data protection supervisory authority in Regulation (EU) 2016/679 or Directive (EU) 2016/680.
    • A different authority designated on the same conditions as those in Articles 41 to 44 of Directive (EU) 2016/680.

    Article 74(8) also protects judicial independence:

    Market surveillance activities shall in no way affect the independence of judicial authorities, or otherwise interfere with their activities when acting in their judicial capacity.

  • The EDPS — The EDPS is the market surveillance authority for the Union institutions, bodies, offices, and agencies in the scope of the EU AI Act (Article 74(9)). The Court of Justice of the European Union in its judicial capacity is an exception. The EDPS can impose fines on these Union institutions, bodies, offices, and agencies (Article 100).

  • The AI Office — Article 3(47) defines the AI Office as a function of the Commission in the Commission Decision of 24 January 2024. References to the AI Office in the EU AI Act are references to the Commission. The AI Office is exclusively competent for the supervision and enforcement of the EU AI Act for these AI systems (Article 75(1)):

    • AI systems "based on general-purpose AI models where the model and the system are developed by the same provider, or by providers forming part of the same undertaking as that provider". Article 75(1)(a) gives four exceptions:
      • AI systems related to products in Annex I
      • AI systems in Annex III point 2
      • AI systems "provided by" law enforcement authorities, border management authorities, and financial institutions, "insofar as those AI systems fall under Article 74(6)"
      • AI systems in Annex III point 8 for the administration of justice.
    • AI systems that are, or that are integrated into, a "very large online platform or very large online search engine designated in accordance with Regulation (EU) 2022/2065".

    This competence applies to the providers of these AI systems. It applies to their deployers only when the deployer is also the provider or is part of the same undertaking as the provider. For these AI systems, Articles 75a to 75d give the AI Office the powers of a market surveillance authority. They also let it impose fines and periodic penalty payments (Article 75c).

    For operators in the scope of Article 75(1), Article 75c(4) applies Article 99(3) to (7) to AI Office enforcement with the necessary adaptations. The Article 99(4) fine category also covers:

    • infringements of applicable provisions not listed in Article 99(4)
    • failure to comply with decisions or measures adopted through the powers in Article 14(4) or Article 16(3) of Regulation (EU) 2019/1020, or Article 75a
    • failure to comply with commitments made binding by a decision in Article 75b.

    Article 75c(4) also applies the Article 99(5) category to "incorrect, incomplete or misleading information" supplied to the AI Office "in reply to a request".

  • The Commission, for general-purpose AI models — The Commission has "exclusive powers to supervise and enforce Chapter V", and it entrusts these tasks to the AI Office (Article 88(1)). The Commission has the "Power to request documentation and information" in Article 91 and the "Power to request measures" in Article 93. Where "necessary and appropriate", the Commission "may request providers to" "restrict the making available on the market, withdraw or recall the model" (Article 93(1)(c)). The AI Office can do evaluations of a model (Article 92).

Enforcement dates ​

In the EU AI Act, Chapter XII on penalties applies from 2 August 2025. But Article 101 on fines for providers of general-purpose AI models applies from 2 August 2026 (Article 113, second paragraph and point (b)). Chapter IX, with market surveillance and the Commission powers for general-purpose AI models, applies from 2 August 2026, but Article 78 on confidentiality applies from 2 August 2025 (Article 113, point (b)). For all dates, see Dates.

The Commission page "The enforcement framework of the AI Act" (last update: 6 October 2026) gives the enforcement dates. It tells providers and deployers that the enforcement powers of the AI Office and the national competent authorities apply from 2 August 2026. For other provisions, the enforcement powers "will start to apply only when those provisions become applicable".

Penalties and maximum fines ​

The Member States make the rules on penalties and other enforcement measures for infringements of the EU AI Act by operators (Article 99(1)). These penalties must be "effective, proportionate and dissuasive". When imposing penalties, Member States must "take into account" the interests and economic viability of SMEs, also start-ups, and SMCs (Article 99(1)).

Each Member State must make rules on how far administrative fines can apply to public authorities and bodies established in that Member State (Article 99(8)). Article 99 gives the maximum administrative fines. For an undertaking, the maximum is the EUR value or the percentage of its total worldwide annual turnover for the preceding financial year, "whichever is higher":

InfringementMaximum fineProvision
Non-compliance with the prohibition of the AI practices in Article 5EUR 35 000 000 or 7%Article 99(3)
Non-compliance with the obligations in Articles 16, 22, 23, 24, 25(2) and (4), 26, and 50, and with the notified-body provisions in Articles 31, 33(1), (3), and (4), and 34EUR 15 000 000 or 3%Article 99(4)
The supply of "incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request"EUR 7 500 000 or 1%Article 99(5)

For SMEs, also start-ups, each of these fines has the lower of the two maximums (Article 99(6)). For SMCs, the lower maximum applies only to the fines in Article 99(4) and (5) (Article 99(6a)). For each decision on a fine, Article 99(7) gives this rule: "all relevant circumstances of the specific situation shall be taken into account". Article 99(7) also lists factors, for example "the nature, gravity and duration of the infringement".

The EU AI Act gives two more groups of fines:

  • Union institutions, bodies, offices, and agencies — The EDPS can impose fines of up to EUR 1 500 000 for non-compliance with Article 5. For non-compliance with other requirements or obligations, the maximum is EUR 750 000 (Article 100(2) and (3)).
  • Providers of general-purpose AI models — The Commission can impose fines on these providers (Article 101(1)). The maximum is 3% of their annual total worldwide turnover in the preceding financial year or EUR 15 000 000, "whichever is higher". The Commission can do this only when it finds that the provider intentionally or negligently did one of these:
    • "infringed the relevant provisions of this Regulation"
    • "failed to comply with a request for a document or for information pursuant to Article 91, or supplied incorrect, incomplete or misleading information"
    • did not comply with a measure requested in Article 93
    • did not give the Commission access to the model for an evaluation in Article 92.

Advice and complaint tools ​

The European Artificial Intelligence Board "shall advise and assist the Commission and the Member States in order to facilitate the consistent and effective application of this Regulation" (EU AI Act Article 66). It can issue recommendations and written opinions on the development and application of codes of conduct and codes of practice (Article 66(e)(i)).

The Commission appointed a Scientific Panel and an Advisory Forum. These two groups give advice to the AI Office and to national authorities about the application of the rules (Commission publication of 1 June 2026). The AI Office has three tools for complaints and reports:

  • the AI Act Complaints Tool, for complaints about providers of AI systems that the AI Office supervises
  • the AI Act Whistleblower Tool, for persons who work with providers of AI systems or general-purpose AI models
  • a "complaints channel for downstream providers", for providers of AI systems that integrate a general-purpose AI model of a different provider.

Sources ​

Disclaimer

This page gives general information. It is not legal advice.