Almost everything published about the AI Act opens with the same figure: 35 million euros, or 7% of worldwide turnover. It works as a headline because it scares — and it scares because it's real.
What rarely travels with the headline are the three things that determine whether it reaches you: for which conduct, in which bracket, and under which calculation rule if you are an SME.
The three brackets, and what each one punishes
Art. 99 of Regulation (EU) 2024/1689 doesn't set one fine: it sets three, and the difference between them is not one of degree but of conduct.
- Art. 99(3) — up to EUR 35 000 000 or 7%. This is the headline bracket, and it punishes “non-compliance with the prohibition of the AI practices referred to in Article 5”. Prohibited practices: harmful subliminal manipulation, exploitation of vulnerabilities, social scoring, emotion inference at work or school, and the rest of Art. 5.
- Art. 99(4) — up to EUR 15 000 000 or 3%. Non-compliance with the provisions the paragraph itself lists, related to operators or notified bodies. It is a closed list when the one imposing the fine is a national authority — which is the case for a company deploying AI: an article that isn't on it doesn't come in through this bracket. The AI Office, whose exclusive competence reaches the providers of systems built on their own general-purpose models — and a deployer only where it is also the provider — is not bound by that list (Article 75c(4) of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744).
- Art. 99(5) — up to EUR 7 500 000 or 1%. Supplying incorrect, incomplete or misleading information to notified bodies or competent authorities.
The figure that circulates as "the AI Act fine" is therefore the one for the gravest bracket, reserved for conduct the Regulation bans outright. It is not the penalty for an out-of-date inventory or a chatbot without a disclosure notice.
The rule that changes the maths for an SME
In all three brackets, the formula for a company is "up to X euros or up to Y% of worldwide turnover, whichever is higher". That is: for a large company, the reference is the higher of the two magnitudes.
Art. 99(6) inverts that logic for SMEs:
“In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower.”
Two expressions deserve attention, and both tend to get lost in summaries.
"Lower". Where a large company faces the higher of the two magnitudes, an SME's fine is capped at the lower one. For a company with modest turnover, the percentage is always far below the fixed amount — so the realistic reference stops being the headline.
"Up to". A ceiling is not a price list. The paragraph caps the fine; it does not set it at the cap. Art. 99(7) requires that, in each individual case, all relevant circumstances of the specific situation be taken into account. Writing "for SMEs, the lower amount applies" would be exactly the kind of simplification this series keeps flagging: right in its direction, wrong in its form.
On top of that, the Regulation itself instructs that the interests of SMEs and their economic viability be taken into account when laying down the penalty regime, and Art. 99 requires weighing every circumstance of the specific case.
Why the headline misleads more than it informs
Here is what rarely gets said, and it is what most changes the conversation in a mid-sized company: most AI uses in an SME are not in the EUR 35 million bracket — and many are in no high-risk bracket at all.
A productivity assistant, a drafting tool, a management system with AI for ordering tasks: none of that is a prohibited practice under Art. 5 nor, in general, a high-risk system. The cases that do escalate are specific and recognisable — by far the most frequent, automated screening of job applications, which comes in through Annex III.
The practical consequence is uncomfortable for the dominant narrative: an SME's typical problem is not exposure to an enormous fine — it is being unable to show where it stands. And those two things call for different work. The first calls for lawyers; the second, for a register.
What is worth having settled
None of these checks is done out of fear of the EUR 35 million. They are done because they answer the question that actually arrives: does this apply to us?
First: rule out Art. 5. It is a short list and its scenarios are recognisable. If none of your systems does any of it — and usually none does — the EUR 35 million bracket stops being your reference. Worth putting in writing, with a date: it is a conclusion someone will ask you to justify.
Second: know which systems, if any, are high-risk, and under which annex. It determines the applicable timeline, which is not a single one — the grace period depends on exactly that.
Third: separate your obligations from your vendors'. A good part of what gets attributed to the deployer belongs to the provider, and Art. 50 is the clearest example: the interaction disclosure belongs to the provider, not to whoever procures the tool.
Fourth: record when each conclusion was reached and who made it. Because what an authority, an auditing client or an insurer will ask for is not a figure: it will be the reasoning, with its date.
Fear is a poor inventory
A company that sets its AI strategy from the EUR 35 million headline ends up in one of two places: paralysed, or spending on advice for a risk it doesn't have.
The alternative is not to stop caring. It is being able to answer, at any moment, which systems are in use, how each one is classified, who decided it and when it was last reviewed. With that, the question about fines answers itself in most cases — and in the few where it doesn't, it gets answered with data instead of a headline.
What makes that unsustainable by hand is not its difficulty. It is that answers age: systems change, use changes, and — as this series keeps showing — the law changes. A document nobody knows when it was last reviewed proves nothing, however complete it was the day it was written.
Content under Article 99 of Regulation (EU) 2024/1689. The amounts and the paragraph 6 rule are quoted in their current wording.
This article is for informational purposes only and does not constitute legal advice.