AI Act

What fines does the AI Act carry and who actually gets them

The top rates go up to €35 million or 7% of worldwide turnover. But for most companies, the risk isn't a fixed price list of fines.

There's a lot of scaremongering about AI Act fines, and a lot of downplaying too. The truth is more specific than either.

The official fine rates

  • Up to €35 million or 7% of worldwide turnover for prohibited AI practices, such as manipulative systems or social scoring.
  • Up to €15 million or 3% of turnover for breaching most of the regulation's other obligations.
  • Up to €7.5 million or 1% of turnover for supplying false information to the authorities.

These caps target mainly companies that develop, sell or deploy AI in high-risk areas. An ordinary company using ChatGPT for work doesn't need to fear them. Its risk looks different.

What missing training actually threatens

For Article 4 itself. The AI literacy obligation. The regulation sets no fixed fine. Enforcement is in the hands of national authorities, and the European Commission states that penalties are most likely when an incident occurs and training was missing. Missing training then counts as an aggravating circumstance.

The real risk isn't the price list of fines, but full liability for the damage an untrained person does with AI. A data leak through a public chatbot is also a GDPR breach, and that one has its own price list.

Who actually pays

In practice, the one who pays is the one where the incident happens and who has nothing to put on the table. The first question from the inspector and from the insurer is the same: what measures did you take? Whoever pulls out training records is done in a few minutes. Whoever can't, bears full liability, and on top of that, it looks like they didn't care.

How you get covered

Training that matches what your people do, a certificate for each of them, and records you can export at any time. Solutions by company size are on the AI Act & compliance page.

Frequently asked questions

Will I get fined if I have no training?

There is no fixed fine in the regulation for missing training alone. The risk is indirect: in an incident, missing training counts as an aggravating circumstance and the company bears full liability for the damage.

Do the €35 million rates apply to small companies too?

The caps are set as maximums and are tied mainly to prohibited practices and high-risk systems. For ordinary AI use in a company, liability for damage and the GDPR matter more.

Did the 2026 amendment change anything about the fines?

The obligation to train stayed. The wording of Article 4 changed so that you no longer have to guarantee a specific level of knowledge for a specific person. Training and a record of it are still how you meet the obligation.

Not sure how this fits your company? We'll go through it in 30 minutes.

Free AI consultation